[go: up one dir, main page]

EP1102216B1 - System and method for automatically checking the passage of a frontier - Google Patents

System and method for automatically checking the passage of a frontier

Info

Publication number
EP1102216B1
EP1102216B1 EP99125349A EP99125349A EP1102216B1 EP 1102216 B1 EP1102216 B1 EP 1102216B1 EP 99125349 A EP99125349 A EP 99125349A EP 99125349 A EP99125349 A EP 99125349A EP 1102216 B1 EP1102216 B1 EP 1102216B1
Authority
EP
European Patent Office
Prior art keywords
data
automated
identification medium
system user
personal
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Expired - Lifetime
Application number
EP99125349A
Other languages
German (de)
French (fr)
Other versions
EP1102216A2 (en
EP1102216A3 (en
Inventor
Markus Hellenthal
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
ACCENTURE GMBH
Original Assignee
Accenture GmbH Germany
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Accenture GmbH Germany filed Critical Accenture GmbH Germany
Publication of EP1102216A2 publication Critical patent/EP1102216A2/en
Publication of EP1102216A3 publication Critical patent/EP1102216A3/en
Application granted granted Critical
Publication of EP1102216B1 publication Critical patent/EP1102216B1/en
Anticipated expiration legal-status Critical
Expired - Lifetime legal-status Critical Current

Links

Images

Classifications

    • G—PHYSICS
    • G07—CHECKING-DEVICES
    • G07C—TIME OR ATTENDANCE REGISTERS; REGISTERING OR INDICATING THE WORKING OF MACHINES; GENERATING RANDOM NUMBERS; VOTING OR LOTTERY APPARATUS; ARRANGEMENTS, SYSTEMS OR APPARATUS FOR CHECKING NOT PROVIDED FOR ELSEWHERE
    • G07C9/00—Individual registration on entry or exit
    • G07C9/10—Movable barriers with registering means
    • G07C9/15—Movable barriers with registering means with arrangements to prevent the passage of more than one individual at a time
    • G—PHYSICS
    • G07—CHECKING-DEVICES
    • G07C—TIME OR ATTENDANCE REGISTERS; REGISTERING OR INDICATING THE WORKING OF MACHINES; GENERATING RANDOM NUMBERS; VOTING OR LOTTERY APPARATUS; ARRANGEMENTS, SYSTEMS OR APPARATUS FOR CHECKING NOT PROVIDED FOR ELSEWHERE
    • G07C9/00—Individual registration on entry or exit
    • G07C9/20—Individual registration on entry or exit involving the use of a pass
    • G07C9/22—Individual registration on entry or exit involving the use of a pass in combination with an identity check of the pass holder
    • G07C9/25—Individual registration on entry or exit involving the use of a pass in combination with an identity check of the pass holder using biometric data, e.g. fingerprints, iris scans or voice recognition
    • G07C9/257—Individual registration on entry or exit involving the use of a pass in combination with an identity check of the pass holder using biometric data, e.g. fingerprints, iris scans or voice recognition electronically
    • G—PHYSICS
    • G07—CHECKING-DEVICES
    • G07C—TIME OR ATTENDANCE REGISTERS; REGISTERING OR INDICATING THE WORKING OF MACHINES; GENERATING RANDOM NUMBERS; VOTING OR LOTTERY APPARATUS; ARRANGEMENTS, SYSTEMS OR APPARATUS FOR CHECKING NOT PROVIDED FOR ELSEWHERE
    • G07C9/00—Individual registration on entry or exit
    • G07C9/20—Individual registration on entry or exit involving the use of a pass
    • G07C9/27—Individual registration on entry or exit involving the use of a pass with central registration

Definitions

  • the present invention relates to a system and method for automatically controlling the passage of a boundary.
  • Border controls z. As at airports, but also in the field of land and ferry services are time-critical for cross-border passenger transport. At the same time, the effort of the control authorities has increased disproportionately to the number of passengers in recent years, partly because of the Schengen Agreement. The increasing mobility of people and increasing numbers of passengers in international air traffic have led to new requirements in passenger transport. On the other hand, the human and financial resources of the state control authorities, airlines and airport operators, as well as the spatial conditions at many international airports are increasingly limited.
  • the invention is therefore based on the object to increase the speed of passenger traffic.
  • the device for collecting personal data from system users a device for automatically reading the personal data having.
  • the device for automatically reading the personal data may be a scanner.
  • the means for acquiring biometric data comprises means for detecting a fingerprint and / or the retinal structure and / or the facial features and / or the voice and / or speech of a respective system user.
  • a further particular embodiment of the system is characterized by a device for processing the acquired biometric data and conversion into one or more representative data feature (s), by means of which a recognition of the system user during the control is possible.
  • the device for storing data has a device for encrypting the personal and / or identification medium data and for generating an identification medium-specific key.
  • the encryption device is a locally provided security module or is located in a background system which is connected via an on-line data connection.
  • the device for storing the data preferably has a device for electrical personalization of the encrypted data in the identification medium and / or a device for applying the personal data and possibly a photo and the signature of the respective system user to the identification medium.
  • the personal data can be applied to the identification medium by thermal transfer printing.
  • the device for storing the data advantageously has a device for coating the identification medium with a laminate film. Through the laminate film, the identification medium is forgery-proof.
  • the identification media are smart cards.
  • At least one video camera is provided in the passage lock. This allows monitoring of the passage lock, in particular with regard to the provision of an effective separation.
  • the device for reading the data stored on the identification media has a device for calculating the identification medium-specific key from the encrypted identification medium data and verification thereof. This makes it possible to carry out a card legitimation check.
  • the means for reading the data stored on the identification medium preferably comprises means for decrypting the encrypted personal data and verifying the same. This enables a personal legitimacy check.
  • Another particular embodiment of the invention is characterized by means for generating and distributing keys for data encryption and monitoring system operation.
  • Such a device fulfills the function of a TrustCenter.
  • a further particular embodiment of the invention is characterized by a device for managing and monitoring, in particular, the lifetime of all identification media issued to system users.
  • Another particular embodiment of the invention is characterized by means for cryptographically encrypting data transmitted between devices of the system and / or between the system and external devices. This is to protect against unauthorized access to the transmitted data.
  • the invention is based on the surprising finding that an integration of the official controls in the overall process with a part of the control is preferred in principle, an acceleration and simplification of the settlement of border traffic is achieved without that suffers the quality of control.
  • Control which is at least in part preferable, can make it easier and faster to control border controls on pre-screened, unproblematic travelers, thus allowing police and control forces to focus on potential offenders and threats.
  • the advance check allows a machine check of the police unproblematic cross-border passenger traffic with all the individual components, which also includes a border control by police officers, namely person comparison, authenticity of border crossing documents, search inquiry, permission of the border crossing.
  • a border control by police officers namely person comparison, authenticity of border crossing documents, search inquiry, permission of the border crossing.
  • travelers classified as unproblematic from a police point of view are currently automatically identified by means of personal data and biometric data on their identification media and cross-checked via an on-line search inquiry ,
  • Figure 1 shows a plan view of part of a system according to a particular embodiment of the invention.
  • the part shown concerns the control of system users directly at a border (eg national border).
  • Figure 1 shows a passage lock 10 with an input 12 and an output 14.
  • the input 12 and the output 14 are each with a Revolving door 16 or 18 provided.
  • the separation can be mechanical, but also z. B. be carried out optically.
  • a traffic light can be used for this purpose. If the traffic light is green, a single person may pass. If a person goes on red, an audible and / or audible alarm will sound.
  • the transit lock 10 contains a biometric data reader 22.
  • the card reader 20 and the biometric data reader 22 are connected to a local server of the Federal Border Guard (not shown).
  • a video camera 24 for monitoring the mechanical separation of the system users is located in the passage lock 10.
  • FIG. 2 schematically shows the essential devices individually or in blocks of the system.
  • a system block, designated by the reference numeral 26, relates to the application and issuing of a card (so-called enrollment center).
  • the card in the form of a smart card 28 serves as an authorization card for each system user. It is checked at the border crossing in the part of the system shown in FIG. 1, which is designated here as a decentralized automated border control system 30.
  • the decentralized automated border control system 30 comprises a local server of the Federal Border Guard, which is connected via a service server 32 of the Federal Border Guard with a search database 34 of the INPOL, a trust center 36, a central data management device 38 of the Federal Border Guard and the Enrollment Center 26.
  • the fingerprint of the potential system user is detected by means of a fingerprint reader (not shown).
  • the data obtained by the fingerprint reader are converted by the processing software into one or more representative data characteristics, which makes it possible to recognize the system user in the border control.
  • a test is made for duplicates, that is, it is checked whether the applicant is already recorded in the system.
  • the previously recorded personal data are supplemented by the biometric data and given for encryption. This is done either on the local system in a dedicated security module or in a background system to which an on-line data connection is switched for this purpose.
  • the encrypted data are electrically personalized in the Enrollment Center into a smart card blank and the personal data is applied to the smart card body in thermal transfer printing.
  • a photograph of the system user and his / her personal details may also be printed.
  • the smart card body is coated with a tamper-proof laminate film. All these steps are running in one machine and are monitored by the PC.
  • the smart card is handed over to the system user. The entire enrollment takes less than 10 minutes. The card application and issue can also be made simultaneously with the initial use of the system at the local border.
  • the collection software ensures that smart cards are issued only with the assistance of legitimate border control officials, only after successful completion of all necessary steps, and only for exempt nationals of certain eligible states who hold a valid travel document.
  • the card control includes all the processes that are carried out during the cardholder's examination as part of the entry.
  • the card control takes place within a passage lock 10 (see FIG. 1) which the person to be checked must enter.
  • the passage lock itself can easily be integrated into the existing infrastructure, meaning that only minor structural changes are necessary.
  • the local server is used for process control and communication with external computers.
  • a mechanical separation by means of a mechanical separation takes place first in order to prevent the entry of unauthorized persons and several persons at the same time.
  • This measure is supplemented by the use of a video camera 24 in the passage lock 10 and corresponding image evaluation software.
  • the person to be checked is asked to insert the smart card into a card reader 20.
  • a security module (not shown) for authenticity verification of the smart card and the personal data stored thereon.
  • Each authentic smart card has a smart card-specific key that can be calculated and then verified based on certain smart card data from the security module in the card reader 20.
  • the communication between the smart card and the security module in the card reader 20 is additionally protected with a temporary key that has been previously negotiated between the smart card and the security module.
  • the personal data including biometric data
  • an appended signature MAC
  • MAC appended signature
  • the revolving door 16 can be rotated so that the person can enter the transit lock.
  • the biometric data reader 22 collects the fingerprint of the system user and makes a comparison with the biometric data stored on its smart card. For this purpose extracts are formed from the locally obtained data and compared with the data features stored in the smart card.
  • the required personal data will be forwarded to a search database of the INPOL for verification via the local server of the Federal Border police.
  • the design of the passage lock, the nature of the singulation technique used and the release at the output of the transit lock can depend on z.
  • the Trust Center 36 serves as a central system component for the administration of all security-relevant aspects of the system, thus in particular for the generation and distribution of keys and monitoring of the ongoing system operation.
  • the central data management device 38 of the Federal Border Guard serves to manage all issued smart cards with functions for monitoring the card life cycle.
  • the Card management also includes the application processing functions, ie the collection of personal data and biometric data.
  • a shell-like security architecture to secure central information and functions is advisable.
  • the goal of the architecture is to set up several hurdles that a potential attacker must overcome to manipulate the system.
  • the core is the personal data together with the biometric data. These data are considered as one unit in the system, ie biometric data is an element of the personal data record.
  • biometric data is an element of the personal data record.
  • About the personal data set is first using a secure hash method, eg., the SHA-1 algorithm generates a cryptographic checksum.
  • This 160-bit value has the typical properties of a good hash algorithm, that is, it is essentially collision-free.
  • the result of the algorithm is considered a part Cryptogram formation is used, since the entire personal data set is too large as the input date of the encryption.
  • the hash value compresses the content of the personal record to a greatly reduced form.
  • the hash value can not be used to deduce the original data. Changes in the personal data record inevitably result in a change in the hash value.
  • the Secure Hash method is not an encryption method, that is, it does not use keys.
  • the private key of an issuing office or the private key of a central authority is used.
  • the personal data record must be sent to the central entity for encryption and can only then be personalized to the smart card (eg by Online request).
  • the public key is needed to decrypt the extract. This is deposited in the control terminals. Decryption initially provides the personal data for the INPOL query and the hash value. The hash value is compared to a recalculated hash value. If equality can be assumed that a genuine record.
  • Each smart card in the system receives a unique serial number during manufacture. This serial number is the basis of the cryptographic processes that are actively performed by the smart card.
  • the smart card contains a smart card-specific key for authentication obtained by deriving the serial number under a master key.
  • the authentication takes place implicitly by reading the personal data in the so-called PRO mode.
  • the PRO mode is a variant of the read access introduced in ISO7816, in which the data transferred to the terminal are protected by a message authentication code (MAC). This MAC is regenerated dynamically with each read access, in order to exclude a so-called replay attack, ie the re-import of already read data.
  • MAC message authentication code
  • the MAC is generated within the operating system of the smart card using the card-specific authentication key and a random number supplied by the terminal.
  • the terminal contains in a security module (eg another smart card) a random number generator and the master key which is used to derive the smart card key under the smart card serial number.
  • the terminal automatically and immediately after reading the smart card data checks the MAC and rejects a card with a faulty MAC.
  • the MAC is generated dynamically by the smart card.
  • the necessary key must be present in the smart card.
  • a manipulation of the smart card, z. B. by duplicating, requires access to this card key, which is possible only with high financial costs.
  • the reading of the data is analogous to the symmetric method, with the exception that the MAC is generated by the asymmetric algorithm.
  • the transmission of data between devices of the system in particular the transmission of the data in the card issue is to be secured by cryptographic methods.
  • methods of line encryption are available, with which protected, transparent data channels can be built.
  • Another feature of the 5th shell is the intention to put all safety-relevant system facilities in the care of the border control authority. This is to ensure, from the point of view of the authority, that access to these system facilities is possible without their intervention and under any circumstances. This does not mean that all system facilities actually have to be located in the premises of the authority itself.
  • the technical operation could also be carried out by a representative of the authority, as long as the corresponding contractual warranty clauses prevent unauthorized access by third parties (including the operator).

Landscapes

  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Engineering & Computer Science (AREA)
  • Human Computer Interaction (AREA)
  • Lock And Its Accessories (AREA)
  • Time Recorders, Dirve Recorders, Access Control (AREA)
  • Diaphragms For Electromechanical Transducers (AREA)
  • Devices For Checking Fares Or Tickets At Control Points (AREA)
  • Collating Specific Patterns (AREA)

Abstract

The access control system detects personal data and biometric data for an individual, for checking the personal data against a wanted list and checking the biometric data against identification data provided by an identification medium carried by the individual, during movement of the individual between entry and exit gates (12,14), the authenticity of the identification medium verified before entering the entry gate. The operation of the entry gate is prevented when the identification medium is falsified and the operation of the exit gate is only permitted upon verification of all data.

Description

Die vorliegende Erfindung betrifft ein System und ein Verfahren zur automatisierten Kontrolle des Passierens einer Grenze.The present invention relates to a system and method for automatically controlling the passage of a boundary.

Grenzkontrollen z. B. an Flughäfen, aber auch im Bereich der Land- und Fährverkehre sind für den grenzüberschreitenden Personenverkehr zeitkritisch. Gleichzeitig ist der Aufwand der Kontrollbehörden - unter anderem wegen des Schengener Abkommens in den vergangenen Jahren überproportional zur Anzahl der Reisenden gestiegen. Die seit Jahren steigende Mobilität der Menschen und wachsende Passagierzahlen im internationalen Flugverkehr führen zu neuen Anforderungen im Personenbeförderungswesen. Andererseits sind die personellen und finanziellen Ressourcen der staatlichen Kontrollbehörden, der Luftverkehrsunternehmen und der Flughafenbetreiber sowie die räumlichen Gegebenheiten auf vielen internationalen Verkehrsflughäfen zunehmend begrenzt.Border controls z. As at airports, but also in the field of land and ferry services are time-critical for cross-border passenger transport. At the same time, the effort of the control authorities has increased disproportionately to the number of passengers in recent years, partly because of the Schengen Agreement. The increasing mobility of people and increasing numbers of passengers in international air traffic have led to new requirements in passenger transport. On the other hand, the human and financial resources of the state control authorities, airlines and airport operators, as well as the spatial conditions at many international airports are increasingly limited.

Durchgengsschleuse sind von US-A-458 64 41 bekannt.Durchgengsschleuse are known from US-A-458 64 41.

Der Erfindung liegt somit die Aufgabe zugrunde, die Geschwindigkeit des Passagierverkehrs zu erhöhen.The invention is therefore based on the object to increase the speed of passenger traffic.

Erfindungsgemäß wird diese Aufgabe gelöst durch ein System zur automatisierten Kontrolle des Passierens einer Grenze, mit:

  • einer Einrichtung zur Erfassung von Personendaten von Systembenutzern,
  • einer Einrichtung zur Erfassung von biometrischen Daten der Systembenutzer,
  • einer Einrichtung zur Weitergabe der Personendaten der Systembenutzer an eine Fahndungsdatenbank und Abfrage, ob der jeweilige Systembenutzer auf einer Fahndungsliste steht,
  • einer Einrichtung zum Speichern von Daten, die die Personendaten und biometrischen Daten des jeweiligen Systembenutzers umfassen, auf einem für jeden Systembenutzer vorgesehenen Identifikationsmedium und gegebenenfalls identifikationsmediumspezifischer Daten, wenn das Ergebnis der Fahndungsabfrage negativ ist,
  • einer vor einer Grenze angeordneten Durchgangsschleuse zum Regulieren des Durchgangs der Systembenutzer mit einem Eingang und einem Ausgang, wobei der Eingang und der Ausgang in Grundstellung verschlossen sind,
  • einer vor dem Eingang der Durchgangsschleuse angeordneten Einrichtung zur Vereinzelung der Systembenutzer,
  • einer hinter der Vereinzelungseinrichtung, aber vor dem Eingang der Durchgangsschleuse angeordneten Einrichtung zum automatisierten Lesen der auf den Identifikationsmedien gespeicherten Daten,
  • einer vor dem Eingang der Durchgangsschleuse angeordneten Einrichtung zur automatisierten Überprüfung der Echtheit der Identifikationsmedien,
  • einer vor dem Eingang der Durchgangsschleuse angeordneten Einrichtung zur automatisierten Überprüfung des Vorliegens einer Manipulation der Daten auf dem jeweiligen Identifikationsmedium,
  • einer Einrichtung zum automatisierten Öffnen des Eingangs der Durchgangsschleuse, wenn die Echtheit des jeweiligen Identifikationsmediums und keine Manipulation der Daten auf dem jeweiligen Identifikationsmedium festgestellt wurden,
  • einer in der Durchgangsschleuse befindlichen Einrichtung zum automatisierten Erfassen von biometrischen Daten eines hineingelassenen Systembenutzers,
  • einer Einrichtung zum automatisierten Vergleich der erfaßten biometrischen Daten mit den auf dem Identifikationsmedium des hineingelassenen Systembenutzers gespeicherten biometrischen Daten,
  • einer Einrichtung zum automatisierten Auslösen eines Alarmsignals, wenn die erfaßten und die auf dem jeweiligen Identifikationsmedium gespeicherten biometrischen Daten nicht übereinstimmen,
  • einer Einrichtung zur automatisierten Weitergabe der Personendaten an die Fahndungsdatenbank und zur automatisierten Abfrage, ob der Systembenutzer auf einer Fahndungsliste steht, und
  • einer Einrichtung zum automatisierten Öffnen des Ausgangs der Durchgangsschleuse und Ermöglichen eines Grenzübertritts des Systembenutzers, wenn das Ergebnis der Fahndungsabfrage negativ ist, und zur automatisierten Auslösung eines Alarmsignals, wenn das Ergebnis der Fahndungsabfrage positiv ist.
According to the invention, this object is achieved by a system for automatically controlling the passing of a border, comprising:
  • a device for collecting personal data from system users,
  • a device for capturing biometric data of system users,
  • a device for passing the personal data of the system users to a search database and querying whether the respective system user is on a wanted list,
  • means for storing data comprising the personal data and biometric data of the respective system user on an identification medium provided for each system user and, if appropriate, identification medium-specific data if the result of the search request is negative,
  • a pass-gate located in front of a boundary for regulating the passage of the system users to an input and an output, the input and the output being closed in the home position,
  • a device arranged in front of the entrance of the passage lock for separating the system users,
  • a device arranged behind the singulating device, but before the entrance of the throughput lock, for the automated reading of the data stored on the identification media,
  • a device arranged in front of the entrance of the through-lock for the automated verification of the authenticity of the identification media,
  • a device arranged in front of the entrance of the throughput lock for the automated checking of the presence of a manipulation of the data on the respective identification medium,
  • a device for the automated opening of the entrance of the transit lock, if the authenticity of the respective identification medium and no manipulation of the data were determined on the respective identification medium,
  • a through-lock facility for automatically capturing biometric data of an admitted system user,
  • a device for automated comparison of the acquired biometric data with the biometric data stored on the identification medium of the admitted system user,
  • a device for automatically triggering an alarm signal when the detected and the biometric data stored on the respective identification medium do not match,
  • a device for the automated transfer of personal data to the search database and for automatically querying whether the system user is on a wanted list, and
  • means for automatically opening the exit of the transit lock and allowing the system user to cross the border if the result of the search request is negative, and for automatically triggering an alert if the result of the search request is positive.

Weiterhin wird die Aufgabe gelöst durch ein Verfahren zur automatisierten Kontrolle des Passierens einer Grenze, das die folgenden Schritte umfaßt:

  • Erfassen von Personendaten von Systembenutzern,
  • Erfassen von biometrischen Daten der Systembenutzer,
  • Weitergabe der Personendaten der Systembenutzer an eine Fahndungsdatenbank und Vornahme einer Abfrage, ob der jeweilige Systembenutzer auf einer Fahndungsliste steht,
  • Speichern von Daten, die die Personendaten und biometrischen Daten des jeweiligen Systembenutzers umfassen, auf einem für jeden Systembenutzer vorgesehenen Identifikationsmedium und gegebenenfalls identifikationsmediumspezifischer Daten, wenn das Ergebnis der Fahndungsabfrage negativ ist,
  • Vereinzelung der einen Grenzübertrittsversuch unternehmenden Systembenutzer vor einer Durchgangsschleuse mit einem Eingang und einem Ausgang, wobei der Eingang und der Ausgang in Grundstellung geschlossen sind,
  • automatisiertes Lesen der auf dem Identifikationsmedium gespeicherten Daten,
  • automatisierte Überprüfung der Echtheit des jeweiligen Identifikationsmediums,
  • automatisiertes Überprüfen des Vorliegens einer Manipulation der Daten auf dem jeweiligen Identififkationsmedium,
  • automatisiertes Öffnen des Eingangs der Durchgangsschleuse, wenn die Echtheit des jeweiligen Identifikationsmediums und keine Manipulation der Daten auf dem jeweiligen Identifikationsmedium festgestellt werden,
  • automatisiertes Erfassen von biometrischen Daten eines in die Durchgangsschleuse hineingelassenen Systembenutzers,
  • automatisiertes Vergleichen der erfaßten biometrischen Daten mit den auf dem Identifikationsmedium des hineingelassenen Systembenutzers gespeicherten biometrischen Daten,
  • automatisiertes Auslösen eines Alarmsignals, wenn die erfaßten und die auf dem jeweiligen Identifikationsmedium gespeicherten biometrischen Daten nicht übereinstimmen,
  • automatisiertes Weitergeben der Personendaten an die Fahndungsdatenbank und automatisiertes Abfragen, ob der Systembenutzer auf einer Fahndungsliste steht, und
  • automatisiertes Öffnen des Ausgangs der Druchgangsschleuse, wenn das Ergebnis der Fahndungsabfrage negativ ist, bzw. automatisiertes Auslösen eine Alarmsignals, wenn das Ergebnis der Fahndungsabfrage positiv ist.
Furthermore, the object is achieved by a method for automatically controlling the passage of a boundary, comprising the following steps:
  • Collecting personal data from system users,
  • Collecting biometric data of system users,
  • Passing the personal data of the system user to a search database and making a query as to whether the respective system user is on a wanted list,
  • Storing data comprising the personal data and biometric data of the respective system user on an identification medium provided for each system user and optionally identification medium-specific data if the result of the search query is negative,
  • Separation of the system user undertaking a border-crossing attempt in front of a through-lock with an entrance and an exit, the entrance and the exit being closed in the basic position,
  • automated reading of the data stored on the identification medium,
  • automated verification of the authenticity of the respective identification medium,
  • automated checking for the presence of a manipulation of the data on the respective identification medium,
  • automated opening of the entrance of the transit lock, if the authenticity of the respective identification medium and no manipulation of the data on the respective identification medium are detected,
  • automated capture of biometric data of a system user admitted to the transit lock,
  • automated comparison of the acquired biometric data with the biometric data stored on the identification medium of the admitted system user,
  • automated triggering of an alarm signal when the detected and the biometric data stored on the respective identification medium do not match,
  • automated sharing of personal data with the search database and automated querying of whether the system user is on a wanted list, and
  • automated opening of the exit of the exit lock, if the result of the search query is negative, or automated triggering an alarm signal, if the result of the search request is positive.

Insbesondere kann bei dem System vorgesehen sein, daß die Einrichtung zur Erfassung von Personendaten von Systembenutzern eine Einrichtung zum automatischen Einlesen der Personendaten aufweist. Beispielsweise kann die Einrichtung zum automatischen Einlesen der Personendaten ein Scanner sein.In particular, it can be provided in the system that the device for collecting personal data from system users a device for automatically reading the personal data having. For example, the device for automatically reading the personal data may be a scanner.

Vorteilhafterweise umfaßt die Einrichtung zur Erfassung von biometrischen Daten eine Einrichtung zur Erfassung eines Fingerabdruckes und/oder der Netzhautstruktur und/oder der Gesichtsmerkmale und/oder der Stimme und/oder Sprache eines jeweiligen Systembenutzers.Advantageously, the means for acquiring biometric data comprises means for detecting a fingerprint and / or the retinal structure and / or the facial features and / or the voice and / or speech of a respective system user.

Eine weitere besondere Ausführungsform des Systems ist gekennzeichnet durch eine Einrichtung zur Verarbeitung der erfaßten biometrischen Daten und Umrechnung in ein oder mehrere repräsentative(s) Datenmerkmal(e), anhand dessen/derer eine Wiedererkennung des Systembenutzers bei der Kontrolle möglich ist.A further particular embodiment of the system is characterized by a device for processing the acquired biometric data and conversion into one or more representative data feature (s), by means of which a recognition of the system user during the control is possible.

Auch kann vorgesehen sein, daß die Einrichtung zur Speicherung von Daten eine Einrichtung zur Verschlüsselung der Personen- und/oder Identifikationsmediumdaten und zur Erzeugung eines identifikationsmediumspezifischen Schlüssels aufweist.It can also be provided that the device for storing data has a device for encrypting the personal and / or identification medium data and for generating an identification medium-specific key.

Ferner kann auch vorgesehen sein, daß die Verschlüsselungseinrichtung ein lokal vorgesehenes Sicherheitsmodul ist oder sich in einem Hintergrundsystem befindet, das über eine On-Line-Datenverbindung verbunden ist.Furthermore, it can also be provided that the encryption device is a locally provided security module or is located in a background system which is connected via an on-line data connection.

Vorzugsweise weist die Einrichtung zur Speicherung der Daten eine Einrichtung zur elektrischen Personalisierung der verschlüsselten Daten in dem Identifikationsmedium und/oder eine Einrichtung zum Aufbringen der Personendaten und gegebenenfalls eines Fotos sowie der Unterschrift des jeweiligen Systembenutzers auf das Identifikationsmedium auf. Beispielsweise können die Personendaten im Thermotransfer-Druck auf das Identifikationsmedium aufgebracht werden.The device for storing the data preferably has a device for electrical personalization of the encrypted data in the identification medium and / or a device for applying the personal data and possibly a photo and the signature of the respective system user to the identification medium. For example, the personal data can be applied to the identification medium by thermal transfer printing.

Günstigerweise weist die Einrichtung zur Speicherung der Daten eine Einrichtung zum Überziehen des Identifikationsmediums mit einer Laminatfolie auf. Durch die Laminatfolie wird das Identifikationsmedium fälschungssicher.The device for storing the data advantageously has a device for coating the identification medium with a laminate film. Through the laminate film, the identification medium is forgery-proof.

Vorzugsweise sind die Identifikationsmedien Smart Cards.Preferably, the identification media are smart cards.

Günstigerweise ist in der Durchgangsschleuse mindestens eine Videokamera vorgesehen. Dies ermöglicht eine Überwachung der Durchgangsschleuse insbesondere hinsichtlich der Vornahme einer wirksamen Vereinzelung.Conveniently, at least one video camera is provided in the passage lock. This allows monitoring of the passage lock, in particular with regard to the provision of an effective separation.

Weiterhin kann vorgesehen sein, daß die Einrichtung zum Lesen der auf den Identifikationsmedien gespeicherten Daten eine Einrichtung zum Berechnen des identifikationsmediumspezifischen Schlüssels aus den verschlüsselten Identifikationsmediumdaten und Verifikation desselben aufweist. Damit ist die Vornahme einer Kartenlegitimationsprüfung möglich.Furthermore, it can be provided that the device for reading the data stored on the identification media has a device for calculating the identification medium-specific key from the encrypted identification medium data and verification thereof. This makes it possible to carry out a card legitimation check.

Weiterhin weist die Einrichtung zum Lesen der auf dem Identifikationsmedium gespeicherten Daten vorzugsweise eine Einrichtung zum Entschlüsseln der verschlüsselten Personendaten und Verifikation derselben auf Dies ermöglicht eine Personenlegitimationsprüfung.Furthermore, the means for reading the data stored on the identification medium preferably comprises means for decrypting the encrypted personal data and verifying the same. This enables a personal legitimacy check.

Eine weitere besondere Ausführungsform der Erfindung ist gekennzeichnet durch eine Einrichtung zur Erzeugung und Verteilung von Schlüsseln für die Datenverschlüsselungen und Überwachung des Systembetriebes. Eine derartige Einrichtung erfüllt die Funktion eines TrustCenter.Another particular embodiment of the invention is characterized by means for generating and distributing keys for data encryption and monitoring system operation. Such a device fulfills the function of a TrustCenter.

Eine weitere besondere Ausführungsform der Erfindung ist gekennzeichnet durch eine Einrichtung zur Verwaltung und Überwachung insbesondere der Lebensdauer aller an Systembenutzer ausgegebener Identifikationsmedien.A further particular embodiment of the invention is characterized by a device for managing and monitoring, in particular, the lifetime of all identification media issued to system users.

Schließlich ist eine weitere besondere Ausführungsform der Erfindung gekennzeichnet durch eine Einrichtung zur kryptographischen Verschlüsselung von zwischen Einrichtungen des Systems und/oder zwischen dem System und externen Einrichtungen übertragenen Daten. Dies soll vor einem unerlaubten Zugriff auf die übertragenen Daten schützen.Finally, another particular embodiment of the invention is characterized by means for cryptographically encrypting data transmitted between devices of the system and / or between the system and external devices. This is to protect against unauthorized access to the transmitted data.

Die Unteransprüche 17 bis 26 betreffen vorteilhafte Weiterentwicklungen des erfindungsgemäßen Verfahrens.The dependent claims 17 to 26 relate to advantageous developments of the method according to the invention.

Der Erfindung liegt die überraschende Erkenntnis zugrunde, daß durch eine Integration der behördlichen Kontrollen in den Gesamtablauf wobei ein Teil der Kontrolle im Prinzip vorgezogen wird, eine Beschleunigung und Vereinfachung der Abwicklung des Grenzverkehrs erzielt wird, ohne daß darunter die Qualität der Kontrolle leidet. Durch die zumindest zum Teil vorgezogene Kontrolle kann die Kontrolle an der Grenze hinsichtlich der bereits vorab kontrollierten, unproblematischen Reisenden vereinfacht und verkürzt werden, wodurch eine Konzentration der Polizei- und Kontrollkräfte auf potentielle Täter und Gefahren möglich wird.The invention is based on the surprising finding that an integration of the official controls in the overall process with a part of the control is preferred in principle, an acceleration and simplification of the settlement of border traffic is achieved without that suffers the quality of control. Control, which is at least in part preferable, can make it easier and faster to control border controls on pre-screened, unproblematic travelers, thus allowing police and control forces to focus on potential offenders and threats.

Die vorab durchgeführte Kontrolle erlaubt eine maschinelle Überprüfung des polizeilich unproblematischen grenzüberschreitenden Reisendenverkehrs mit all den Einzelkomponenten, die auch eine Grenzkontrolle durch Polizeibeamte beinhaltet, nämlich Personenvergleich, Echtheitsprüfung von Grenzübertrittsdokumenten, Fahndungsabfrage, Gestattung des Grenzübertritts. Dabei werden unter Berücksichtigung aller nationalen, Schengener und EU-Anforderungen zuvor aus polizeilicher Sicht unproblematische eingestufte Reisende nach Antragstellung und auf freiwilliger Basis mittels auf ihren Identifikationsmedien gespeicherten Personendaten und biometrischen Daten beim Grenzübertritt jeweils aktuell maschinell identifiziert und über eine On-Line-Fahndungsabfrage polizeilich überpüft.The advance check allows a machine check of the police unproblematic cross-border passenger traffic with all the individual components, which also includes a border control by police officers, namely person comparison, authenticity of border crossing documents, search inquiry, permission of the border crossing. Taking into account all national, Schengen and EU requirements, travelers classified as unproblematic from a police point of view are currently automatically identified by means of personal data and biometric data on their identification media and cross-checked via an on-line search inquiry ,

Weitere Merkmale und Vorteile der Erfindung ergeben sich aus den Ansprüchen und aus der nachstehenden Beschreibung, in der ein Ausführungsbeispiel anhand der schematischen Zeichnungen im einzelnen erläutert ist. Dabei zeigt:

  • Figur 1 eine Draufsicht eines Teils eines Systems gemäß einer besonderen Ausführungsform der vorliegenden Erfindung; und
  • Figur 2 schematisch wesentliche Einrichtungen und Einrichtungsblöcke des Systems;
Further features and advantages of the invention will become apparent from the claims and from the following description in which an embodiment with reference to the schematic drawings is explained in detail. Showing:
  • Figure 1 is a plan view of part of a system according to a particular embodiment of the present invention; and
  • Figure 2 shows schematically essential equipment and equipment blocks of the system;

Figur 1 zeigt eine Draufsicht eines Teils eines Systems gemäß einer besonderen Ausführungsform der Erfindung. Der gezeigte Teil betrifft die Kontrolle von Systembenutzern direkt an einer Grenze (z. B. Landesgrenze). Figur 1 zeigt eine Durchgangsschleuse 10 mit einem Eingang 12 und einem Ausgang 14. Der Eingang 12 und der Ausgang 14 sind jeweils mit einer Drehtür 16 bzw. 18 versehen. Vor der Drehtür 16 am Eingang 12 befindet sich eine Einrichtung zur Vereinzelung der Systembenutzer (nicht gezeigt). Die Vereinzelung kann mechanisch, aber auch z. B. optisch durchgeführt werden. Beispielsweise kann dazu eine Ampel verwendet werden. Wenn die Ampel auf Grün steht darf eine einzelne Person passieren. Wenn eine Person bei Rot weitergeht, wird ein optischer und/oder akustischer Alarm ausgelöst. Zwischen dieser Einrichtung und der Drehtür 16 befindet sich ein Kartenlesegerät 20 zum Lesen von Smart Cards. Die Drehtür 16 ist in Grundstellung arretiert und verschließt somit den Eingang 12. In der Durchgangsschleuse 10 befindet sich ein Biometriedatenlesegerät 22. Das Kartenlesegerät 20 und das Biometriedatenlesegerät 22 sind mit einem lokalen Server des Bundesgrenzschutzes (nicht gezeigt) verbunden. In der Durchgangsschleuse 10 befindet sich darüber hinaus noch eine Videokamera 24 zur Überwachung der mechanischen Vereinzelung der Systembenutzer.Figure 1 shows a plan view of part of a system according to a particular embodiment of the invention. The part shown concerns the control of system users directly at a border (eg national border). Figure 1 shows a passage lock 10 with an input 12 and an output 14. The input 12 and the output 14 are each with a Revolving door 16 or 18 provided. In front of the revolving door 16 at the entrance 12 there is a device for separating the system users (not shown). The separation can be mechanical, but also z. B. be carried out optically. For example, a traffic light can be used for this purpose. If the traffic light is green, a single person may pass. If a person goes on red, an audible and / or audible alarm will sound. Between this device and the revolving door 16 is a card reader 20 for reading smart cards. The revolving door 16 is locked in the basic position and thus closes the input 12. The transit lock 10 contains a biometric data reader 22. The card reader 20 and the biometric data reader 22 are connected to a local server of the Federal Border Guard (not shown). In addition, a video camera 24 for monitoring the mechanical separation of the system users is located in the passage lock 10.

In Figur 2 sind schematisch die wesentlichen Einrichtungen einzeln bzw. in Blöcken des Systems gezeigt. Ein Systemblock, der mit dem Bezugszeichen 26 versehen ist, betrifft die Beantragung und Ausgabe einer Karte (sogenanntes Enrolment Center). Die Karte in Form einer Smart Card 28 dient als Berechtigungsausweis für jeden Systembenutzer. Sie wird beim Grenzübertritt in dem in Figur 1 gezeigten Teil des Systems, der hier als dezentrales automatisiertes Grenzkontrollsystem 30 bezeichnet ist, überprüft. Das dezentrale automatisierte Grenzkontrollsystem 30 umfaßt einen lokalen Server des Bundesgrenzschutzes, der über einen Dienststellen-Server 32 des Bundesgrenzschutzes mit einer Fahndungsdatenbank 34 der INPOL, einem Trust Center 36, einer zentralen Datenverwaltungseinrichtung 38 des Bundesgrenzschutzes und dem Enrolment Center 26 in Verbindung steht.FIG. 2 schematically shows the essential devices individually or in blocks of the system. A system block, designated by the reference numeral 26, relates to the application and issuing of a card (so-called enrollment center). The card in the form of a smart card 28 serves as an authorization card for each system user. It is checked at the border crossing in the part of the system shown in FIG. 1, which is designated here as a decentralized automated border control system 30. The decentralized automated border control system 30 comprises a local server of the Federal Border Guard, which is connected via a service server 32 of the Federal Border Guard with a search database 34 of the INPOL, a trust center 36, a central data management device 38 of the Federal Border Guard and the Enrollment Center 26.

In dem Enrolment Center 26 kann eine Kartenbeantragung vorgenommen werden. Diese umfaßt alle Prozeßschritte, die zur Erfassung der potentiellen Systembenutzer, also insbesondere die Erfassung ihrer Personen- und biometrischen Daten, notwendig sind. Es können mehrere Enrolment Center vorgesehen sein, die an verschiedenen Orten errichtet sind. Zur Kartenbeantragung legen die potentiellen Systembenutzer ihr Grenzübertrittsdokument vor, von dem der Bediener eines PCs, auf dem die Erfassungssoftware läuft, die Daten automatisch oder manuell erfaßt. Der Datensatz wird auf einem Formblatt ausgedruckt und vom antragstellenden, potentiellen Systembenutzer unterschrieben. Das Formblatt enthält unter anderem folgende weitere Angaben:

  • eine Beschreibung des Systems,
  • die Personalien des potentiellen Systembenutzers,
  • die Bedingungen für die freiwillige Teilnahme am System,
  • die notwendigen datenschutzrechtlichen Erklärungen zur Erhebung, Speicherung, Übermittlung und Verarbeitung der Personendaten des antragstellenden, potentiellen Systembenutzers im Zusammenhang mit der automatisierten Grenzkontrolle,
  • einen Hinweis auf die Pflicht des Systembenutzers, bei jedem Grenzübertritt ein gültiges Grenzübertrittsdokument mit sich zu führen, und
  • Hinweise zu den anerkannten Reisezwecken, für die das System genutzt werden darf.
In the Enrollment Center 26 a card application can be made. This includes all process steps that are necessary for the detection of potential system users, ie in particular the collection of their personal and biometric data. There may be several Enrollment Centers built in different locations. For card application, the potential system users submit their border crossing document from which the operator of a PC running the acquisition software automatically or manually collects the data. The record is printed on a form and signed by the applicant, potential system user. The form contains, among other things, the following information:
  • a description of the system,
  • the personal details of the potential system user,
  • the conditions for voluntary participation in the system,
  • the necessary data protection declarations for the collection, storage, transmission and processing of the personal data of the applicant, potential system user in connection with the automated border control,
  • a reference to the system user's obligation to carry a valid border crossing document each time he crosses the border, and
  • Notes on the recognized travel purposes for which the system may be used.

In einem nächsten Schritt wird der Fingerabdruck des potentiellen Systembenutzers mittels eines Fingerabdrucklesegerätes (nicht gezeigt) erfaßt. Die vom Fingerabdrucklesegerät gewonnen Daten werden durch die Verarbeitungssoftware in ein oder mehrere repräsentative Datenmerkmale umgerechnet, anhand derer eine Wiedererkennung des Systembenutzers bei der Grenzkontrolle möglich wird. Dann wird ein Test auf Duplikate vorgenommen, das heißt es wird überprüft, ob der Antragsteller bereits im System erfaßt ist. Die zuvor erfaßten Personendaten werden um die biometrischen Daten ergänzt und zur Verschlüsselung gegeben. Diese erfolgt entweder am lokalen System in einem dafür vorgesehenen Sicherheitsmodul oder in einem Hintergrundsystem, zu welchem für diesen Zweck eine On-Line-Datenverbindung geschaltet wird. Die verschlüsselten Daten werden im Enrolment Center in einen Smart Card-Rohling elektrisch personalisiert und die Personendaten auf dem Smart-Card-Körper im Thermotransfer-Druck aufgebracht. Zusätzlich können gegebenenfalls ein Foto des Systembenutzers sowie seine Personalien (beides erforderlichenfalls als Grundlage für eine manuelle Überprüfung, z. B. im Rahmen von Stichprobenkontrollen), seine Unterschrift und der Name des ausstellenden Enrolment Centers aufgedruckt werden. Anschließend wird der Smart-Card-Körper mit einer fälschungssicheren Laminatfolie überzogen. All diese Schritte laufen in einer Maschine ab und werden vom PC überwacht. Nach einer Funktionskontrolle an einem Terminal im Enrolment Center wird die Smart Card dem Systembenutzer ausgehändigt. Das gesamte Enrolment dauert weniger als 10 Minuten. Die Kartenbeantragung und -ausgabe kann auch gleichzeitig mit der erstmaligen Benutzung des Systems an der Grenze vor Ort vorgenommen werden.In a next step, the fingerprint of the potential system user is detected by means of a fingerprint reader (not shown). The data obtained by the fingerprint reader are converted by the processing software into one or more representative data characteristics, which makes it possible to recognize the system user in the border control. Then a test is made for duplicates, that is, it is checked whether the applicant is already recorded in the system. The previously recorded personal data are supplemented by the biometric data and given for encryption. This is done either on the local system in a dedicated security module or in a background system to which an on-line data connection is switched for this purpose. The encrypted data are electrically personalized in the Enrollment Center into a smart card blank and the personal data is applied to the smart card body in thermal transfer printing. In addition, a photograph of the system user and his / her personal details (both if necessary as the basis for a manual check, eg as part of random checks), his / her signature and the name of the issuing Enrollment Center may also be printed. Subsequently, the smart card body is coated with a tamper-proof laminate film. All these steps are running in one machine and are monitored by the PC. After a functional check on a terminal in the Enrollment Center, the smart card is handed over to the system user. The entire enrollment takes less than 10 minutes. The card application and issue can also be made simultaneously with the initial use of the system at the local border.

Alle hoheitlichen Schritte - die Durchführung der vorgezogenen Grenzkontrolle entsprechend der nationalen, Schengener und EU-Anforderungen und die Freigabe der Smart Card - sind einem Beamten der Grenzkontrollbehörde vorbehalten. Er wird gegebenenfalls unterstützt durch Personal bzw. Beauftragte des Betreibers. Für die Mitarbeiter in den Enrolment Center werden ebenfalls geeignete Zugangskontrollen vorgesehen.All sovereign steps - carrying out the early border checks in accordance with national, Schengen and EU requirements and the release of the smart card - are reserved for an official of the border control authority. He may be assisted by staff or agents of the operator. Appropriate access controls are also provided for the employees in the Enrollment Center.

Darüber hinaus stellt die Erfassungssoftware sicher, daß Smart Cards nur mit Zutun legitimierter Grenzkontrollbeamter, nur nach erfolgreichem Verlaufen aller erforderlichen Schritte und nur für visumsbefreite Angehörige bestimmter zugelassener Staaten ausgestellt werden, die im Besitz eines gültigen Reisedokumentes sind.In addition, the collection software ensures that smart cards are issued only with the assistance of legitimate border control officials, only after successful completion of all necessary steps, and only for exempt nationals of certain eligible states who hold a valid travel document.

Die Kartenkontrolle umfaßt alle Prozesse, die bei der Prüfung des Karteninhabers im Rahmen der Einreise durchgeführt werden. Die Kartenkontrolle findet innerhalb einer Durchgangsschleuse 10 (siehe Figur 1) statt, welche die zu kontrollierende Person betreten muß.The card control includes all the processes that are carried out during the cardholder's examination as part of the entry. The card control takes place within a passage lock 10 (see FIG. 1) which the person to be checked must enter.

Die Durchgangsschleuse selbst kann problemlos in die bestehende Infrastruktur integriert werden, das heißt es sind nur geringfügige bauliche Veränderungen notwendig. Der lokale Server dient zur Ablaufsteuerung und zur Kommunikation mit externen Rechnern.The passage lock itself can easily be integrated into the existing infrastructure, meaning that only minor structural changes are necessary. The local server is used for process control and communication with external computers.

Vor der Durchgangsschleuse 10 findet zunächst eine mechanische Vereinzelung mittels einer Einrichtung zur mechanischen Vereinzelung (nicht gezeigt) statt, um das Eintreten von Unberechtigten sowie mehreren Personen zur gleichen Zeit zu verhindern. Diese Maßnahme wird durch den Einsatz einer Videokamera 24 in der Durchgangsschleuse 10 und entsprechender Bildauswertungssoftware ergänzt.Before the passage lock 10, a mechanical separation by means of a mechanical separation (not shown) takes place first in order to prevent the entry of unauthorized persons and several persons at the same time. This measure is supplemented by the use of a video camera 24 in the passage lock 10 and corresponding image evaluation software.

Hinter der Einrichtung zur Vereinzelung, aber vor dem Eingang 12 wird die zu überprüfende Person zum Einführen der Smart Card in ein Kartenlesegerät 20 aufgefordert. In dem Kartenlesegerät 20 befindet sich ein Sicherheitsmodul (nicht gezeigt) zur Echtheitsüberprüfung der Smart Card sowie der darauf gespeicherten Personendaten. Jede authentische Smart Card besitzt einen Smart Card-spezifischen Schlüssel, der basierend auf bestimmten Smart Card Daten von dem Sicherheitsmodul im Kartenlesegerät 20 berechnet und sodann verifiziert werden kann. Die Kommunikation zwischen der Smart Card und dem Sicherheitsmodul in dem Kartenlesegerät 20 wird zusätzlich mit einem temporären Schlüssel geschützt, der vorher zwischen der Smart Card und dem Sicherheitsmodul ausgehandelt worden ist.Behind the device for separating, but in front of the entrance 12, the person to be checked is asked to insert the smart card into a card reader 20. In the card reader 20 is a security module (not shown) for authenticity verification of the smart card and the personal data stored thereon. Each authentic smart card has a smart card-specific key that can be calculated and then verified based on certain smart card data from the security module in the card reader 20. The communication between the smart card and the security module in the card reader 20 is additionally protected with a temporary key that has been previously negotiated between the smart card and the security module.

Danach werden die Personendaten einschließlich biometrischen Daten aus der Smart Card gelesen und eine angehängte Signatur (MAC) mit Hilfe des öffentlichen Schlüssels im Sicherheitsmodul auf Echtheit überprüft. So können illegale Datenmanipulationen sicher erkannt werden.Then the personal data, including biometric data, are read from the smart card and an appended signature (MAC) is authenticated by means of the public key in the security module. Thus, illegal data manipulation can be reliably detected.

Wenn die Echtheit der Karte und das Vorliegen keiner Datenmanipulation verifiziert worden sind, läßt sich die Drehtür 16 drehen, so daß die Person in die Durchgangsschleuse gelangen kann. In der Durchgangsschleuse 10 wird mittels des Biometriedatenlesegerätes 22 der Fingerabdruck des Systembenutzers erhoben und ein Vergleich mit den auf seiner Smart Card gespeicherten biometrischen Daten vorgenommen. Dazu werden aus den lokal gewonnen Daten Extrakte gebildet und mit den in der Smart Card gespeicherten Datenmerkmalen verglichen.If the authenticity of the card and the presence of no data manipulation have been verified, the revolving door 16 can be rotated so that the person can enter the transit lock. In the transit lock 10, the biometric data reader 22 collects the fingerprint of the system user and makes a comparison with the biometric data stored on its smart card. For this purpose extracts are formed from the locally obtained data and compared with the data features stored in the smart card.

Durch dieses zweistufige Überprüfungsverfahren am Eingang der Durchgangsschleuse und innerhalb derselben wird zweierlei erreicht:

  • es wird festgestellt, daß es sich bei der Person, der aufgrund der am Eingang der Durchgangsschleuse geprüften Smart Card der Einlaß gewährt wurde, um einen berechtigten Systembenutzer handelt;
  • unberechtigten Personen wird der Eintritt in die Durchgangsschleuse verwehrt; hier dürfte es ausreichen, auf einem Bildschirm am Kartenlesegerät am Eingang der Durchgangsschleuse einen Hinweis zu geben, sich der regulären Grenzkontrolle zu unterziehen.
  • Mißbräuchliche Benutzer oder durch das System fälschlicherweise zurückgewiesene Berechtigte (dies läßt sich durch kein technisches System zu 100 % ausschließen) werden spätestens in der Durchgangsschleuse zuverlässig festgestellt. Hier wäre - nach einer entsprechenden automatischen Alarmauslösung durch das System - ein Eingreifen durch die Grenzkontrollbehörde oder einen Beauftragten erforderlich, um die Person aus der Durchgangsschleuse zu befreien und einer regulären Grenzkontrolle zuzuführen.
This two-stage verification procedure at the entrance of the transit lock and within it achieves two things:
  • it is determined that the person granted the admission based on the smart card checked at the entrance to the transit lock is an authorized system user;
  • unauthorized persons are denied access to the transit lock; Here it should be sufficient to give a hint on a screen on the card reader at the entrance to the through-lock to undergo the regular border control.
  • Abusive users or persons wrongfully rejected by the system (this can not be completely ruled out by any technical system) will be detected reliably at the latest in the transit lock. Here, after a corresponding automatic triggering of the alarm by the system, intervention by the border control authority or a representative would be required in order to release the person from the transit gate and to feed it to a regular border control.

Im nächsten Schritt werden die erforderlichen Personendaten über den lokalen Server des Bundesgrenzschutzes zur Überprüfung an eine Fahndungsdatenbank der INPOL weitergeleitet.In the next step, the required personal data will be forwarded to a search database of the INPOL for verification via the local server of the Federal Border Police.

Wenn alle vorab beschriebenen Schritte beanstandungslos durchlaufen werden, wird der Ausgang der Durchgangsschleuse freigegeben. Im Falle einer Beanstandung oder eines fehlerhaften Verhaltens des System wird ein Alarm ausgelöst und mit der Überprüfung der Person durch Personal des Bundesgrenzschutzes fortgefahren.If all steps described above are passed through without complaint, the output of the transit lock is released. In the event of a complaint or faulty behavior of the system, an alarm will be triggered and the person will be checked by the staff of the Federal Border Police.

Die Gestaltung der Durchgangsschleuse, die Art der verwendeten Vereinzelungstechnik und der Freigabe am Ausgang der Durchgangsschleuse können in Abhängigkeit von z. B. der Ergonomie und der Führung großer Verkehrsströme bestimmt werden.The design of the passage lock, the nature of the singulation technique used and the release at the output of the transit lock can depend on z. B. the ergonomics and the leadership of large traffic flows are determined.

Das Trust Center 36 dient als zentrale Systemkomponente zur Verwaltung aller sicherheitsrelevanten Aspekte des Systems, also insbesondere zur Erzeugung und Verteilung von Schlüsseln und Überwachung des laufenden Systembetriebes.The Trust Center 36 serves as a central system component for the administration of all security-relevant aspects of the system, thus in particular for the generation and distribution of keys and monitoring of the ongoing system operation.

Die zentrale Datenverwaltungseinrichtung 38 des Bundesgrenzschutzes dient zur Verwaltung aller ausgegebenen Smart Cards mit Funktionen zur Überwachung des Card Life Cycle. Die Kartenverwaltung beinhaltet auch die Funktionen zur Antragsbearbeitung, also der Erfassung der Personendaten und der biometrischen Daten.The central data management device 38 of the Federal Border Guard serves to manage all issued smart cards with functions for monitoring the card life cycle. The Card management also includes the application processing functions, ie the collection of personal data and biometric data.

Die besondere Sensibilität der Daten der Smart Cards und der damit verbundenen Funktionalität erfordern ein hohes Maß an Schutz gegen:

  • Verfälschung der Personendaten auf der Smart Card
  • Verfälschung der biometrischen Daten
  • Verfälschung der Verbindung zwischen biometrischen Daten und den Personaldaten
  • Manipulationen an einem Kontrollterminal
  • Manipulationen bei der Erfassung der Personendaten bzw. der biometrischen Daten und
  • Angriffe auf die kryptographischen Funktionen im System.
The special sensitivity of the smart card data and the associated functionality require a high degree of protection against:
  • Falsification of personal data on the smart card
  • Falsification of biometric data
  • Falsification of the connection between biometric data and personal data
  • Manipulations at a control terminal
  • Manipulations in the collection of personal data or biometric data and
  • Attacks on the cryptographic functions in the system.

Zur umfassenden Absicherung dieser Risiken ist eine schalenartige Sicherheitsarchitektur zur Absicherung zentraler Informationen und Funktionen ratsam. Ziel der Architektur ist, die Errichtung mehrerer Hürden, die ein potentieller Angreifer überwinden muß, um das System zu manipulieren.To protect these risks comprehensively, a shell-like security architecture to secure central information and functions is advisable. The goal of the architecture is to set up several hurdles that a potential attacker must overcome to manipulate the system.

Den Kern bilden die Personendaten zusammen mit den biometrischen Daten. Diese Daten werden im System als eine Einheit betrachtet, das heißt biometrische Daten sind ein Element des Personendatensatzes. Über den Personendatensatz wird zunächst mit Hilfe eines Secure Hash-Verfahrens, z. B. dem SHA-1 Algorithmus, eine kryptographische Prüfsumme erzeugt. Dieser 160 Bit lange Wert hat die typischen Eigenschaften eines guten Hash-Algorithmus, das heißt, er ist im wesentlichen kollisionsfrei. Das Ergebnis des Algorithmus wird als ein Teil der Kryptogrammbildung verwendet, da der gesamte Personendatensatz als Eingabedatum der Verschlüsselung zu groß ist. Der Hash-Wert komprimiert den Inhalt des Personendatensatzes auf eine stark reduzierte Form. Dabei kann vom Hash-Wert nicht auf die ursprünglichen Daten geschlossen werden. Änderungen im Personendatensatz ergeben zwangsläufig eine Änderung im Hash-Wert. Das Secure Hash-Verfahren ist kein Verschlüsselungsverfahren, das heißt, es verwendet keine Schlüssel.The core is the personal data together with the biometric data. These data are considered as one unit in the system, ie biometric data is an element of the personal data record. About the personal data set is first using a secure hash method, eg. For example, the SHA-1 algorithm generates a cryptographic checksum. This 160-bit value has the typical properties of a good hash algorithm, that is, it is essentially collision-free. The result of the algorithm is considered a part Cryptogram formation is used, since the entire personal data set is too large as the input date of the encryption. The hash value compresses the content of the personal record to a greatly reduced form. The hash value can not be used to deduce the original data. Changes in the personal data record inevitably result in a change in the hash value. The Secure Hash method is not an encryption method, that is, it does not use keys.

In der zweiten Schale werden wesentliche Extrakte aus den Personendaten (z. B. Name, Geburtsdatum und Geburtsort), insbesondere also die Daten für die Abfrage bei der INPOL-Fahndungsdatenbank, zusammen mit dem Hash-Wert mit einem Private Key-Verfahren verschlüsselt Als Private Key-Verfahren sollen - abhängig von der weiteren Detailabstimmung - RSA mit einer Schlüssellänge von mindestens 1.024 Bit oder elliptische Kurven mit hinreichender Schlüssellänge genutzt werden.In the second shell, essential extracts from the personal data (eg name, date of birth and place of birth), in particular the data for the query in the INPOL wanted database, are encrypted together with the hash value with a private key procedure Key methods should be used - depending on the further detail tuning - RSA with a key length of at least 1,024 bits or elliptic curves with sufficient key length.

Für die Verschlüsselung des Extraktes wird der private Schlüssel einer Ausgabestelle oder der private Schlüssel einer zentralen Instanz verwendet Im letzteren Fall muß der Personendatensatz zur Verschlüsselung an die zentrale Instanz versandt werden und er kann erst dann in die Smart Card personalisiert werden (z. B. durch On-Line-Anfrage).For the encryption of the extract, the private key of an issuing office or the private key of a central authority is used. In the latter case, the personal data record must be sent to the central entity for encryption and can only then be personalized to the smart card (eg by Online request).

Für die Entschlüsselung des Extraktes wird der öffentliche Schlüssel benötigt. Dieser wird in den Kontrollterminals hinterlegt. Eine Entschlüsselung liefert zunächst die Personendaten für die INPOL-Abfrage und den Hash-Wert. Der Hash-Wert wird mit einem erneut berechneten Hash-Wert verglichen. Bei Gleichheit kann von einem unverfälschten Datensatz ausgegangen werden.The public key is needed to decrypt the extract. This is deposited in the control terminals. Decryption initially provides the personal data for the INPOL query and the hash value. The hash value is compared to a recalculated hash value. If equality can be assumed that a genuine record.

Innerhalb des Verfahrens sind eine Reihe von Varianten möglich, deren Nutzung von den konkreten Rahmenbedingungen abhängt:

  • Eine eindeutige Smart Card-Nummer könnte in den Personendatensatz aufgenommen und dadurch mit diesem verknüpft werden. Eine Übertragung der Daten auf ein andere Smart Card wäre damit nicht möglich. Eine sinnvolle Nutzung dieser Option setzt eine On-Line-Personalisierung voraus, bei der Personendaten und die Smart Card-Nummer verschlüsselt und direkt in die Smart Card personalisiert werden.
  • Die Verschlüsselung des Personendatensatzes kann mit dem privaten Schlüssel der Ausgabestelle durchgeführt werden. Diese würde dann ihren öffentlichen Schlüssel in der Smart Card speichern. Eine Kontrollstation würde dann zur Verifikation des Extraktes den von der Smart Card gelieferten öffentlichen Schlüssel der Ausgabestelle nutzen. Zur Verhinderung des Mißbrauches, etwa der Einspielung von gefälschten öffentlichen Schlüsseln einer Ausgabestelle, müssen die Schlüsselpaare der Ausgabestelle von einer zentralen Instanz elektronisch signiert werden. Ein solches Verfahren erlaubt die Ausgabe der Smart Card ohne Zugriff und Authorisierung durch ein Zentralsystem.
Within the procedure, a number of variants are possible, the use of which depends on the specific conditions:
  • A unique smart card number could be included in the personal record and thereby linked to it. It would not be possible to transfer the data to another smart card. A sensible use of this option requires an on-line personalization in which personal data and the smart card number are encrypted and personalized directly into the smart card.
  • The encryption of the personal data record can be carried out with the private key of the issuing office. This would then save their public key in the smart card. A control station would then use the issuer's public key provided by the smart card to verify the extract. In order to prevent the abuse, such as the recording of fake public keys of an issuing office, the key pairs of the issuing office must be electronically signed by a central authority. Such a method allows the issuing of the smart card without access and authorization by a central system.

Jede Smart Card im System erhält bei der Herstellung eine eindeutige Seriennummer. Diese Seriennummer ist Grundlage der kryptographischen Verfahren, die aktiv durch die Smart Card ausgeführt werden. Die Smart Card enthält einen durch Ableitung der Seriennummer unter einem Masterschlüssel gewonnen smartcardspezifischen Schlüssel zur Authentisierung.Each smart card in the system receives a unique serial number during manufacture. This serial number is the basis of the cryptographic processes that are actively performed by the smart card. The smart card contains a smart card-specific key for authentication obtained by deriving the serial number under a master key.

Die Authentisierung erfolgt implizit durch das Auslesen der Personendaten im sogenannten PRO-Mode. Der PRO-Mode ist eine in ISO7816 eingeführte Variante des Lesezugriffs, bei dem die an das Terminal übertragenen Daten durch einen Message Authentication Code (MAC) gesichert werden. Dieser MAC wird dynamisch bei jedem Lesezugriff neu erzeugt, um einen sogenannten Replay-Angriff, also das erneute Einspielen bereits gelesener Daten, auszuschließen.The authentication takes place implicitly by reading the personal data in the so-called PRO mode. The PRO mode is a variant of the read access introduced in ISO7816, in which the data transferred to the terminal are protected by a message authentication code (MAC). This MAC is regenerated dynamically with each read access, in order to exclude a so-called replay attack, ie the re-import of already read data.

Die Erzeugung des MAC erfolgt innerhalb des Betriebssystems der Smart Card unter Nutzung des kartenindividuellen Authentisierungsschlüssels und einer durch das Terminal gelieferten Zufallszahl. Das Terminal enthält hierzu in einem Sicherheitsmodul (z. B. eine weitere Smart Card) einen Zufallszahlengenerator und den Masterschlüssel, welche für die Ableitung des Smart Card-Schlüssels unter der Smart Card-Seriennummer benutzt wird. Das Terminal überprüft selbständig und unmittelbar nach dem Auslesen der Smart Card-Daten den MAC und weist eine Karte mit fehlerhaftem MAC ab.The MAC is generated within the operating system of the smart card using the card-specific authentication key and a random number supplied by the terminal. For this purpose, the terminal contains in a security module (eg another smart card) a random number generator and the master key which is used to derive the smart card key under the smart card serial number. The terminal automatically and immediately after reading the smart card data checks the MAC and rejects a card with a faulty MAC.

Wichtig ist in diesem Zusammenhang, daß der MAC dynamisch durch die Smart Card erzeugt wird. Der dazu notwendige Schlüssel muß in der Smart Card vorhanden sein. Eine Manipulation der Smart Card, z. B. durch Duplizieren, erfordert Zugriff auf diesen Kartenschlüssel, welches nur unter hohem finanziellen Aufwand möglich ist.It is important in this context that the MAC is generated dynamically by the smart card. The necessary key must be present in the smart card. A manipulation of the smart card, z. B. by duplicating, requires access to this card key, which is possible only with high financial costs.

Auch für diese Schutzstufe gibt es eine Variante, die jedoch eine leistungsfähigere Smart Card voraussetzt. Statt einem symmetrischen Verfahren für die MAC-Bildung (in der Regel Triple DES) kann das asymmetrische Verfahren der elliptischen Kurven Anwendung finden. Bei diesem Verfahren wird in der Karte der private, kartenindividuelle Schlüssel auslesegeschützt gespeichert und der öffentliche Schlüssel lesbar gemacht. Der öffentliche Schlüssel muß dazu mit dem privaten Schlüssel des Systembetreibers signiert werden. Ein Kontrollterminal braucht nun nur den weniger sicherheitskritischen, öffentlichen Schlüssel des Systembetreibers zu speichern und mit ihm die Echtheit des kartenindividuellen öffentlichen Schlüssel zu überprüfen.There is also a variant for this protection level, which however requires a more powerful smart card. Instead of a symmetric method for MAC formation (usually Triple DES), the asymmetric method of elliptic curves can be applied. With this method, the private, card-specific key is stored in a read-only manner in the card and the public key is made readable. The public key must be signed with the private key of the system operator. A control terminal now only needs to store the less security-critical, public key of the system operator and to check with it the authenticity of the card-specific public key.

Das Auslesen der Daten erfolgt analog dem symmetrischen Verfahren, mit der Abweichung, daß der MAC durch den asymmetrischen Algorithmus erzeugt wird.The reading of the data is analogous to the symmetric method, with the exception that the MAC is generated by the asymmetric algorithm.

Solche Verfahren auf Basis asymmetrischer Kryptographie finden aufgrund ihrer hohen Anforderungen an die Rechenleistung nur begrenzten Einsatz in Smart Cards. Im Detail muß hier sicher noch das Antwort-Zeitverhalten einer solchen Lösung betrachtet werden.Such methods based on asymmetric cryptography find due to their high demands on the computing power only limited use in smart cards. In detail, the response time behavior of such a solution must certainly be considered here.

Die Übertragung der Daten zwischen Einrichtungen des Systems, insbesondere die Übertragung der Daten bei der Kartenausgabe soll durch kryptographische Verfahren abgesichert werden. Hierzu bieten sich Verfahren der Line-Verschlüsselung an, mit denen sich geschützte, transparente Datenkanäle aufbauen lassen.The transmission of data between devices of the system, in particular the transmission of the data in the card issue is to be secured by cryptographic methods. For this purpose, methods of line encryption are available, with which protected, transparent data channels can be built.

Mit diesen Verfahren läßt sich die Integrität der Daten und die Vertraulichkeit sicherstellen. Letztere ist insbesondere bei der Erzeugung und Verteilung der Systemschlüssel von Bedeutung.These procedures ensure the integrity of the data and confidentiality. The latter is particularly important in the generation and distribution of system keys.

Ein wesentlicher, oft unterschätzter Mechanismus zur Sicherung von Informationssystemen ist die Einbettung der technischen Systeme in eine zuverlässige Ablauforganisation (5. Schale). Die besten und längsten Schlüsselverfahren der Welt nützen nichts, wenn die Schlüssel einfach zugänglich sind. Technische Verfahren können hier nur einen begrenzten Schutz herstellen, einem Angriff von innen sind sie oft schutzlos ausgeliefert.An essential, often underestimated mechanism for securing information systems is the embedding of the technical systems in a reliable process organization (5th shell). The best and longest key processes in the world do not help if the keys are easily accessible. Technical procedures can only provide limited protection here, they are often vulnerable to an attack from the inside.

Ein weiteres Merkmal der 5. Schale ist die Absicht, alle sicherheitsrelevanten Systemeinrichtungen in die Obhut der Grenzkontrollbehörde zu stellen. Dadurch soll aus Sicht der Behörde gewährleistet werden, daß ein Zugriff auf diese Systemeinrichtungen ohne ihr Zutun und unter keinen Umständen möglich ist. Dazu müssen sich nicht alle Systemeinrichtungen tatsächlich in den Räumlichkeiten der Behörde selbst befinden. Der technischen Betrieb könnte auch bei einem Beauftragten der Behörde durchgeführt werden, solange durch entsprechende vertragliche Gewährleistungsklauseln ein unerlaubter Zugriff durch Dritte (einschließlich dem Betreiber) unmöglich ist.Another feature of the 5th shell is the intention to put all safety-relevant system facilities in the care of the border control authority. This is to ensure, from the point of view of the authority, that access to these system facilities is possible without their intervention and under any circumstances. This does not mean that all system facilities actually have to be located in the premises of the authority itself. The technical operation could also be carried out by a representative of the authority, as long as the corresponding contractual warranty clauses prevent unauthorized access by third parties (including the operator).

Eine zusätzliche organisatorische Schutzvorkehrung besteht darin, daß alle hoheitlichen Schritte - das heißt die Durchführung der vorgezogenen Grenzkontrolle entsprechend den nationalen, Schengener und EU-Anforderungen und die Freigabe der Smart Card - einem Beamten der Grenzkontrollbehörde vorbehalten sind. Für ihn sowie für die anderen Mitarbeiter in dem Enrolment Center bestehen geeignete Zugangskontrollen.An additional organizational safeguard is that all sovereign steps - that is, carrying out the advanced border control in accordance with national, Schengen and EU requirements and the release of the smart card - are reserved to an official of the border control authority. For him as well as for the other employees in the Enrollment Center there are suitable access controls.

Darüber hinaus stellt die Erfassungssoftware sicher, daß Smart Cards

  • nur auf der Basis im System bereits bekannter Smart Card-Rohlinge (jeder Smart Card-Rohling besitzt eine ein-eindeutige Kartennummer),
  • nur mit Zutun im System legitimierter Grenzkontrollbeamter,
  • nur nach erfolgreichem Durchlaufen aller erforderlichen Schritte und
  • nur für Angehörige bestimmter zugelassener Staaten ausgestellt werden, die im Besitz eines gültigen Reisedokumentes sind.
In addition, the capture software ensures that Smart Cards
  • only on the basis of already known smart card blanks in the system (each blank blank card has a unique card number),
  • only a border control official legitimized with the help of the system,
  • only after successful completion of all necessary steps and
  • only be issued to nationals of certain accredited states who hold a valid travel document.

Die erfindungsgemäßen Systeme haben einige Vorteile, die es von verschiedenen anderen, bislang erfolglosen Versuchen zur flächendeckenden Einführung automatisierter Grenzkontrollen unterscheiden:

  • Das System stellt eine wirksame und sparsame Möglichkeit dar, Grenzkontrollbehörden effizienter zu machen. Das System erlaubt es den Grenzkontrollkräften, sich auf einen eher polizeilich relevanten Personenkreis zu fokussieren. Damit können sie mit weniger Aufwand mehr für Sicherheit und Service leisten.
  • Die gemäß einer besonderen Ausführungsform der Erfindung eingesetzte Smart Card erlaubt die Speicherung auch sensibler Daten ohne das Risiko eines Mißbrauchs durch unerlaubte Veränderungen oder von Fälschungen.
  • Das Verfahren erlaubt kürzestmögliche Transaktionszeiten (im wesentlichen nur abhängig vom Antwort-Zeitverhalten der Abfrage bei der INPOL-Fahndungsdatenbank).
  • Das Verfahren erlaubt geringstmögliche Transaktionskosten.
  • Das Verfahren birgt keine datenschutzrechtliche Problematik (der Besitzer trägt seine vor unberechtigtem Zugriff sicher geschützten personenbezogenen Daten mit sich).
  • Die in einer besonderen Ausführungsform der Erfindung verwendete Smart Card enthält ausreichende Speicherkapazität für diese und gegebenenfalls weitere zukünftige Anwendungen mit zusätzlichen Nutzpotentialen.
  • Auf der gemäß einer besonderen Ausführungsform der Erfindung verwendeten Smart Card befindet sich ausreichend Platz, um gegebenenfalls weitere Sicherheitsmerkmale (z. B. maschinenlesbares Hologramm mit Mikroschrift) oder andere Speichervarianten gleichzeitig zu nutzen.
The systems of the invention have several advantages that differentiate it from various other hitherto unsuccessful attempts to introduce automated border controls nationwide:
  • The system is an effective and economical way to make border control authorities more efficient. The system allows border control forces to focus on a group of people more relevant to the police. This allows them to do more with less effort for safety and service.
  • The smart card used according to a particular embodiment of the invention allows the storage of even sensitive data without the risk of misuse by unauthorized changes or counterfeiting.
  • The method allows shortest possible transaction times (essentially only dependent on the response time behavior of the query in the INPOL wanted database).
  • The procedure allows lowest possible transaction costs.
  • The procedure has no data protection problems (the owner carries with him his unauthorized access securely protected personal data with him).
  • The smart card used in a particular embodiment of the invention contains sufficient storage capacity for these and possibly other future applications with additional useful potentials.
  • On the smart card used according to a particular embodiment of the invention, there is sufficient space to possibly other security features (eg. B. machine-readable hologram with micro-writing) or other storage variants simultaneously.

BezugszeichenlisteLIST OF REFERENCE NUMBERS

88th
Grenzeborder
1010
DurchgangsschleusePass-through
1212
Eingangentrance
1414
Ausgangoutput
16,1816.18
Drehtürrevolving door
2020
KartenlesegerätCard Reader
2222
BiometriedatenlesegerätBiometric reader
2424
Videokameravideo camera
2626
Enrolment CenterEnrollment Center
2828
Smart CardSmart card
3030
dezentrales automatisiertes Grenzkontrollsystemdecentralized automated border control system
3232
Dienststellen-ServerDirectory server
3434
FahndungsdatenbankWanted list database
3636
Trust CenterTrust Center
3838
zentrale Datenverwaltungseinrichtungcentral data management facility

Claims (26)

  1. System for automated border-crossing control, with:
    - a device (26) for recording personal data of system users,
    - a device (26) for recording biometric data of system users,
    - a device (26) for transmitting the personal data of system users to a wanted persons database (34) and inquiring whether the corresponding system user is on a wanted persons list,
    - a device (26) for storage of data, comprising the personal data and biometric data of the corresponding system user, on an identification medium (28) provided for each system user and optionally data specific to the identification medium, when the result of the wanted persons inquiry is negative,
    - a transit gate (10) arranged in front of a boundary (8) to control the passage of system users, with an entrance (12) and an exit (14), in which the entrance (12) and exit (14) are closed in the base position,
    - a device for isolation of system users arranged in front of the entrance (12) of transit gate (10),
    - a device (20) for the automated reading of the data stored on the identification media, said device (20) being arranged behind the isolation device, but in front of the entrance (12) to the transit gate (10),
    - a device (20) for the automated checking of the authenticity of the identification media, said device (20) being arranged in front of the entrance (12) of transit gate (10),
    - a device (20) for the automated checking of the presence of data manipulation on the corresponding identification medium, said device (20) being arranged in front of the entrance (12) of the transit gate (10),
    - a device for the automated opening of the entrance (12) of transit gate (10), when the authenticity of the corresponding identification medium and no data manipulation on the corresponding identification medium have been established,
    - a device (22) for the automated recording of biometric data of an admitted system user, said device (22) being situated in the transit gate (10),
    - a device (22) for automated comparison of the recorded biometric data with the biometric data stored on the identification medium of the admitted system user,
    - a device for the automated triggering of an alarm signal, when the recorded biometric data and the biometric data stored on the corresponding identification medium do not correspond,
    - a device for the automated transmitting of personal data to the wanted persons database (34) and automated inquiring as to whether the system user is on a wanted persons list, and
    - a device for the automated opening of the exit of the transit gate (10) and permitting border-crossing of the system user, when the result of the wanted persons inquiry is negative, and for the automated triggering of an alarm signal, when the result of the wanted persons inquiry is positive.
  2. System according to Claim 1, characterized in that the device (26) for recording the personal data of system users has a device for automatic entry of personal data.
  3. System according to Claim 1 or 2, characterized in that the device (22, 26) for recording biometric data has a device for recording a fingerprint and/or retinal structure and/or facial features and/or voice and/or language of a corresponding system user.
  4. System according to one of Claims 1 to 3, characterized by a device for automated processing of recorded biometric data and automated conversion to one or more representative data features, by means of which automated recognition of the system user is possible during control.
  5. System according to one of the preceding claims, characterized in that the device (26) for storage of data has a device for encryption of the personal and/or identification medium data and for generation of an identification medium-specific code.
  6. System according to Claim 5, characterized in that the encryption device is a locally provided security module or is situated in a background system that is connected via an online data connection.
  7. System according to Claim 5 or 6, characterized in that the device (26) for storage of data has a device for electrical personalization of the encrypted data in the identification medium and/or a device for application of personal data and optionally a photo, as well as signature of the corresponding system user, to the identification medium.
  8. System according to Claim 7, characterized in that the device (26) for storage of data has a device for coating the identification medium with a laminate film.
  9. System according to one of the preceding claims, characterized in that the identification media are Smart Cards (28).
  10. System according to one of the preceding claims, characterized in that at least one video camera (24) is provided in the transit gate (10).
  11. System according to one of the preceding claims, characterized in that the device (20) for the automated reading of the data stored in the identification media has a device for calculating the identification medium-specific code from the encrypted identification medium data and verification of it.
  12. System according to one of the preceding claims, characterized in that the device (20) for the automated reading of the data stored on the identification medium has a device for decoding the encrypted personal data and verification of it.
  13. System according to one of the preceding claims, characterised by a device (36) for generation and distribution of codes for the data encryption and monitoring of system operations.
  14. System according to one of the preceding claims, characterized by a device for management and monitoring, especially of the lifetime of all identification media issued to system users.
  15. System according to one of the preceding claims, characterized by a device for encryption of data transferred between devices of the system and/or between the system and external devices.
  16. Method for the automated control of border-crossing, comprising the following steps:
    - recording of personal data of system users,
    - recording of biometric data of system users,
    - transfer of personal data of system users to a wanted persons database and performance of an inquiry, whether the corresponding system user is on a wanted persons list,
    - storage of data, comprising the personal data and biometric data of the corresponding system user, on an identification medium provided for each system user and optionally identification medium-specific data, if the result of the wanted persons inquiry is negative,
    - isolation of system users undertaking a border-crossing attempt in front of a transit gate with an entrance and an exit, in which the entrance and exit are closed in the base state,
    - automated reading of data stored in the identification medium,
    - automated checking of the authenticity of the corresponding identification medium,
    - automated checking of the presence of data manipulation on the corresponding identification medium,
    - automated opening of the entrance of the transit gate when the authenticity of the corresponding identification medium and no data manipulation on the corresponding identification medium are established,
    - automated recording of biometric data of a system user admitted to the transit gate,
    - automated comparison of the recorded biometric data with the biometric data stored on the identification medium of the admitted system user,
    - automated triggering of an alarm signal, when the recorded biometric data and the data stored on the corresponding identification medium do not correspond,
    - automated transmission of personal data to the wanted persons database and automated inquiry whether the system user is on a wanted persons list, and
    - automated opening of the exit of the transit gate, when the result of the wanted persons inquiry is negative, or automated triggering of an alarm signal, when the result of the wanted persons inquiry is positive.
  17. Method according to Claim 16, characterized in that the personal data of system users are recorded by automatic entry.
  18. Method according to Claim 16 or 17, characterized in that the fingerprint and/or retinal structure and/or facial features and/or voice and/or language of a corresponding system user is/are recorded.
  19. Method according to one of Claims 16 to 18, characterized in that the recorded biometric data are processed and converted to one or more representative data features, by means of which recognition of the system user is possible during control.
  20. Method according to one of Claims 16 to 19, characterized in that the personal and/or identification medium data are encrypted and an identification medium-specific code is generated.
  21. Method according to one of Claims 16 to 20, characterized in that the encrypted data are electrically personalized in the identification medium and/or the personal data and optionally a photo, as well as signatures of the corresponding system user, are applied to the identification medium.
  22. Method according to one of Claims 16 to 21, characterized in that the identification media are coated with a laminate film.
  23. Method according to one of Claims 16 to 22, characterized in that Smart Cards are used as identification medium.
  24. Method according to one of Claims 16 to 23, characterized in that the transit gate is monitored by means of a video camera.
  25. Method according to one of Claims 16 to 24, characterized in that an identification medium-specific code is calculated and verified from the encrypted identification medium data.
  26. Method according to one of Claims 16 to 25, characterized in that the encrypted personal data are decoded and verified.
EP99125349A 1999-11-19 1999-12-21 System and method for automatically checking the passage of a frontier Expired - Lifetime EP1102216B1 (en)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
DE19957283 1999-11-19
DE19957283 1999-11-19

Publications (3)

Publication Number Publication Date
EP1102216A2 EP1102216A2 (en) 2001-05-23
EP1102216A3 EP1102216A3 (en) 2001-05-30
EP1102216B1 true EP1102216B1 (en) 2006-08-16

Family

ID=7930650

Family Applications (1)

Application Number Title Priority Date Filing Date
EP99125349A Expired - Lifetime EP1102216B1 (en) 1999-11-19 1999-12-21 System and method for automatically checking the passage of a frontier

Country Status (3)

Country Link
EP (1) EP1102216B1 (en)
AT (1) ATE336766T1 (en)
DE (3) DE29922252U1 (en)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7724924B2 (en) 2004-03-17 2010-05-25 Sagem Securite Person identification control method and system for implementing same
RU2497197C2 (en) * 2008-01-24 2013-10-27 Каба Галленшютц Гмбх Device of access control
DE202018101858U1 (en) 2018-04-05 2018-04-17 Bemm Gmbh radiator

Families Citing this family (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP3938303B2 (en) 2001-12-07 2007-06-27 株式会社日立製作所 Immigration system, immigration method, immigration system, and immigration method
EP1454314A4 (en) * 2001-12-13 2005-03-02 Unisys Corp Split interface handling of border crossing data
DE10163123A1 (en) * 2001-12-20 2003-07-03 Transas S R O Largely automated access control device has personnel identity checking means combined with simultaneous checking of security- relevant objects and means for complete scanning of a person for security threatening objects
EP1347420A3 (en) * 2002-03-22 2005-02-16 VSS Veranstaltungs Sicherheits-Systeme GmbH Biometric access control device
US20040078335A1 (en) * 2002-08-29 2004-04-22 Calvesio Raymond V. Transportation security system and method that supports international travel
WO2004051585A2 (en) * 2002-11-27 2004-06-17 Rsa Security Inc Identity authentication system and method
FR2879050A1 (en) * 2004-12-08 2006-06-09 Roger Felix Sejalon Purchase payment/withdrawal prohibiting method for e.g. in bank sector, involves informing user after comparing read identification code with that of base sources and controlling operation of e.g. rejection of bank card/impression for check
DE102005038092A1 (en) * 2005-08-11 2007-02-15 Giesecke & Devrient Gmbh Method and device for checking an electronic passport
WO2007068004A1 (en) * 2005-12-08 2007-06-14 Peter Charles Booth-Jones A security system for permitting or inhibiting access to a secure area
DE202009010858U1 (en) 2009-08-11 2009-10-22 Magnetic Autocontrol Gmbh Passage or transit barrier with a device for monitoring the passage or passage area

Family Cites Families (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US4586441A (en) * 1982-06-08 1986-05-06 Related Energy & Security Systems, Inc. Security system for selectively allowing passage from a non-secure region to a secure region
DE3623792C1 (en) * 1986-07-15 1987-12-10 Messerschmitt Boelkow Blohm Device for determining the number of people and direction within a room to be monitored or a passage gate
JP2793658B2 (en) * 1988-12-28 1998-09-03 沖電気工業株式会社 Automatic screening device
CH678460A5 (en) * 1989-05-18 1991-09-13 Ballmoos Ag Von
US4993068A (en) * 1989-11-27 1991-02-12 Motorola, Inc. Unforgeable personal identification system
SE9102739L (en) * 1991-09-20 1992-09-07 Lennart Eriksson PROCEDURE AND SYSTEM FOR MONITORING TIME OR PASSENGER CONTROL
US5400722A (en) * 1992-11-25 1995-03-28 American Engineering Corporation Security module
US5815252A (en) * 1995-09-05 1998-09-29 Canon Kabushiki Kaisha Biometric identification process and system utilizing multiple parameters scans for reduction of false negatives
US6317544B1 (en) * 1997-09-25 2001-11-13 Raytheon Company Distributed mobile biometric identification system with a centralized server and mobile workstations
DE19818229A1 (en) * 1998-04-24 1999-10-28 Hauke Rudolf Contactless method for hand- and fingerprint recognition

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7724924B2 (en) 2004-03-17 2010-05-25 Sagem Securite Person identification control method and system for implementing same
RU2497197C2 (en) * 2008-01-24 2013-10-27 Каба Галленшютц Гмбх Device of access control
DE202018101858U1 (en) 2018-04-05 2018-04-17 Bemm Gmbh radiator

Also Published As

Publication number Publication date
EP1102216A2 (en) 2001-05-23
DE19961403C2 (en) 2002-09-19
DE19961403A1 (en) 2001-08-02
DE29922252U1 (en) 2000-03-23
EP1102216A3 (en) 2001-05-30
ATE336766T1 (en) 2006-09-15
DE59913780D1 (en) 2006-09-28

Similar Documents

Publication Publication Date Title
WO2001039133A1 (en) System and method for automatically controlling the crossing of a border
DE69605627T2 (en) Anonymous information management system for statistics, in particular for electronic voting procedures or periodical consumables lists
DE60209388T2 (en) SYSTEM AND METHOD FOR READING A SAFETY RELEASE CARD
EP0063794B1 (en) Apparatus and process for checking identity
EP1102216B1 (en) System and method for automatically checking the passage of a frontier
EP3256977A1 (en) Computer-implemented method for access control
DE3103514A1 (en) METHOD AND DEVICE FOR CONTROLLING A SECURED TRANSACTION
EP2203900B1 (en) System for screening people and method for carrying out a screening process
DE3044463A1 (en) METHOD AND DEVICE FOR CODING A CARD
DE3122534C1 (en) Process for creating and checking documents, as well as document and device for carrying out the process
DE2949351A1 (en) METHOD AND DEVICE FOR SECURING DOCUMENTS AND THE DOCUMENT USED THEREOF
EP3182317A1 (en) Apparatus and method for personalised provision of a key
DE69330743T2 (en) Procedure for the certification of one unit of information by another
WO2007104423A1 (en) Method and apparatus for the secure processing of sensitive information
EP1686541A2 (en) Identification system
EP1706957B1 (en) Biometric authentication
DE19502657C1 (en) Method and device for detecting tampering with transmitted data
WO2010040162A1 (en) Identification feature
EP1057144B1 (en) Access authorization or identification medium and method for the production of the same
DE69313777T2 (en) Method and device for writing information on a data carrier, with the possibility of confirming the originality of this information
EP3977371B1 (en) Method and control device for securely checking an electronic ticket
EP1358734A1 (en) Telecommunications protocol, system and devices for anonymous, validated electronic polling
DE102016110274B4 (en) Method for a biometric-based triggering of a user action by means of an ID token assigned to a user
EP4332919A1 (en) Ticket-cancelling device for a passenger transport system
DE102005057798A1 (en) Access authorization allocating and verifying method for e.g. computer system, involves verifying fulfillment of requirement through another requirement, and permitting access to access region of restriction region based on verification

Legal Events

Date Code Title Description
PUAI Public reference made under article 153(3) epc to a published international application that has entered the european phase

Free format text: ORIGINAL CODE: 0009012

PUAL Search report despatched

Free format text: ORIGINAL CODE: 0009013

AK Designated contracting states

Kind code of ref document: A2

Designated state(s): AT BE CH CY DE DK ES FI FR GB GR IE IT LI LU MC NL PT SE

AX Request for extension of the european patent

Free format text: AL;LT;LV;MK;RO;SI

AK Designated contracting states

Kind code of ref document: A3

Designated state(s): AT BE CH CY DE DK ES FI FR GB GR IE IT LI LU MC NL PT SE

AX Request for extension of the european patent

Free format text: AL;LT;LV;MK;RO;SI

17P Request for examination filed

Effective date: 20011102

AKX Designation fees paid

Free format text: AT BE CH CY DE DK ES FI FR GB GR IE IT LI LU MC NL PT SE

RAP1 Party data changed (applicant data changed or rights of an application transferred)

Owner name: ACCENTURE GMBH

GRAP Despatch of communication of intention to grant a patent

Free format text: ORIGINAL CODE: EPIDOSNIGR1

GRAS Grant fee paid

Free format text: ORIGINAL CODE: EPIDOSNIGR3

GRAA (expected) grant

Free format text: ORIGINAL CODE: 0009210

AK Designated contracting states

Kind code of ref document: B1

Designated state(s): AT BE CH CY DE DK ES FI FR GB GR IE IT LI LU MC NL PT SE

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: NL

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20060816

Ref country code: IT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRE;WARNING: LAPSES OF ITALIAN PATENTS WITH EFFECTIVE DATE BEFORE 2007 MAY HAVE OCCURRED AT ANY TIME BEFORE 2007. THE CORRECT EFFECTIVE DATE MAY BE DIFFERENT FROM THE ONE RECORDED.SCRIBED TIME-LIMIT

Effective date: 20060816

Ref country code: IE

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20060816

Ref country code: FI

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20060816

REG Reference to a national code

Ref country code: GB

Ref legal event code: FG4D

Free format text: NOT ENGLISH

REG Reference to a national code

Ref country code: CH

Ref legal event code: EP

REG Reference to a national code

Ref country code: IE

Ref legal event code: FG4D

Free format text: LANGUAGE OF EP DOCUMENT: GERMAN

REF Corresponds to:

Ref document number: 59913780

Country of ref document: DE

Date of ref document: 20060928

Kind code of ref document: P

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: SE

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20061116

Ref country code: DK

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20061116

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: ES

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20061127

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: MC

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20061231

Ref country code: LI

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20061231

Ref country code: CH

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20061231

Ref country code: BE

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20061231

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: PT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20070116

NLV1 Nl: lapsed or annulled due to failure to fulfill the requirements of art. 29p and 29m of the patents act
REG Reference to a national code

Ref country code: IE

Ref legal event code: FD4D

ET Fr: translation filed
PLBE No opposition filed within time limit

Free format text: ORIGINAL CODE: 0009261

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: NO OPPOSITION FILED WITHIN TIME LIMIT

26N No opposition filed

Effective date: 20070518

REG Reference to a national code

Ref country code: CH

Ref legal event code: PL

BERE Be: lapsed

Owner name: ACCENTURE G.M.B.H.

Effective date: 20061231

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: AT

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20061221

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: GR

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20061117

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: LU

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20061221

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: CY

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20060816

REG Reference to a national code

Ref country code: GB

Ref legal event code: 732E

Free format text: REGISTERED BETWEEN 20100930 AND 20101006

REG Reference to a national code

Ref country code: FR

Ref legal event code: TP

REG Reference to a national code

Ref country code: GB

Ref legal event code: 732E

Free format text: REGISTERED BETWEEN 20101118 AND 20101124

REG Reference to a national code

Ref country code: FR

Ref legal event code: TP

REG Reference to a national code

Ref country code: DE

Ref legal event code: R081

Ref document number: 59913780

Country of ref document: DE

Owner name: ACCENTURE GLOBAL SERVICES LIMITED, IE

Free format text: FORMER OWNER: ACCENTURE GLOBAL SERVICES GMBH, SCHAFFHAUSEN, CH

Effective date: 20110518

REG Reference to a national code

Ref country code: FR

Ref legal event code: PLFP

Year of fee payment: 17

REG Reference to a national code

Ref country code: FR

Ref legal event code: PLFP

Year of fee payment: 18

REG Reference to a national code

Ref country code: FR

Ref legal event code: PLFP

Year of fee payment: 19

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: DE

Payment date: 20181211

Year of fee payment: 20

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: GB

Payment date: 20181219

Year of fee payment: 20

Ref country code: FR

Payment date: 20181122

Year of fee payment: 20

REG Reference to a national code

Ref country code: DE

Ref legal event code: R071

Ref document number: 59913780

Country of ref document: DE

REG Reference to a national code

Ref country code: GB

Ref legal event code: PE20

Expiry date: 20191220

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: GB

Free format text: LAPSE BECAUSE OF EXPIRATION OF PROTECTION

Effective date: 20191220