NO318169B1 - Device for remote control and authentication - Google Patents

Description

This invention relates to a remote control device for operating an apparatus or system.

The invention also relates to a device for combined authentication and remote control where a secure authentication of the user is required.

The invention also relates to a method for remote control of a device, apparatus or system that uses a device for combined authentication and remote control.

Furthermore, the invention relates to a device and a method for authenticating authorized users for access to a service that is available via a network from a remote server and a corresponding method for gaining access to a service that is available via a network from a remote server using a set-top box.

An increasing number of service providers distribute their services via a network operated by cable companies or satellite distributors. A typical example is film distribution "Pay-per-view") via cable networks. The services {for example, movies) are distributed from one or more servers connected to terminals (for example, "set-top boxes"), where the content (for example, a movie) is displayed on a monitor (for example, a TV)

The users can operate their terminal (for example the "set-top box") with a remote control while the monitor (for example a TV) can be operated with a similar, but separate, remote control.

When the User orders a service (for example a film) from the Service Provider, this is registered on the server, which distributes the service (for example the film) to the User via the network. A log of the transaction is stored on the server, as a basis for subsequent billing to the User, for example on a monthly basis.

Current solutions have some limitations in their way of working which will be described below.

A first limitation of current solutions is related to the distribution chain and the system elements involved. The service provider does not know with sufficient certainty who the recipient is, and therefore cannot judge whether the recipient is a recipient who is entitled to the distributed service. If, for example, the service ordered by the consumer is an adult film, then the administrative software on the server should be able to filter the delivered content, so that minors do not have access to adult films. This can be solved by a password, or a PIN code that is entered into the user terminal (for example the "set-top box"). However, passwords or PIN codes are notoriously spread, intentionally or not, and are therefore misused in most cases sooner or later.

Another limitation of current systems is that the user terminal ("set-top box") and the monitor (TV screen) currently require separate remote control units. In addition, other devices at the customer's premises, such as for example a DVD player, VCR , etc. also separate remote controls, or can be equipped with a universal remote control, if all devices are purchased as part of a cohesive set. Alternatively, the User can purchase a programmable remote control that can be adapted to all devices to be operated. Such multi-purpose remote control can be cheaper than several different remote controls, and will be more convenient to use, as the simplification from many remote controls to a single device simply reduces the number of portable devices flooding the user's home. However, despite the fact that using a single remote control for multiple purposes is still a relatively expensive device, as any functionality to be handled by the remote usually requires separate function buttons, which represent a combination of mechanical and electronic components connected to the underlying printed circuit board.

Yet another limitation is currently that once remote controls are manufactured and distributed, they cannot be changed or modified without prohibitive costs. Functionality added or modified can therefore only provide

brought by handing over new remote controls.

Yet another limitation of current systems is related to the fact that such mechanical/electronic remote controls based on dedicated function buttons become unnecessarily expensive, due to limited competition and especially because remote controls are in most cases specially adapted to proprietary devices that it is supposed to control. In addition, normally every new device introduced to the market is equipped with new versions of remote controls, so that production volumes are significantly smaller than what could be possible.

As a typical example, reference is made to a known set-top box described in US patent no. 6,028,950 where a method for trading through a set-top box using fingerprint data is carried out. Typically for this application, the fingerprint reader sends a fingerprint, possibly a processed fingerprint, to a base unit via a connection, thereby forming a transmission line that can be intercepted.

Furthermore, it is known from the international patent publication WO 0201328 A2 a method for biometric input in a memory device, where a device is shown which has a processor, a user database and a biometric recognition system.

For elucidation of the background technique, reference can also be made to: http: // www , javacardforum . org / Documents / Biometry / JCBiometricsAP I WhitePaper - pdf , where issues and solutions when using biometric methods for authentication in a network are highlighted, and which describes the use of the "Match on Card" principle for identifying users in a network.

It can also be referred to http: // www, electronic-identity. org/download/EU-STUDY TB 1 BIONORM web. pdf which describes different techniques for using biometric data in connection with smart cards.

It is a main object of the present invention to produce an improved device with the properties: secure authentication of the users, for access to special services from a service provider's server by fingerprint, and

a remote control device which, in combined form, overcomes the above-mentioned limitations in the previously known solutions.

It is also an object of the present invention to provide a combination solution for remote control technology which enables a secure and convenient authorization of the user, especially for remote controls that are used to order goods or services via a network, but at the same time to produce a remote control which is generic, cheap to manufacture and flexible by adapting to new functionality and thereby being able to control a number of devices connected to a monitor (for example a

television).

In particular, it is an object of the invention to provide a remote control device which enables a secure and convenient authentication of a user, in order for a server to automatically effectuate an ordered service, for example to release any ordered movie ("pay-per- display").

It is a further object of the invention to provide a remote control device which enables a blocking of a service (for example the distribution of a film) if the user is identified as unauthorized for the particular ordered service (for example a minor attempting to order an adult film ).

It is yet another object of the present invention to provide a method for remote control of a device, apparatus or system or networked devices using a combined authentication and remote control device.

The objects set out above are achieved with a combined authentication and remote control device for controlling a remote system according to the invention, comprising a user input module, a processing unit and an interface module for communicating with the remote system having the characterizing features as given in independent claim 1 .

Preferred embodiments of the combined authentication and remote control device according to the invention are given in the independent claims 2-6.

The purposes of the present invention are also achieved by means of a method for remote control of a device, apparatus or system using a combined authentication and remote control device according to claim 6 comprising the steps in independent claim 7.

The purposes of the invention are also achieved by means of a method for remote control of a device, an apparatus or system using a device according to claim 1 and where the method includes the steps in independent claim 8.

Preferred embodiments of the method for remote control of a device, an apparatus or system using a device according to claim 1 are given in the independent claims 9-15.

The objects of the invention are also achieved with a set-top box for authenticating authorized users to provide access to a service made available for distribution in a network from a remote server, which has the characterizing features given in claim 16.

The invention will now be described in more detail with reference to the attached drawings, in which: Fig. 1 illustrates an example of a common distribution system for television. Fig. 2 Shows an example of a combined control unit

according to the invention.

Fig. 3A Outlines the new control unit according to the invention to combine user authentication and an improved remote control. Fig. 3B shows a control unit according to the invention, held

by a human hand.

Fig. 4A shows a first preferred embodiment of an integrated circuit (IC) which is the core part of the control unit according to the invention. Fig. 4B shows an even more preferred embodiment of an integrated circuit IC which is a core part of the control unit according to the invention. Fig. 5A-B illustrates a control unit according to the present invention, a control unit according to the present invention (Figure 5B) in contrast to a common remote control device included with available products (Figure 5A). Fig. 5C illustrates a control unit according to the present invention, with an integrated display unit. Figure 1 shows a network (N), through which a service is distributed from a server (30) to a terminal (31) in the User's home (34), and shows the contents of the display unit (33) on a television receiver (TV) (32). The distribution network (N) can either be wireless (in the case of satellites)

or using fixed lines (cable companies). Figure 2 shows how the terminal (31) is operated and authenticated using the new control unit (20) by giving the User feedback via the monitor (32). Figure 3 outlines the new control unit (20) which combines user authentication and an improved

remote control device in the device itself, using an IC (1) that enables user authentication and remote control of any device that connects to a monitor or display. Figure 4A shows one version of such an IC (1) while Figure 4B shows another version of the IC (1). Figure 5A illustrates a conventional prior art remote control unit, with a conventionally larger number of function buttons. In contrast, Figure 5B shows a control unit according to the present invention. Figure 5C illustrates a remote control according to the present invention, in an alternative embodiment with a built-in display, which enables the user to also control devices, devices or systems that do not incorporate a monitor.

The combined authentication and remote control device according to the invention comprises, as illustrated by the three views in Figure 3A, an outer housing (20) containing a fingerprint sensor (5) connected to a miniature printed circuit board PCB (21) on which the IC (1) is placed. The control unit (20) further comprises a battery (25) for power supply which is kept inside the housing (20) by means of a removable cover (26). The battery (25) is connected to the PCB (21) with wires. The controller is also equipped with a wireless 2-way transceiver (27), an On/Off button (24) for power, and all the active components are connected to the IC (1) using cables (23) via the PCB (21). Figure 3B illustrates this device (29) held by a human hand.

A biometrics sensor in the form of a fingerprint sensor (5) is connected to a biometrics processor in the form of an integrated circuit - IC - (1) which is the core device of the invention. In the context of this specification, the term fingerprint refers to the elevation and indentation pattern of any finger on one of the hands. Two versions of the IC are shown in Figures 4A and 4B. The details of the ICs will now be described.

The sensor (5) is connected to a fingerprint sensor image capture and pre-processing block (5C) via a first interface block (5A) as well as a wake-up circuit (5B), the function of the latter being to start up all the other blocks of the IC (1) . When a finger is detected on the sensor's (5) surface, the output signals from the sensor (5) will rise above a preset threshold, triggering the wake-up circuit (5B) to start up the rest of the IC (1) in a preset sequence. The first blocks to start up are the image capture and preprocessing block (5C) as well as the high-speed bus (3) and the volatile memory (6 or 6C), all of which are connected to the high-speed bus (3). The image acquisition and preprocessing block (5C) is designed to perform the initial, labor-intensive processing of the captured raw images from the sensor (5). The temporary results are stored in the volatile memory (6A or 6D). The volatile memory (6A or 6C) thereby provides working memory which is also available for the other modules on the IC (1).

Meanwhile, the remaining blocks on the IC (1) are booted up in a preset sequence, starting with the central processor (2) which is a powerful processor, such as ARM 9, or equivalent. The processor unit (2) is also connected to the high-speed bus (3) for communication with the other components or modules on the chip. The image capture and preprocessing block (5C) crushes the captured raw images into a temporary stage of significantly compressed information, i.e. a data set of reduced size, called temporary fingerprint data. The temporary data is fed to the central processor {2) for final reduction of the captured fingerprint images into compact fingerprint representations, called details. Such details are distinct points where fingerprint lines (elevations) start or stop, or locations of branches of the elevations and can be described by at least one vector comprising X and Y coordinates, and directions of the individual details, stored as an alphanumeric string in not -volatile memory (7, 7A, or 7E). The non-volatile memory (7, 7A or 7E), connected to the high-speed bus (3) via a second memory interface block (7B or 7D) is typically used to store program code (eg administrative software), custom security output responses and fingerprint representations in the form of details.

These fingerprint details from the access attempts are compared by the central processor (2) with main fingerprint details stored in non-volatile memory (7, 7A or 7E). These master fingerprint details will typically be the fingerprint details of the persons authorized to use the device. Depending on said comparison, an encryption of a secure output signal is performed in the processor unit (2) by obtaining encryption information, or alternatively scrambling information from the encryption modules (8 or 8A, 8B and 8C). The encryption modules are also connected to the high-speed bus (3). The obtained encryption information is used on the fingerprint data using the processing unit (2), thereby producing secured data that uses the processing unit (2), thereby producing secured data suitable as an output to the high-speed bus (3). Alternatively, the encryption and scrambling process can be performed in an encryption/scramble hardware module that is located separately from the main processor (2). If a positive match is established, the chip can proceed to generate a secure key (SKG) either processed by a special algorithm on the central processor (2) based on a seed pre-stored in the non-volatile memory (7, 7A, or 7E ), or alternatively built into the hardware block (8A). If the same SKG algorithm is run on two separate computers [for example a server (30) and the central processor (2) on the IC (1)] it will give the same key, or password, when the identical algorithm on both of the two separate computers are fed an identical seed. While the algorithms are usually assumed to be known, and will be the same for all computers in a network (N), or for a subset of users, the seed is individual and secret and known only to the system administrator and the user. The SKG algorithm may be designed to produce a pseudo-random and identical key on both computers (2 and 30) that is either valid for a period of time, or alternatively changed for each individual transaction. This requires the current key number and previous key numbers to be stored in the non-volatile memory (7, 7A, or 7E). Secret information such as seeds, key numbers, IP address, etc., can either be scrambled at block (8) and stored on an external normal Flash memory (7), or securely stored in Smart Card environments (7A or 7C). Once a key is generated, as above, the administrative software, stored in the non-volatile memory (7, 7A or 7E) and running on the central processor (2), can combine the information to form the basis of a secure communication between the IC (1) and the network server (30). The information to be encrypted may include a user identification code (ID), password and other information. Encryption is performed in hardware blocks (8 or 8B or 8C). The rules for secure communication enforced in the current network (N) are embedded in the administrative software running on the central processor (2) and can be adapted to include PKI and handshake sequences. The encryption blocks (8, 8B or 8C) can also be used to encrypt general information transactions between the IC (1) and the network server (30), if desired. Access to such extended encryption will be granted to the user pending a positive match of his fingerprint with an authorized fingerprint representation by compact master detail tables, pre-stored in the non-volatile memory (7, 7A or 7E). The IC (1) also includes hardware and/or software necessary to supply output signals to a number of other interface blocks (9A, 9B, 9C or 9D) to transfer data to other devices and networks (N) external to the IC (1) . In the present invention, the IC (1) is adapted to supply data to the external access-restricted devices, devices or systems. This second interface block may include hardware and software to support a USB (9A), Ethernet (9B), GPIO (9C), PCMCIA/UART (9D) and/or Smart Card (7C) interface. With the exception of the USB and Ethernet interfaces, the other interface blocks are served by a bus (4) with a lower bandwidth and capacity than the high-speed bus (3). The two buses (3 and 4) are connected by means of a bus bridge (11C). The hardware blocks that do not rely on high-speed transfers are connected to the slower bus (4). The IC's (1) hardware blocks are designed to perform their respective tasks in a minimum amount of time, and to interact with each other with a minimum of delays and queuing. In addition to the hardware blocks, the central processor (2) which executes the administrative software provides a high degree of flexibility in adapting the programming to external devices and networks (N).

The main difference between the IC (1) in Figure 4A and 4B is that the version in Figure 4B has volatile memory (6C) and non-volatile memory (7A) embedded as integral parts of the IC (1), thus reducing the need for data exchange with external memory and further improves the security and speed of the device's operation by containing almost all the processing of the fingerprints internally within the IC one (1).

Thereby, the IC (1) is designed as a multipurpose tool that can operate a fingerprint sensor (5) in a stand-alone mode, but it can also communicate with external devices and networks (30) by bridging biometrics from the sensor (5) and to a non-biometric representation according to the secure communication settings on the server (30) in a network (N) . The IC (1) transforms the fingerprints into a password or PKI, etc, under the current secure communication rules, according to the secure communication rules implemented on the server (30).

The use of the IC (1) for the authentication of an authorized user to gain access to a service distributed in a network (N) from a server (30) will first be explained for the arrangement where the authentication and remote control are carried out in a device according to the invention which includes an IC (1) as described above, placed in the terminal (31), for example the set-top box. In the context of this specification, the term set-top box refers to any receiving device connected to at least one local television set for receiving programs from a remote server or from a distribution network or system, which controls the television set, and possibly to descrambling or decrypting received programming and to scrambling or encrypting return signals, as exemplified in US Patent No. 6,028,950. - The user contacts the service provider to subscribe to selected services. - The service provider will hand over a suitable terminal (31) (for example a "set-top box") to the user, who connects it to his monitor (32) (TV set). - The service provider also provides the user with a unique seed, which may be preloaded in the terminal (31). This seed is then stored on the server (30) in the network (N) together with the user ID for the User. A number of available seeds can be pre-stored in the terminal (31) to enable a limited number of users to use the same terminal (31). - When the user receives the terminal (31) from the service provider, the administrator of the user group to access the terminal (1) (the main user, for example the head of the family) will register himself by entering his username and his fingerprint. The fingerprint image from the sensor (5) will be captured by the IC (1) and reduced to compact details, for storage in the non-volatile memory (7, 7A, or 7E). A user identification code (ID) or user classification code will be allocated to each stored

fingerprint representation on.

- The administrator will be given maximum user privileges, such as for example defined by "adult" in the context of "watch-on-order" films. The username, together with the Seed number (for example one of ten), the assigned access privileges (for example "adult") will be encrypted in block (8, 8B or 8C) on the basis of a secure key (SKG) generated by the central processor (2) or block (8A) and transferred via the network (N) to the server (30) at tj the sole supplier. - The encrypted message will be decrypted on the server (30) by the same encryption algorithm and for Seed number 1

in the terminal (31), identified by the Terminal number, or

The IP address of the terminal (31).

- The decrypted user information will be stored on the server (30) together with the Terminal number (or IP address) and the User ID.

The terminal's administrator (31) can then register the rest of the user group (for example a family) for access to the same terminal (31).

When a new user is registered, the administrator will countersign with his fingerprint on the sensor (5). If that fingerprint is authenticated against the pre-stored master detail representations for the administrator, then he will assign a username and access privileges (for example, "minor") to the new user. This information will be encrypted and transmitted to the server (30), and this information (User Name, Access Privileges, etc.) will be stored on the server (30) as a subset of the administrator for that terminal number. Such registration of new users by the administrator on the terminal (31) can be carried out immediately after the administrator has been registered or gradually over time. The administrator can also authorize users for a

limited time period.

- When a registered user (33) accesses the terminal (31) to access a service via the network (N) from a remote server (30) in order to order a service assigned to restrictions on access (for example, an adult film) will the user will be asked to identify himself by a fingerprint on the sensor (5).

Then the following steps will usually be carried out in the IC (1): - The access fingerprint image from the sensor (5) will be recorded using the IC (1) via a first interface block

(5A) .

- The acquired fingerprint images will be pre-processed in the image sensor recording and pre-processing block (5C). - The pre-processed data will be transferred via the high-speed bus (3) to the processor unit (2) to extract the features of the fingerprint, thereby reducing

that to compact detail fingerprint representations,

- The processor unit (2) obtains fingerprint information from a storage module that holds the pre-stored fingerprint details. - The compact access details of the extracted features representing the captured and pre-processed fingerprint images are compared to the pre-stored master detail tables located in the non-volatile memory (7, 7A or 7E). In the case of a non-match, the process will be interrupted by the IC (1), while in the case of a positive match, the IC (1) will allow the user to continue with his order, encrypting the UserID, the password (generated from Seed number n ) and the purchase description (for example film

the title), and transferred to the server.

- Depending on the result of said comparison, a generation of an encrypted, secure output signal is compiled in the processor unit (2) by obtaining encryption information, or alternatively scrambling information, from the encryption modules (8, 8A, 8B and 8C) connected to the high-speed bus (3) and applying this encryption information to the fingerprint data to produce secured communication data as an output to the high-speed bus (3). - Said secure output is supplied to the remote server (30) using at least one of the other interface blocks (9A, 9B or 9C) to deliver the secured data to the remote

the server (30).

- In response to the provided secured data, the server will, on the basis of the Terminal number (or IP address), try to decrypt the message, starting with Seed number 1 registered for that terminal. If unsuccessful, it will try to decrypt the message using Seed number 2 registered on that terminal and so on, until the correct seed for the particular user of the terminal is found. The number of seeds per terminal will in practice be limited to

example 50 users per terminal.

- Once the message has been decrypted and the password obtained, as well as the username, the server will compare the current access privileges for the requested service (for example, an adult movie) and compare these with the actual access privileges of the identified user. If the actual access privileges are equal to or higher than the current access privileges, then the server will approve the transaction and continue by

download the requested service to the terminal (31).

- If the identified user has insufficient access privileges to obtain the requested service, the server will categorize the user as unauthorized and will abort the operation.

The above method and apparatus will provide the following advantages;

- The administrator (main user) will have full control over which users are authorized to order which services. No passwords or PIN codes are required for the other users, where the password can be passed on voluntarily or involuntarily obtained by unauthorized persons

users, and thus misused.

- The service provider has insurance that no services are distributed to the owner (administrator) of the terminal which

the owner does not approve.

- Users do not need to remember yet another password or PIN code, but can conveniently use their fingerprints to access the parts of the system for which they are authorized

access to.

- The service provider will benefit from biometric verification of authorized users locally on their terminals (31), without having to choose a biometric standard on their

server, as the IC (1) bridges the biometric input centrally at the terminal (31), to a defined secure communication protocol in the network (N), which may include SKG/password, encryption, PKI and handshake sequences.

This will be possible due to the architecture and methodology of the IC (1) containing the powerful central processor (2). The identity authentication will be performed in a fraction of the available time for the IC (1). The central processor (2) therefore offers considerable free processing capacity that can be used for other purposes. Similarly, it is possible with this invention to move the preceding user authentication from a fingerprint sensor (5) placed on the terminal (31) (for example the set-top box) to a remote control device (20) which serves as a combined remote control and authentication device (20) which is more cost effective than traditional multi-button remote controls with mechanical/electronic components for each function, connected to a printed circuit board.

Figures 3A and 3B show such another preferred embodiment of the invention as a combined authentication and remote control device (20) which is a separate control unit (20) comprising an outer casing designed to fit snugly in the hand (Figure 3B), whether the user is right- or left-handed. On top of the control unit (20) there is a fingerprint sensor (5) conveniently placed for ergonomic operation using, for example, the thumb. There is also an On / Off button (24) for energy saving, if the user leaves the terminal (31), for example during holidays or similar longer periods. Turning on the power after an outage may require an authorized fingerprint to continue accessing the system, and the network and its services.

The control unit (20) is powered by a battery (25) which may be rechargeable or of a disposable type. The battery is held in place in the control unit (20) by a removable battery cover (26) for battery replacement. In the front of the control unit (20) there is a two-way wireless transceiver (27) that communicates with the terminal (32) or set-top box (31), which in turn is normally connected to the network (N), the server (30) and the monitor (32) (for example the TV set). All active electronic components of the remote control (20) are connected to a miniature printed circuit board PCB (21) which includes the integrated circuit (IC) (1).

This embodiment of the invention requires that the sensor (5) is of a type that can operate the IC (1) in 3 modes: - Sleep mode (for power saving). This is the normal mode. The IC's (1) trigger circuit (5B) will activate (start up) the rest of the IC (1) when a finger touches the fingerprint sensor (5), raising the output signal from the sensor (5) above a preset threshold for the trigger circuit (5B). - When the IC (1) has been started up from sleep mode, it will normally go to navigation mode. This means that any finger movement over the surface of the sensor (5) will be interpreted by the IC (1) according to a pre-stored set of navigation rules, called the finger command table, stored in the IC's (1) non-volatile memory (7, 7A or 7E ). This finger command table is based on elements or combinations of elements of finger movements over the surface of the sensor (5) or time-related touch/non-touch sequences of the finger on the sensor (5), such as for example a "tap" or a

"double bank".

- On request from the server (30), when access-restricted services are ordered, or from the terminal (31) for start-up or for configuration changes, or by means of the remote control (20) itself (start-up, registration of new users, etc.) the IC (1) is operated ) in the remote control (20) to authentication mode, waiting for a fingerprint to be captured by the sensor (5). Navigation mode on the control unit (20) will be performed as follows; - The remote control menu (33) to be reviewed with the help of the control unit (20) will be located as software on the terminal (31) rather than as at present, built-in hardware buttons on the current remote controls, (see Figure 5A). This menu (33) will be displayed on the monitor (32) (for

for example the TV set)

- The user will navigate the cursor within the displayed menu (33) by finger commands on the control unit (20). - Selection of a menu option can be carried out by placing the cursor over the desired option or option on the display (33), and then "double tap" with your finger on the sensor (5) to confirm the selection.

Another embodiment of the invention is shown in Figure 6C where the combined control unit, according to the invention, is equipped with an integrated small display. Thereby, the combined control unit according to the invention can also be used to control appliances, devices and systems that do not include a monitor (32), and still provide visual feedback to the user about his finger commands that are given to the control unit (20) by finger movements over the sensor (5). The procedure for operating such an embodiment of the invention is identical to the preceding descriptions, with the exception of the menus that are displayed locally on the control unit (20) itself.

Now, the operation of a combined authentication and remote control device will be described step-by-step, exemplified by the preferred embodiments illustrated in Figure 2. The steps to be described include:

1) Personalization, by the Service Provider.

2) Registration of Main User.

3) Registration of other users.

4) Remote control of appliances and devices.

5) Ordering a service.

These will be described in chronological order for the usual order.

Personalization / by the Service Provider.

- A user group (for example a family) orders a subscription with a Service Provider (for example a cable company or a satellite distributor) - The Service Provider compiles an equipment set for the subscriber (family). This set consists of a terminal (31) and a combined authentication and remote control unit (20), hereinafter referred to as the control unit (20).

The terminal will be a standard product, except that it is equipped with a two-way transceiver (27) and can be packaged without any further personalization. However, the control unit (20) must be equipped with factory settings

specified by the Service Provider. Such factory settings may typically include:

- The control unit (20) has been loaded from the factory

with software relevant to the Service Provider. This applies in particular to any encryption algorithm if it is different from the built-in DES/TDES algorithms built into the hardware blocks (8, 8B or 8C) of the IC (1). For the case where the Service Provider prefers any other encryption algorithm, this will be downloaded into the IC's (1) non-volatile memory (7, 7A, or 7E).

Furthermore, the factory will load the specific communication setup imposed by the Service Provider into the iCen's (1) non-volatile memory (7, 7A, or 7E)

Finally, the factory will load the version of the administrative software specified by the Service Provider into the IC's (1) non-volatile memory (7, 7A or 7E), including all subsets of the administrative software. In particular, such a subset is the interface commands between the control unit (20) and the terminal (31).

When the control unit (20) has been delivered from the factory to the Service Provider, it is time for the Service Provider to personalize the control unit (20) for the subscriber. Such personalization will be carried out by authorized personnel within the Service Provider's organisation, with a special Personalization program on their server (30). Preferably, the Personalization Program can only be accessed through a validated fingerprint to authenticate the operator as an authorized operator. Preferably, the Personalization program should be linked to other parts of the Service Provider's database, such as invoicing routines, and so on. When a subscriber has been entered into the database, and an authenticated Operator has entered the relevant data into the Personalization program, this can only be entered into the database by the Operator who countersigns with his fingerprint, to end the personalization of the control unit (20). The steps of such personalization can usually include the following: - The operator enters the ID of the control unit (20) into the database, together with the details of the subscriber, such as name, billing address, and details of the subscription conditions. - The operator processes the subscriber's details to be downloaded into the secret parts of the non-volatile memory block (7A or 7E) or alternatively to be scrambled at block (8) for storage in the non-volatile memory block (7). These details include: A set of secret seeds (eg ten seeds) for Secure Key Generation (SKG) for DES/TDES, or other encryption.

Optionally, electronic certificates for PKI and

public/private key cryptography.

IP address of the server partition, to be addressed

of the control unit (20) via the terminal (31).

This data is downloaded to the control unit (20) upon positive authentication by the Operator as an authorized user of the Personalization program. If not, the personalization routine will be interrupted. At the same time as these details of the personalization are downloaded to the control units, either for scrambling at block (8) for storage on external flash (7) or for loading in secret parts of the Smartcard block (7A or 7E), this data is copied to the server's (30 ) database, linked to the subscriber, including the unit ID of the control unit.

The control unit (20) will now be packed together with the terminal (31) for delivery to the subscriber (user). When the subscriber receives the package, he will connect the terminal (31) to his television receiver (32), and be ready to register as Main User for the control unit (20).

Registration of Main User:

The first person within the user group (for example a family) will normally be proposed as Main User (or System Administrator) for the control unit (20), with full privileges. When the battery (25) is inserted into the control unit (20) and the On button (24) is pressed, the control unit (20) will for the first time (after personalization) be directed to enrollment mode, ready to enroll the Main User through the following subsequent steps: - The control unit administrator software will trigger the enrollment menu (33) to be displayed on the monitor (32)

(for example the television screen) and encourage the person to be enrolled to enter the following information;

username (name or acronym), age, user status

(Main user, or regular user), and privileges (administrator, adult, minor, etc.) Usually, a user identification code (ID) or user classification code stored in this way can later be used in an access discrimination operation, for example performed by the processor (2) to allow different access functionality for different users.

- Once this information has been entered, the menu (33) displayed can prompt the Master User for a short training session for fingerprint capture, where a fingerprint image of acceptable quality (the model image) is shown on the display next to the instant fingerprint image of the finger to be swiped over the sensor (5 ). The user is guided by the menu text to swipe one of their fingers over the sensor

(5), and the result (the cleaned image) is displayed next to it

of the model image. For each swipe of the finger over the sensor

(5) the IC (1) will record the image from the image recording and

the preprocessing block (5C), which will perform the initial processing of cleaning up the image ("cleaned up image") and temporarily store this cleaned up image in the volatile working memory (6A or 6C). The cleaned image is then transferred via the high-speed bus (3) to the central processor (2) which will reduce it to fingerprint detail representations and calculate a quality measure for the image. The cleaned image will then be displayed in the menu (33) together with a measure and a judgment as to whether it is of acceptable quality or not. Note that the detailed fingerprint representations from the training session will not be permanently stored in the IC (1), but are simply intended to provide feedback to the user. When the user has thus swiped his finger over the sensor (5) a preset number of times (for example 3 consecutive times) with acceptable

quality, the administrative software changes

the control unit (20) to Registration mode.

- In Enrollment mode, the user will be prompted by the menu (33) to swipe his finger over the sensor (5) for registration of master detail fingerprint representations.

This will be performed as in the preceding procedure, except that the extracted detail table will be permanently stored in the IC's (1) non-volatile memory (7, 7A or 7E). The administrative software may be preset to require, for example, 3 master detail tables

of acceptable quality for each finger.

- When the main user's first fingerprint main detail table(s) of acceptable quality have been stored in the IC (1), the main user is asked if he wants to register more fingers. Note that the administrative software can be set up to ten different fingers, so the Main User should consider whether he should allocate these

between themselves and their family members.

- When the main user has correspondingly registered the selected number of his fingers, he will enter a menu selection which

says he has completed the registration.

- The administrative software on the IC (1) will now assign one of the pre-stored seeds (from the personalization of the Service Provider) to this

the user.

- This seed will then be accessed from the non-volatile memory (7, 7A, or 7E). For the case of storing the seed on the external Flash (7), the seed will be unscrambled, while for the case of storing the seed on the Smartcard blocks (7A or 7E), it will be extracted from the secret sections of the Smartcard block ( 7A or 7E). Note that this seed will never leave the IC's interior (1) i

during this process, and will be unreachable externally to the IC (1). The accessed seed will then be transferred via the high-speed bus (3) either to the central processor (2) (for the case of Figure 4A) or to the Secure Key

Generation (SKG) block (8A) (for the case in Figure 4B)

to produce a unique key.

- This key will then be transferred by the administrative software via the high-speed bus (3) to the appropriate encryption block, according to the setup in the administrative software subgroup on encryption, either to block (8, 8B or 8C) or alternatively using the keyword of an encryption algorithm (which forms a subset of the administrative software) downloaded into the non-volatile memory (7, 7A or 7E) during the factory preparation of the control unit (20) according to the specifications of

The service provider.

- The following message is then encrypted by the designated encryption method [hardware encryption block (8, 8B or 8C) or alternatively a specific encryption algorithm performed by the central processor (2)]: Ekey(user ID, assigned seed number, privilege). This information is then mixed with non-encrypted information Device ID, current key number and the IP address of the server (30).

The full message will thus include:

Manroi<=> [<IP>addr/Unit ID, keyno, Ekoy(user ID, seed^, privilege)]

- When the Main User has thus registered himself, he will, using the display menu (33), be asked to tick either "Continue" or "Change?". Assuming that the Main User has filled in the menu (33) correctly and is satisfied that the input he has given is correct (no printing errors, etc.), he will tick "Continue" and countersign with his fingerprint on the sensor (5). The administrative software in the IC (1) will process this countersignature fingerprint, extract the fingerprint detail representation and compare with the preceding master details which

was just entered by the main user.

- Depending on a positive match for validation of his fingerprint countersignature, the administrative software in the IC (1) will send the encrypted message "M" via the two-way wireless transceivers (27) to the terminal (31) where it will be forwarded to the server (30) at the IP address. - The server (30) which receives the partially encrypted message "M", will obtain the Unit ID from the non-encrypted part of the message "M" and look this up in the database on the server (30).

- From the database entries for the Unit ID, the server (30)

obtain the seed and the key number, and decrypt the encrypted ones

the parts of the message "M".

- The server (30) will then change the user ID, and the assigned seed number (seedi) as well as the privileges (for example

Main user, Adult) for the devices under Device ID.

- The server (30) will then increment its key number, and send an acknowledgment via the terminal (31) to the control unit (20), which in response will increment its key number, so that it is synchronized with the units below

The device ID of the server (30).

This completes the registration of the Main User. The main user who is now registered as the administrator [for this particular control unit (20)] among the database objects under the Unit ID on the server (30) now has the privileges to enroll other users (for example his family).

User registration

The main user is now entitled to enroll other users. This will usually follow the same procedure as for enrolling the Master User, with some minor deviations which will be outlined below: The Master User will place their finger on control the unit's (20) sensor (5). This will raise the output signal from the sensor (5) to a level that exceeds a preset threshold within the IC's (1) gain block (5B), which starts up the IC (1) in a preset sequence

to go to normal wake mode "navigation".

A main menu (33) will be displayed on the monitor (32). The main user will move his finger on the sensor (5) causing the cursor on the displayed menu (33) to follow his finger movements on the sensor (5) as explained under "Control devices". The main user will use his finger to move the cursor to the menu option "Register" and then select this option by double-pressing his finger

on the sensor (5).

To gain access to the Enrollment menu, the Main User is asked to authenticate himself, using a verified fingerprint. He will swipe his finger over the sensor (5). The sensor output signal is directed to the IC (1) via the sensor interface block (5A) to the image acquisition and preprocessing block (5C). The access detail table extracted by the central processor (2) from the temporary fingerprint representation output on block (5C) is then compared with the Master User's main detail table(s) securely stored in non-volatile memory blocks (7, 7A, or 7E). Provided that the access detail table is checked to match the main detail table for the Main User, the Enrollment menu opens and the IC (1) switches back to navigation mode. For the case of no match,

the registration process is interrupted.

- The registration menu starts with a registration window where the main user enters the following information about the new user; username (name or acronym, age and privileges (adult or minor). For demonstration purposes, let's say that this new user is entered with the "minor" privilege, which means that the Master User will exclude the new user from being able to

order adult films ("pay-per-view").

When this new information is entered, the menu (33) can

which is presented drive the new user to a short training session for fingerprint capture, where a fingerprint image of acceptable quality (the model image) is shown on the display next to the instant fingerprint image of the finger to be swiped over the sensor (5) . The user is guided by the menu text to swipe one of their fingers over the sensor (5), and the result (the cleaned image) is displayed next to the model image. This training is managed by ICen's (1) administrative software according to the same procedure as explained under Registration of Main User. When the user has thereby swiped his finger over the sensor (5) a preset number of times (for example 3 consecutive times) with acceptable quality, the administrative software switches the control unit (20) to Registration mode.

The new user is registered by fingerprint registration, using exactly the same procedures as

explained under Registration of the Main User.

Once a sufficient (let's say three) number of fingerprint master detail representations have been collected for the new user's finger, another of the new user's fingers can be enrolled using the same

the procedure.

When the registration is complete, the Main User will countersign using one of their fingers. If the administrative software, using the IC's (1) hardware blocks, confirms the Main User is authentic (by a match with one of the previously enrolled main fingerprint detail tables for the Main User), the enrollment is completed. For the case of a non-match,

the registration process is interrupted at this stage.

ICen's (1) administrative software then assigns it

next available seed number to the new user. The controller (20) then compiles a partially encrypted message, using the administrative software and

IC's (1) hardware blocks, comprising:

Hanroi15[IPad«ir,Unit ID, keyno, Ej^y(user ID, seed„0, privilege)] The control unit (20) then transmits this message "M" using the two-way wireless transceivers (27) to the terminal (31) which forwards the message to the server (30). The server (30) that receives the partially encrypted message "M" will obtain the Unit ID from the unencrypted part of the message "M" and look it up in the database on the server (30).

From the database entries for the Unit ID, the server will

(30) obtain the seed and key number and decrypt them

encrypted the parts of the message "M".

The server (30) will then change the User ID, and assign a seed number (seed) as well as privileges (for example Normal

User, Minor) to the devices under Device ID. The server (30) will then increment its key number for this particular user, and send an acknowledgment via the terminal (31) to the control unit (20), which in response will increment its key number, so it is synchronized with that of the Device ID units for the server ( 30).

This completes the registration of a new user. Additional users can then be registered by the Main User at any time, but only by the Main User.

Below it will be described how appliances and devices can be controlled by the control unit (20).

Control devices

Another preferred embodiment of the method for controlling a device, apparatus or system comprises using the invention to select menus to be displayed on a monitor, to perform navigation within such menus, and finally to perform selections/commands within such menus.

When triggered by a finger on the sensor (5), the IC (1) on the control unit (20) will normally be woken up to go into Navigation mode, where a finger moved over the sensor (5) will be interpreted as navigation commands for a cursor. The remote control device may comprise a fingerprint sensor adapted to detect finger touches as well as lateral finger movements.

Such finger movements or touches on the sensor (5) involve the execution of the following steps in said Navi-gas ion mode : The presence of a finger on the fingerprint sensor is detected (5, 5A-B) , and the IC (1) is normally started up

to Navigation mode.

The subsequently captured fingerprint images are pre-processed (5C) in the image capture and pre-processing block to produce a number of condensed images.

The incremental differences in the compact image information from the pre-processing block (5C) are analyzed by means of the central processor (2) which determines the direction of movement of the finger (A) and the associated speed of movement over the sensor (5), and whether the finger (A) contact on the surface of the sensor (5) is interrupted, and possibly how long such an interruption i

the contact lasts.

In the central processor (2) the obtained information is compared, for example the finger speed and

-the direction, contact or non-contact versus time, with a pre-stored table of finger commands, such as defined for example by sequences and directions of finger movements over the sensor, stored in one of the non-volatile memory blocks (7, 7A, or 7E). Sets of fingerprint command structures can thus be defined and detected, thus enabling a multifunctional tool for fingerprint scanning, input of text/characters in multiple modes, and cursor control, all by finger commands on a single

sensor or sensor device.

Using the central processor (2), and depending on the results of said comparison, it is determined which finger command the analyzed finger movement

represents.

Then, the code for this particular finger command is transferred from the central processor (2) via the high-speed bus (3) to a selected communication interface block (9A, 9B, 9C, or 9D). Furthermore, the command code is transmitted from said interface block to the remotely controlled device, apparatus or system, preferably in wireless form (27).

Such an interpretation of finger movements into commands can, for example, offer the user the means to navigate and control a menu that is presented to the user

on the monitor.

Finally, in the remote controlled device, apparatus or system, the said command is interpreted and provided to the operating system of the remote controlled

the device, apparatus or system.

The secure communication between the control unit (20) and the network server (30), via the terminal (31), can include a variety of different transmissions. A unique User ID, for example in the form of a long alphanumeric string, by means of which the User (34) is identified, in a data warehouse on the server (30) could be transferred. Alternatively, a unique password that is automatically triggered by a positive identity match in the IC (1) can be transmitted. In another alternative, an alphanumeric code identifying the type of access or service may be transmitted. In yet another alternative, all of the aforementioned transmission elements could be transmitted in packed format and encrypted using one of the blocks (8, 8A, 8B or 8C).

The control unit (20) can similarly be used as an authentication and remote control unit with several functions. The latter application can be used to control devices such as DVD players, TV sets and similar devices.

The procedure below is performed to order a movie from the Service Provider, where an example also demonstrates the validation of an eligible buyer.

Ordering services

In this context, the Main User (for example the head of a family) can decide that his minor children should not be able to order adult films when they are at home alone. If the family so decides, they will have entered a choice in their subscription contract. The control unit (20) according to the invention would make it possible for the Service Provider to offer such a service by the server automatically checking the privileges of the user who orders a service, and still be sure that biometric authentication of a buyer of the control unit (20) can accommodate this.

The assumption is that the Service Provider offers such filtering, and that the Main User assigns the corresponding privileges when registering his family. This example demonstrates the versatility of the invention: - When a user wants to order a service from the Service Provider (let's say order a movie using "pay-per-view"), he will pick up the control unit (20) and touch the fingerprint sensor ( 5).

A finger on the sensor will trigger the IC (1) to wake up

up from sleep mode, and normally go to navigation mode. This will trigger the display of a menu (33) on the TV set (32). The user will then move the cursor in the menu, by

move your finger on the sensor (5), until the cursor is

placed above the "Order Film" checkbox.

The user then double taps his finger on the sensor (5) and confirms his choice. This will presumably bring up a list of categories of movies. The user then moves the cursor by moving his finger over the sensor (5) until the box for the desired category is checked and then double-taps his finger on the sensor (5) to make

the election. For the sake of the example, an adult film is chosen. The request for the selected film is transmitted via the terminal (31) to the server (30) which looks up the title in its database and establishes that this film selection requires

"adult" privileges for the user.

The server (30) then returns an authentication request to the terminal (31) which forwards this request to the control unit (20) via two-way wireless transceivers (27).

The controller (20) responds by entering authentication mode, supported by a visual feedback

by a message in the menu (33).

The user swipes his finger over the sensor (5). The sensor output signal is captured by the IC's (1) image capture and pre-processing block (5C) and the fingerprint is processed, as previously described, comparing this with the resident master details in non-volatile

memories (7, 7A, or 7E).

The continuation can be handled in one of two alternative ways:

- Either the control unit can establish that the owner of the fingerprint matched against a unit with the privileges "minor" is not authorized for such

purchase, thereby interrupting the ordering sequence then and there, Or, the IC (1) could generate a message back to the server (30) as previously described, comprising: M«iroi= [IPaddrfUnit ID, keyne>, Ekey(user ID, seed„ 0,

privilege)]

The server (30) will decrypt this message, as previously described, extract the privilege and then abort the ordering sequence.

In any case, this verification by fingerprint of the control unit (20) enables a filtering of the available content from the Service Provider pending classification (privilege) for the user. The same approach can also be used on PCs with Internet access, to block access to unwanted content from Service Providers (such as pornography, etc.) by classifying the content of the web portal operators.

The advantage of the control unit (20) and the corresponding method for using the control unit (20) according to the invention is essentially: - The control unit (20) can be made very simple without countless function buttons, as shown in Figures 5A and 5B, where a conventional previously known remote control unit (28) and a control unit (20) according to the present invention are shown side by side. Thus, the costs of a remote control can be tightened with a control unit according to the present invention. - As the functionality is stored in software to be displayed on the monitor (32), this is very flexible, and can be fitted into a large variety of terminal makes (30) and there is no need to specially adapt a remote control to the terminal (31) . Correspondingly, the production volumes for the control units (20) according to the invention can be significantly larger than previously known remote controls, thereby tightening the production costs of the remote controls even more. - Due to this flexibility, the service providers are free to upgrade their services even when this involves modification of user interface and interaction, without having to replace obsolete hardware (terminals and remote controls). This can accelerate adaptation to usability.

- The authentication device and the control unit will be combined into a single unit (20) which is much cheaper than the current remote control alone.

The advantages of the remote control unit (20) and corresponding methods for using the remote control unit (20) according to the invention are essentially;

The remote control (20) can be made very simply without countless function buttons as shown in Figure 5, where a typical previously known remote control unit (28) and a remote control unit according to the present invention are shown side by side. Thus, the costs of the remote control can be reduced with a remote control according to the present

invention.

As the functionality is stored in software to

be displayed on the monitor (32), this is very flexible, and can be fitted into a large variety of terminal makes (30) and there is no need to specially adapt the remote control to the terminal (31). Correspondingly, the volumes of remote controls can be significantly larger than the current editions, thereby pushing the production costs of the remote controls even more.

Because of this flexibility, service providers are free to upgrade their services even when this involves modifications to the user interface and interaction, without having to replace obsolete hardware (terminals and remote controls) This can accelerate adaptation to

ease of use.

The authentication device and remote control device will be combined into a single unit (20) which is even cheaper than current remote controls alone.

Claims (16)

1. Device for combined authentication and remote control when controlling a remote system comprehensively a user input module, a processing unit and interface module for communicating with the remote system, characterized by an integrated circuit (IC) (1) to provide increased security by superimposing between fingerprint input from a user and secure communication with the remote device and the network to which it is connected, said IC having at least the following parts: - a processor unit ( 2) which communicates with the other components on the chip via a high-speed bus (3), - a first memory interface block (6B or 6D) which is connected to the high-speed bus (3) for connection with volatile memory (6A or 6C), thereby providing available working memory for the other modules of the integrated circuit, - a second memory interface block (7B) connected to the high-speed bus (3) for connection with non-volatile memory (7A or 7 or 7E) for storing program code, for example administrative software and specially adapted security output responses and fingerprint representations in the form of so-called details, - a first interface block (5A) to be connected to a fingerprint sensor (5), - said first interface block okk (5A) is connected to a fingerprint sensor signal recording and preprocessing block (5C), - said sensor signal recording and preprocessing block (5C) comprises a powerful processing module to reduce the large volume of raw fingerprint images captured by the sensor (5) to a data set with a reduced volume , called temporary fingerprint data, for delivery as output to the central processor block (2) via the high-speed bus (3), for final processing in the central processor block (2) into a more compact form of representations of fingerprints, called fingerprint details, - encryption modules (8 or 8A, 8B and 8C) connected to the high-speed bus (3) to provide encryption information, or alternatively scrambling information, - the processor unit (2) is adapted to use the encryption information on the fingerprint data to produce secured data as an output to the high-speed bus (3), - other interface blocks (9A, 9B or 9C) to supply the secured the data of the remote system and the network to which it is connected. 2. Device for combined authentication and remote control according to claim 1, comprising - fingerprint information storage means for storing information related to authorized users' fingerprint characteristics, - fingerprint input means for entering authorized users' fingerprint characteristics into non-volatile memory on the IC and - fingerprint verification means for checking authenticity by the user attempting to access the remote system. 3. Device for combined authentication and remote control according to claim 1, comprising - access discrimination means to allow different access functionality for separate users. 4. Device for combined authentication and remote control according to claim 1, comprising - navigation and control means in which a user is able to provide navigation input commands for navigation in a menu presented to the user. 5. Device for combined authentication and remote control according to claim 1, comprising - fingerprint scanning sensor with the ability to detect finger touches as well as lateral finger movements, - storage means containing predetermined categories of finger movements and sequences thereof and sets of finger command structures, enabling a multifunctional tool for fingerprint scanning, text/character input in multiple modes, and cursor control, all by finger commands on a single sensor. 6. Device for combined authentication and remote control according to claim 1, with a built-in integrated circuit - IC - (1) comprising - a non-volatile storage means (7, 7A or 7E) in which the finger movement characteristics are stored in a finger command table, - said finger command table includes tolerance acceptance criteria for how finger movements should be interpreted, and tolerance settings for how sequences of touch/non-touch on the sensor (5) should be interpreted, - an image capture and pre-processing block (5C) capable of continuous processing of a stream of image capture from a fingerprint sensor (5) into a condensed form of incremental finger movements, - a central processor (2) capable of interpreting the information stream of incremental finger movements from the image capture and pre-processing block (5C), and capable of comparing such incremental finger movements with the finger command table stored in the non-volatile storage means {7, 7A or 7E), - said central processor (2) is capable of determining whether the current incremental finger movement signal received from image capture and preprocessing block (5C) falls within the tolerance criteria for a particular finger command for said finger command table stored in the non-volatile storage means (7, 7A or 7E), - said central processor (2) is able to issue (eng.: two outputs) the identified finger command to a preset selection of interface block (9A, 9B, 9C or 9D), - and said remote control device further comprising a two-way transceiver for wirelessly transmitting the current finger command for interaction via the menu (33) displayed on the monitor (32) (eg, the TV screen). 7. Method for remote control of a device, an apparatus or system using a device for combined authentication and remote control according to claim 6, where the following steps are performed: - an integrated circuit - IC - (1) is normally woken up by a finger (A ) on a sensor (5) that triggers an output signal that starts up the IC (1) in a preset sequence that normally puts the remote control device in a "navigation mode", unless an external command [for example from the server (30)] requests an "authentication mode ", - an image capture and pre-processing block (5C) captures a stream of images from the fingerprint sensor (5) via a first interface block (5A), - said image capture and pre-processing block (5C) compresses the stream of captured images to incremental finger movements, - said incremental finger movements are continuously transmitted from the image capture and pre-processing block (5C) via the high-speed bus (3) to the central processor (2), - said central pros essor (2) compares a sequence of incremental finger movements received from the image acquisition and pre-processing block (5C) with at least one of pre-stored (7, 7A or 7E) sets of finger command tables, - depending on the result of the above comparison, a finger command can be transmitted via the high-speed bus (3) and alternatively also via the second bus (4) to a preset output interface block (9A, 9B, 9C or 9D), - the output finger command is further transmitted wirelessly via two-way transceivers (27) to a terminal (31), - the terminal (31) interprets the received finger command into a cursor control signal ("move right", "move left", "move up", "move down", "select", and so on) into a menu (33) displayed on a monitor (32) (for example a TV set), thereby enabling a user (34) to interact with the cursor position within the displayed menu (33) and to determine his next movement of his finger (A) on the sensor (5). 8. Method for remotely controlling a device, apparatus or system using a device for combined authentication and remote control according to claim 1, where the following steps are performed in the integrated circuit (1): - recording (5C) of an image in a fingerprint sensor (5) via a first interface block (5A), - preprocessing (5C) of the captured signal in the sensor image capture and preprocessing block (5C), - transferring the preprocessed data to the processor unit (2) to extract the features of the fingerprints via a high-speed bus, - obtaining fingerprint information from a storage module that holds pre-stored fingerprint information, - comparison in the processor unit (2) of the extracted features representing the fingerprint recordings with features of the pre-stored fingerprints of the authorized persons, - depending on said comparison, encrypting a secure output signal in the processor unit ( 2) by obtaining encryption information, or is alternatively scrambling information from the encryption modules (8 or 8A, 8B and 8C) connected to the high-speed bus (3) and applying this encryption information to the fingerprint data, to produce secured data as an output signal to the high-speed bus (3), and - delivering said secure output to the remote controlled device. 9. Method according to claim 8, comprising first performing the following steps, - registering the fingerprints for an administrator and one or more authorized users, - processing and storing representations for said registered fingerprints in non-volatile memory (7, 7A, or 7E), and - allocating a user identification code (ID) or user classification code for each of the stored fingerprint representations. 10. Method according to claim 9, where in a normal remote control mode the following steps are performed, - detection of the presence of a finger over the fingerprint sensor, - pre-processing of a number of captured fingerprint images in the pre-processing unit (5C) to produce a number compact images, - to analyze, in the central processor (2), the incremental differences of the compressed image information from the pre-processing block (5C) to determine the direction of the finger (A) movement and the associated speed of movement over the sensor (5) and whether the contact of the finger (A) on the surface of the sensor (5) is broken, and for how long such a break in the contact lasts, - comparison in the central processor (2) of the generated information, for example finger speed and direction, contact or non-contact against time, with a pre-stored table of finger commands, such as defined by sequences and directions of finger movement over the sensor, stored in one of the non - the volatile memory blocks (7, 7A or 7E), - determining in the central processor (2), depending on the results of said comparison, which finger command the finger movement represents, - transmitting from the central processor (2) the code for this particular finger command via the high-speed bus to a selected communication interface block (9A, 9B, 9C or 9D), - transmitting the command code from said interface block to the remote controlled device, device or system, preferably in wireless form, - interpreting said command code in the remote controlled device, device or system, and - deliver these command codes to the operating system of the remote device, apparatus, or system. 11. Method according to any one of claims 8-9 where the remotely controlled device, apparatus or system is a terminal, preferably local, which communicates with a remote host machine, server or service provider via a network (N). 12. Method according to claim 11, comprising the following steps; - to interpret in the terminal the command codes originating in the central processor, - to transmit the command codes to said remote host, server or service provider via said network (N) in order to request a service, - said remote host, server or service provider responds by returning an authentication request to the terminal, where said terminal then puts the remote control device in authentication mode, - performing an authentication procedure in the remote device to try to identify the user from detected fingerprints. 13. Method according to claim 12, where the authentication procedure comprises the following steps: - recording (5C) of an image in the fingerprint sensor (5) via a first interface block (5A), - preprocessing (5C) of the captured fingerprint signal in the sensor image recording - and the pre-processing block (5C) containing hardware built-in algorithms optimized for high-speed processing of the most labor-intensive initial processing of the raw fingerprint image data, - transmission via a high-speed bus (3) of the pre-processed data to the processor unit (2) to extract compressed fingerprint detail features, - obtaining by the processor unit (2) compressed fingerprint detail information from a non-volatile storage module (7, 7A, or 7E) holding pre-stored master fingerprint representations for authorized persons, - comparison in the processor unit (2) of the extracted the features representing the fingerprints occupied by the features for the pre-stored master fingerprint representations, - to produce, depending on a result of said comparison, a predefined secure output to the network via the terminal through a pre-selected set among several communication interfaces (9A, 9B, 9C, 9D, and 7C) in the remote control device , - the server will receive the encrypted identity of the User and checks with its database whether this User has valid access privileges that match the User's requested access, - depending on the result of this authorization check, the server decides whether the requested access should be opened, thereby allowing the provision of a service , for example an adult film from a service provider in a cable TV network, to the user. 14. Method according to claim 11, where the secure communication between the remote control device and the network server, via the terminal, comprises a combination of one or more of the following steps: - transmission of a unique UserID, for example in the form of a long alphanumeric string by which the User is identified included in the data store on the server, - transmission of a unique password automatically triggered by a positive identity match in the IC (1), - transmission of an alphanumeric code that identifies the type of access or service requested, - transmission of all the above-mentioned information in a packaged and encrypted format using one of the blocks (8, 8A, 8B or 8C). 15. Method according to claim 14 comprising the following steps: - to generate a password that is significantly longer than what would normally be remembered by most people, - to change the password in the remote control device according to pre-stored algorithms, for example depending on time or the number of transactions . 16. Set-top box {31) for authentication of authorized users to gain access to a service made available for distribution in a network (N) from a remote server (30) characterized by an integrated circuit (IC) (1) to provide increased security in the superstructure between fingerprint input from a user and secure communication with the remote device and the network to which it is connected, said IC having at least the following parts: - a processor unit (2) which communicates with the other components on the chip via a high-speed bus (3), - a first memory interface block (6B or 6D) which is connected to the high-speed bus (3) for connection with volatile memory (6A or 6C), which thereby providing available working memory for other modules on the integrated circuit, - a second memory interface block (7B) which is connected to the high-speed bus (3) for connection with non-volatile memory (7A or 7 or 7E) for storing program code, for example administrative software and custom security output responses and fingerprint representations in the form of so-called details, - a first interface block (5A) to be connected to a fingerprint sensor (5), - said first interface block (5A) is connected to a fingerprint sensor image capture and preprocessing block <5C), - said sensor image capture and preprocessing block (5C) comprises a powerful processing module to reduce the large volume of raw fingerprint images captured from the sensor (5) into a set of data with reduced volume, called temporary fingerprint data, for presentation as output to the central processor block (2) via the high-speed bus (3), for final processing in the central processor block (2) into a more compact form of fingerprint representations, called fingerprint details, - encryption modules (8 , or 8A, 8B and 8C) connected to the high-speed bus (3) to supply encryption information, or alternatively scrambling information, - where the processor unit (2) is adapted to use the encryption information on the fingerprint data to create secured data as an output to the high-speed bus (3) - other interface blocks (9A, 9B or 9C) to supply the secured data to the remote system and the network it is connected to.