Abstract:
A directional, wireless, user-authenticating electronic token is disclosed. The token is embedded as an integrated system (generally, within a protective electronic enclosure). Typically the present invention includes a fingerprint sensor, a processor, a power source, a token transceiver and antenna, and orientation indicia. The antenna propagates highly directional signals. This allows users to orient (i.e., “aim”) token signals toward intended transceivers (POS machines, doors, computers, etc.), while reducing risks of transacting with “unintended” transceivers outside the aimed beam. The present invention offers an improved design for electronic wireless hardware tokens: providing versatile, secure, directional, wireless, user-authenticating devices (e.g., advanced ID cards, smartcards, hybrid cards, dongles, etc.). Such devices reduce risk of unintended emissions (i.e., signals radiating in the direction of unintended transceivers). As an optional aid to pointing the device in the direction of an intended transceiver, a narrow guiding light beam can be included as a target designator.

Description:
BACKGROUND 
       [0001]    1. Field of the Invention 
         [0002]    The field of the invention is wireless devices and wireless user-authenticating devices, more particularly, authenticating devices with highly directional signals and highly directional signal output lobes (footprints) for optimizing wireless message transmission in the direction of intended receivers only. 
         [0003]    2. Related Art 
         [0004]    There are a variety of “authenticating devices” in the art. Notwithstanding, the inventor has not found any other wireless authenticating devices with highly directional antenna footprints and other features and benefits of the present invention, comparable to the present invention. 
         [0005]    There are a variety of “hardware tokens” are known in the art. Typically, hardware tokens use a reduced size form factor physical enclosure, such as a USB dongle, a smartcard or other card, calculator size tokens, etc. Examples of radio frequency “hardware tokens” are products currently made and/or sold by HID; Exxon-Mobil SPEEDPASS®; etc. Generally, such hardware tokens are also directly bundled with enabling software products and they are provided as integrated and/or as embedded systems. Integrated systems and hardware tokens function together, thereby providing (often vendor specific) control and/or security solutions. 
         [0006]    Thus, the use of simple user-authenticating electronic “tokens”—e.g., smartcards and authenticating tokens, handheld “dongles” (and the like) for authenticating “enrolled and authorized” users and/or for performing secured transactions—are known in the art. Some of these devices are wirelessly operated in proximity to transceiver devices to authenticate and confirm the identity of enrolled authorized users (i.e., user token holders). In theory (and in limited practice) such devices can also operate to transfer account information needed prerequisite to completion of transaction(s), operate to open doors, operate to access computers, vaults, and other controlled and secured resources. In summary, existing user-authenticating electronic tokens are employed to help determine and communicate the extent of enrolled and authorized token users&#39; access privileges. The main challenge all these products have, is that most are neither wireless nor are the wireless products generally directional wireless products comparable in features and flexibility that are hallmarks of the present invention. 
         [0007]    In summary, while there are user-authenticating products and wireless products known in the art, the inventor finds no directional, wireless, user-authenticating electronic tokens comparable to the present invention. Thus, accordingly, there appears to be a need in the art for wireless electronic token products with directional, wireless, user-authenticating capabilities in a hardware token with a small form factor size. 
         [0008]    Necessity of the Invention: 
         [0009]    Wireless, directional, user-authenticating electronic “tokens”—e.g., smartcards, handheld “dongles”, and the like—for wirelessly authenticating users and/or performing secured transactions—appears to address unfulfilled needs and widely perceived needs of information technology consumers. 
         [0010]    The token devices of the present invention can be wirelessly operated in proximity to a transceiver device to confirm the identity of the token holder and (depending on configuration), such devices can also be operated to transfer account information needed to complete transaction(s) and/or determine the token holder&#39;s access privileges. No comparable products appear to exist in the market. 
         [0011]    As technology improves, the transmission range of personal identifying tokens such as contactless cards and RFID tags has grown from a few centimeters to more than one meter or greater, creating a hazard that a wireless transaction may radiate from the token&#39;s antenna and propagate in an unintended direction. Such “unintentional misdirection” from the wireless token, becomes an exposure; i.e., an unintentional signal misdirection allows a transmission to possibly be read by an unintended transceiver (receiver and/or transceiver). Such “misdirection” could result, e.g., in an erroneous transaction at another legitimate transceiver. Or, e.g., the misdirection could result in a false or unintended transaction with a “rogue transceiver”, which amounts to theft or worse. Additionally, in access control applications, the token holder may inadvertently or deliberately gain access to a wrong computing device (e.g., because the wireless signal was sent in many or all directions). 
         [0012]    Accordingly, it appears there&#39;s a need in the art for a wireless token that possesses the property of highly directional signal transmission such that the token holder can aim or point their wireless token at an intended transceiver or receiver (e.g., at a user&#39;s intended terminal, doorway, lock, vault, etc.) and gain access to that intended target receiver device—and/or transact business with that intended device—and only with that intended device. 
         [0013]    In summary, while there are user-authenticating products known in the art and wireless “token” products known in the art, there seems to be no highly directional, wireless, user-authenticating electronic tokens comparable to those of the present invention. Thus, there appears to be a need in the art for the secure and accurate present invention, a wireless electronic token product with highly directional, wireless, user-authenticating capabilities in a hardware token with a small form factor size. 
       OBJECTS OF THE INVENTION 
       [0014]    Accordingly, it is one primary object of the present invention to provide a wireless directional, user-authenticating “electronic token” that can be deliberately pointed only in the direction of (i.e., “aimed” at) intended receiver(s). Due to its&#39; highly directional antenna radiation propagation pattern (given its&#39; narrow-lobed, focused signal energy) the wireless user-authenticating token of the present invention, transmits little or no usable signal to unintended receivers, thereby increasing security and accuracy, while decreasing risks of unintended transmissions. 
         [0015]    It is another primary object, to provide one or more token-aiming indicators and/or indicia upon the exterior of the token of the present invention (e.g., at least one of an arrow, a pointer, or other distinctive visual indicia such as a LED or a focused light beam) to help a user optimally “aim” and orient the token accurately only upon intended receiver or transceiver. The token-aiming indicator(s) tell the user, the most effective directional orientation of the token, thereby maximizing optimum intended transmission characteristics, while minimizing signal transmission to unintended receivers and transceivers. The benefits of this feature are that it enables users to more quickly and accurately aim their token properly; this feature also reduces frustration due to inaccurate pointing and failure to transmit and receive properly, and/or due to inadvertent communication with an unintended receiver. 
         [0016]    It is another related object, to optionally provide a token-aiming “illuminator” (i.e., a “target designator”) to guide a user to optimally orient and aim the electronic token apparatus (essentially directly) at the intended receiver, along the path and plane of the token&#39;s maximum signal strength. 
         [0017]    It is yet another object of the invention, to provide one or more “token actuators”—i.e., man/machine interfaces on the exterior of the token—e.g., push button(s) and/or other “token actuating” device(s). In versions of the present invention which have advanced user authentication security features—e.g., biometric sensor(s)—each prospective token user must be properly authenticated, before the token is enabled, actuated, and capable of transmitting to and intended receiver. 
       SUMMARY OF THE INVENTION 
       [0018]    The present invention is a wireless, user authenticating radio frequency token, a device that possesses the property of highly directional wireless transmission. Using the present invention, the wireless token holder can point the token at any specifically intended receiver situated at any access point where authentication is warranted (e.g., a terminal, doorway, gate, vault, or etc.). Successful user authentication allows the user to gain logical, physical, or other access (e.g., door access, computer access, transactional access, etc.), but only with the intended target receiver or transceiver. 
         [0019]    Preferably, the token also provides one or more “token aiming” indicators—e.g., visual markings, and/or LEDs which flash when pointed in the direction of detected received carrier from an intended receiver, and/or other indicia or indicators—to help the user optimally aim and orient the token. When referring to such indicia, the user will always know how to approximately best aim the token toward the intended receiver. 
         [0020]    The tokens of the present invention may optionally also employ an “illuminating beam” to help the user better aim the token in the direction of maximum antenna output (signal strength) propagation toward an intended receiver. 
         [0021]    As an option, the token may be activated by a user&#39;s push or press of a button, a switch, or other authenticating sensor (e.g., a biometric device such as a fingerprint authenticating device, a voice authenticating device, an electrocardiogram authenticating device, etc.) with a processor that the user may employ to unlock its functions, once the token has been pointed in the right direction. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS AND REFERENCE NUMERALS 
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0022]      FIG. 1  depicts the system of the invention, from end to end. 
           [0023]      FIG. 2A  shows a token with fingerprint sensor and transmitter. 
           [0024]      FIG. 2B  shows a token with a push-button initiated transmitter. 
           [0025]      FIG. 3  illustrates a typical non-directional transmitter (an isotropic emitter). 
           [0026]      FIG. 4  shows a typical directionally-oriented signal (a directed emitter). 
           [0027]      FIG. 5  shows a typical non-directional signal emission pattern. 
           [0028]      FIG. 6  shows a typical directionally-oriented signal emission pattern. 
           [0029]      FIG. 7  illustrates a token-aiming, guiding illumination beam 
           [0030]      FIG. 8  depicts transmitting to target with data path 
           [0031]      FIG. 9  shows receiving with data path to illuminate ‘Carrier-Detect’ LED 
       
    
    
     REFERENCE NUMERALS 
       [0032]      102  User&#39;s hand with a finger being placed on its electronic fingerprint sensor 
         [0033]      104  Electronic Fingerprint Sensor and Processor 
         [0034]      106  Token in the form of a Card 
         [0035]      108  Processor for Electronic Token 
         [0036]      110  Radio Frequency transmission 
         [0037]      112  RF Transceiver target 
         [0038]      114  Communications path from transceiver  112  to terminal  116   
         [0039]      116  Screen on terminal device (e.g., computer or other machine) 
         [0040]      117  RF Transmitter (e.g., push button activated) 
         [0041]      118  Highly Directional Antenna 
         [0042]      119  RF Receiver (for detecting received signals from intended transceivers) 
         [0043]      120  Point Of Sale machine (terminal, computer, intended transceiver, etc.) 
         [0044]      122  Guiding Beam Light Source and light beam 
         [0045]      123  Guiding Beam centerline on Radio Signal Wave Front  126   
         [0046]      124  ‘Carrier-Detect’ LED 
         [0047]      126  Radio Signal Wave Front 
       DETAILED DESCRIPTION OF THE INVENTION 
       [0048]    There are many possible versions of the present invention, depending on application needs and configurations implemented. 
         [0049]    One version of the present invention can be activated only upon, and in response to a signal generated by a token transceiver. 
         [0050]    Another version of the present invention can be activated only after successful completion of biometric authentication of a prospective user fingerprint on the electronic token, after the user presents their finger and the fingerprint sensor processor matches the inputted fingerprint in storage and determines the inputted fingerprint to represent the presence of an authorized and pre-enrolled user. 
         [0051]    Yet another version of the present invention can be implemented with an actuator (e.g., a push-type button, or a switch) on the electronic token; in such a case, other security techniques can be used external to the electronic token to verify that the user is who they claim to be (not subjects of this application). The switch-actuated or push-button actuated versions of the invention can be considered “lower security” versions of the present invention, than the biometric fingerprint sensor versions. Additionally, when implemented, the push button (or plurality of push buttons) version of the present invention can be implemented in a manner such that a Personal Identification Number (PIN) can be used on the token, as one means for authentication of a prospective user of the token. 
         [0052]    Referring now to  FIG. 1 , an overview of the present invention is shown. When initially enrolling to use the invention—but prior to “going into the field”—the user  102  is directed to enroll his/her fingerprint(s) into an authenticating device such as a biometric fingerprint sensor (e.g., a fingerprint sensor  104 , coupled to a processor  108 , as shown in  FIG. 2A ) aboard electronic token apparatus  106 . In operation, after receiving a prompt (or at their own initiative): the user typically authenticates at least one pre-enrolled fingerprint to the fingerprint sensor aboard authenticator apparatus  106 , as explained in more detail in  FIG. 2A . Moving from left to right on  FIG. 1 , token  106  transmits to an intended receiver or transceiver  112 . In this case, the intended receiver  112  is an interim stop enroute to display and terminal  114  (generally, after further processing). 
         [0053]      FIG. 2A  shows a closer view of electronic token apparatus  106 . This drawing again shows a biometric fingerprint authentication version of the present invention. In operation, the user places one or more finger(s) on fingerprint sensor  104  and a graphic image of the fingerprint is captured as is well known in the art. When the user presents their fingerprint(s) to the fingerprint sensor  104  aboard token  106 , processor  108  verifies the presented fingerprint(s) by comparison to its stored (internal and/or external) fingerprint template database of authorized enrolled users. (This fingerprint recognition technique is known in the art, e.g., as more fully articulated in U.S. Pat. No. 4,582,985 to Lofberg, and many others.) Assuming the user&#39;s presented fingerprint(s) “match”—subsequent to the user successfully completing the step of fingerprint authentication—processor  108  generates transmittable message data for transmission to the intended receiver—e.g., data indicating the identity of the user and/or results of user authentication. 
         [0054]    Transmission of messages is effectuated by directional antenna  118 . NB: The performance characteristics of antenna  118  can be set and/or varied (depending on details of implementation)—either at the factory and/or by users and/or application owners (based on installation-specific security policies, based on implemented capabilities, and other factors). Transmission of the highly directional signal is accomplished via RF transmitter  117 . 
         [0055]    Optimally, most message transmissions between any user and any intended receiver occur optimally, while the user is (approximately) aiming the token of the present invention in the direction of the intended receiver or transceiver. Since it is an objective of the invention to increase security and decrease risk by limiting or precluding radio dialogue (message communications) between electronic tokens and “unintended receivers”—depending on implementation/configuration details—some tokens may not properly communicate with (or may be terminated from communication with) intended receivers, if the enrolled authorized user fails to exercise sufficient care in aiming the electronic token of the present invention. 
         [0056]    After the authorized enrolled user successfully completes biometric authentication, the token is enabled, and capable of receiving signals from its&#39; intended target device or transceiver device. The devices (both the token and its&#39; intended receiver) can then communicate in this way as long as necessary, i.e., until the transaction or access control function has been completed, ending transmission. 
         [0057]    In the discussion of  FIG. 2A  above, one version of the process of authenticating an enrolled authorized user is discussed, using biometric fingerprint inputs. It is important to note, different biometric authentication versions of the present invention can be used—as can be observed from references to both biometric and non-biometric user authentication modalities additionally discussed herein. 
         [0058]    Messages 
         [0059]    Once biometric authentication is successfully completed, device messaging begins. 
         [0060]    NB: Referring to  FIG. 1  will assist understanding these Message examples. This example comprises a “2-way authenticated message exchange”: 
         [0061]    Message sent from token  106  to the terminal  120 : 
         [0062]    [Header, Device Serial Number, Time Varying Parameter1, Checksum] 
         [0063]    Message returned from terminal  120  to the token  106 : 
         [0064]    [Header, ENCRYPTED (Device Serial Number, Time Varying Parameter1), Time Varying Parameter2, Checksum](NB: Parameter1 decrypted and verified upon receipt before proceeding.) 
         [0065]    Message sent from the token  106  to the terminal  120 : 
         [0066]    [Header, ENCRYPTED (Device Serial Number, Time Varying Parameter2), Checksum] 
         [0067]    (NB: Parameter2 decrypted and verified upon receipt before proceeding.) 
         [0068]    (NB: It is important to note, the above type of message exchange sequence is known in the art. Additional relevant data/information on messaging can be obtained from American National Standards Institute (ANSI) X9.19 message authentication standard. Additional basic definitions follow below.) 
         [0069]    Definitions: 
         [0070]    Header: A fixed data sequence to enable the recipient to recognize and synchronize with the message. 
         [0071]    Device Serial Number: A unique number for each authenticator apparatus manufactured, which is installed at the factory or introduced at the time the device is issued to the user. 
         [0072]    Authentication Result: An indication of the success or failure of a “biometric authentication of an authorized enrolled user” authentication event and optionally, an indication of the strength or certainty of that authentication (e.g., probability of positive match). NB: It is important to note, “biometric authentication” of a user, is different and separate of “cryptographic authentication” establishing the authenticity of a message, as defined in the ANSI X9.19 standard; i.e., it must be remembered that word “authentication” is used herein, in both these meanings, as should be obvious in explicit contexts that “authentication” is discussed. 
         [0073]    Checksum: A CRC (cyclic redundancy check) or other reliable means for detecting message errors, if any. 
         [0074]    Time-Varying Parameter: A number that changes over time and may optionally indicate the actual clock time at the transmitting authenticator device. (NB: This is included to allow intended receiver  112  (e.g., a terminal or data center and/or complex of machinery) to detect “replay” of previously-transmitted messages.) 
         [0075]    Time-Varying Challenge: An unpredictable number that is issued by the intended receiver  112  to be included in the encrypted or cryptographic response so as to prevent “replay” of old messages. 
         [0076]    Alternatively, the transmittable data can consist of the captured fingerprint image, itself, or a biometric template obtained from the fingerprint image. In any of these cases, the data is converted into a set of audio tones by modulating the audio signal to represent the binary data. This technique is well known to the art as “modem technology”, for example, as taught in U.S. Pat. No. 4,425,665 to Stauffer, and many others. Additionally, other biometrics can be used, such as a voiceprint or an electrocardiogram, assuming requisite input electronics and input feeds. 
         [0077]    Now referring to  FIG. 2B , a version of the invention is shown which does not use a fingerprint sensor user authentication. This version operates simply when actuated by one or more push button actuators, such as in  FIG. 2A . In this version of the invention, push button operation makes the device essentially a simple actuator, either with separate security features or no security features at all (depending on the application and configuration thereof). NB: As a counterpoint, the simple push button(s) version of the present invention can also be implemented with a basic, push button-implemented security feature by configuring it with the capability to provide a Personal Identification Number (PIN) authentication means for authenticating the user attempting to access the token device. Transmission of the highly directional signal of the present invention is done by RF transmitter  117 . 
         [0078]      FIG. 3  shows one typical version of a non-directional transmitter (essentially an “isotropic emitter” or “isotropic radiator”, which broadcasts a signal in all directions). The “360° broadcast” characteristics and virtually “spherical” signal output footprint of non-directional transmitters like this, make “isotropic radiators” not amenable to many applications targeted by the present invention. This omnidirectional radiator is shown to point out the typical (restrictive) state-of-the-art in transmitters. 
         [0079]      FIG. 4  depicts a directionally-oriented antenna and transceiver which employs a curved reflector to focus a signal beam. In this microwave case or near-microwave case, the curved reflector (shown) helps to direct and propagate signals in a narrow beam, but other “equifinal” signal narrowing and signal propagation techniques can be used. NB: Reduced beamwidth signals propagated by the directional antenna and transceiver of the present invention—plus an optional reflector provides a signal beam with a 10°-15° wide beamwidth, measured between ˜2-feet and ˜12-feet (the “target” distance) from an intended receiver. (Details are entirely dependent on implementation and configuration.) 
         [0080]      FIG. 5  shows a signal direction and signal strength plot of an antenna power radiation footprint typical to non-directional antennas, i.e., antennas which are not amenable to use in the present invention. 
         [0081]      FIG. 6  is a counterpoint to  FIG. 5 .  FIG. 6  depicts a signal direction and strength plot of the highly directional signal propagation characteristics of the present invention. It can be observed in this case, that a signal beamwidth of only 10°-15° is shown. 
         [0082]      FIG. 7  shows a picture of a user&#39;s finger (after self-authentication) pressing onto fingerprint sensor  104  aboard token  106 . The user is performing this action in order to transmit data and information to an intended receiver (via highly directional RF message transmission signals in signal wave front  126 ). Transmission from the token transceiver and antenna to the intended transceiver can occur either automatically after user authentication, or can occur when the authenticated user presses a transmit button (not shown), depending on implementation details. To assist an authenticated user undertaking “token aiming”, a guiding illumination beam  123  can be sent out from an light source, light source  122 . Source  122  either a collimated laser light source (comparable to a laser “pointer”), or a focused non-laser light source. After user authentication is complete, token  106  is enabled and capable of transmitting highly directional signals to intended transceiver  112  (or other intended transceiver) via radio frequency waves, or other transmission modality capable of transferring signal intelligence (e.g., sonic signals, etc.). 
         [0083]      FIG. 8  depicts transmissions from an electronic token  106 , to an intended transceiver target  112 . Furthermore,  FIG. 8  shows a data path from the token  106  to the transceiver target  112 , plus also again shows beam  123  aimed at (i.e., “targeted on”) the intended transceiver  112 .  FIG. 8  also depicts a highly directional RF message transmission signal wave front  126  directionality heading from the token to the intended transceiver  112 . Transmissions by RF transmitter  117  are initiated generally by push button and/or automatically after authentication. 
         [0084]      FIG. 9  depicts reception of a signal in token  106 , from an intended receiver  112 . Also shown is the receiving data path, which triggers illumination of a ‘Carrier-detect’ LED. Once the user has authenticated to their token, e.g., then the token transmits the user identification data to the intended receiver  112 , which subsequently acknowledges the receipt of the transmission by sending a signal to the token  106  to initiate handshaking. Alternatively, the intended receiver  112  can be polling out to notify incoming tokens that it is available. When the token  106  detects the presence of a polling signal from the intended receiver  112 , it can light the Carrier Detect LED  124 , as part of the process of helping the user optimally aim the token  106 . (Details are dependent on implementation and configuration and applications.) It is important to note, Carrier-detect LED  124  lights to notify the user of receipt of intended transceiver signals detected by RF receiver  119  aboard the token. Alternatively, or other modalities of notifying the user of detection of received carrier from an intended transceiver can be used, e.g., a sound from a sound (audio) generator can be used; a vibration from a vibration generator can be used; etc., depending on details of configuration and implementation. 
         [0085]    It is important to note, the terms “transceiver”, “receiver” “intended transceiver”, and “intended receiver” are generally are sometimes used interchangeably. Details of implementation and configuration make specifics of signal processing (i.e., data sources; data sinks; messaging dialogues and interactions between token(s) and one or more intended transceiver(s); single and multiple processing of messages; etc.) vary from one product version to another; from one system implementation to another; and from one application to another. This should be obvious and easily understood by those skilled in the arts directly and indirectly related to the present invention. 
         [0086]    Based on the foregoing, it is readily observed by those skilled in the art, that many variations of the present invention are possible. Accordingly, the literal scope of this patent application and its&#39; claims is not limited only to the disclosed embodiments and configurations disclosed herein.