DE19906388A1 - Personalizing, verifying identity, security documents involves placing personal data and/or correlated data in document in second, machine-readable form generated using biometric technique - Google Patents

Abstract

The method involves applying personal data to the document in alphanumeric and/or graphical form. Personal data and/or data correlated with it that are present in or on the document in a second, machine-readable form are generated using a biometric technique. Independent claims are also included for an identity or security document, for a device for verifying an identity or security document.

Description

The invention relates to a method and an apparatus for Personalization and verification of identity and security documents as well as an identity and security document that can be used with it.

Highly secure identity documents such as ID cards, passports, licenses, Driver's licenses, motor vehicle licenses, membership cards, company and service ID cards, Credit cards and the like consist of an unpersonalized one Document body on and / or in which the personal data of the holder be introduced in an inseparable way from the document body. For this are several methods known, z. B. photographic processes, laser engraving, Thermal transfer, dye sublimation, xerographic laser processes, ink jet Procedures etc. are to be mentioned.

The document body itself can consist of different materials, combinations, constructions of materials, formats and additions. Examples of materials are: identity and security papers, plastics such as polycarbonate and polyvinyl chloride. Examples of formats are:
ID0, ID1 [ICAO and ISO standards, e.g. B. ISO 7816].

Said identity documents are for security reasons in one Companies of value and security technology manufactured and centrally personalized. When personalizing, the personal data of the owner introduced into the document body using various methods.

There are basically two classes of personnel data:
alphanumeric and graphic personnel data. Alphanumeric personal data basically consist of letters, numbers and special characters of the different character sets (fonts). An example of the scope of a character set in the European language area is shown in ISO 8859. However, there are other character sets for z. B. Arabic or Asian fonts. The OCR briefs in the ICAO lines of identity documents represent a special form because they are machine-readable. This makes it possible to read and verify alphanumeric data of the identity document with the aid of a reader (scanner).

Typical graphic data of an identity document are: portraits, Signatures, fingerprints, barcodes, national emblems and logos. This Graphic data are created using modern photographic or digital printing and Engraving process introduced in the identity document. This ensures that the personal data is inextricably linked to the document.

Automatic methods are known for the alphanumeric personal data, the z. B. at airports the ICAO lines with the help of appropriate reading devices Read (scanner) and with the entries in an electronic Compare personal archive (database). However, this procedure continues the online connection between the scanner and a central database ahead and cannot yet be applied to graphic data, since this is a high complexity and thus a high data volume. The height Complexity results in a high processor performance of those involved Information processing systems for the transmission and processing of the Data volume. Because of the large data volume, a high one Memory requirements and a broadband transmission capacity of the connected  Communication facilities needed. Even using the most modern Information processing systems would be put into practical use here unacceptably long processing and response times arise.

Another disadvantage of the method described above is the need for permanent online availability of the central personal database. In practice this means that constantly complex, fail-safe and expensive Information processing systems must be available and operational, and that, for example, a policeman in a patrol car or in a local one Do not watch over the necessary testing options stand.

National legal restrictions are also critical in this context, e.g. B. the personal data protection that the machine-based Prohibit identification of persons, since there is a risk that the Data can be evaluated and motion profiles can be created from it.

The object of the invention is a method and an apparatus for Personalization and verification of security documents as well as a to provide a suitable security document, which allows the authenticity especially graphic personal data with relatively simple means to be able to be verified automatically. In practice, this means that a Authorization person such as B. determine a police or border control officer must be able to know whether z. B. the portrait of a submitted identity document belongs to this.

This task is characterized by the distinctive features of the independent Claims resolved.

The solution according to the invention essentially comprises the following features and advantages:

• - Verification is possible with relatively simple means,
• - the verification takes place offline, i. H. without connection to a central  Database instead,
• - The verification leads to the result that the graphic data of the Check submitted identity document are genuine, so belong to this and
• - the verification does not violate applicable legal provisions.

The visual comparison between the presentation of a person's face and the pictorial representation z. B. as a photographic photograph or in printed Form is the classic method of recognition per se. For this reason In the following the process solution is exemplified for the portrait as Identification method described. Of course, the explanations apply in an adapted form for other graphic personal data, such as B. Fingerprints. In another version there are also acoustic ones Comparative methods for identifying such as B. the human voice applicable.

When personalizing identity documents, portraits are becoming increasingly common with the help of digital printing processes in a central value and Security printing company established. This method has the advantage that the Production is carried out on data processing systems in which the portrait is in a computer-aided format (pixel data) and for one Further processing can be used efficiently. The volume of a portrait for use in identity documents is at an acceptable Reproduction quality about 70 to 100 kbytes. These numbers are a. dependent of the geometric dimensions, the color, the color depth and the Compression factor.

The solution goes beyond the idea of having this graphic data in the conventional printed and a second machine-readable form in the Submit identity document. So there is the possibility with a Identity check to compare both forms of portrait with each other and at successful comparison to confirm the authenticity of the document.  

In a preferred embodiment it is provided that the portrait data, i. H. the Store comparison data in an electronic memory chip. This chip is Part of the identity document. As an embodiment, chip cards according to ISO 7816 or contactless (transponder) cards. Further Possibilities to save the graphic data in a second form, offer Barcodes, especially 2D barcodes such as B. the PDF 417 from Symbol.

When using semiconductor memories, the writable memory area is of suitable chip cards with processor functionality currently typically 16 kByte for contact cards. The above Data amount of a portrait is around one Much larger than the available storage space. It is not at the moment possible, the pixel data of a portrait in uncompressed form in a chip card to file. Apart from that, the duration of reading such a Amount of data take an unacceptably long time.

The main disadvantage of uncompressed storage, however, is that the pure pixel data enable a simple counterfeiting attack, since an attacker could overwrite the chip of an identity document with counterfeit data. For this reason, the storage of the portrait data must meet the following conditions:

• - the memory size d. H. the degree of compression of the data must be in one optimal relationship between quality and feasibility
• - The graphic data must be saved in a genuine format be performed.

In order to meet the first condition, the graphic data. The ones present when the security document was produced Graphic data correspond to a pixel representation of the portrait. With the help of this Data stream, the personalization device is controlled to the image to print the document. In the case of an automatic inspection, the picture of be included in a verification device. For this, scanners can be used or use cameras with CCD technology (CCD: Charge Coupled Devices). However, the scanned image always delivers a different data stream than that for Personalization used. This is u. a. that the color values of the  Portraits can never be exactly reconstructed and that the original Pixel resolution is never precise enough due to the geometric tolerances can be hit.

For this reason, a method is used which is based on a biometric method for generating the data set. The background is that the comparison of two portraits does not depend on the pure pixel data, but that certain physical characteristics are decisive. This also corresponds to the way a police officer compares the portrait on the card with the face of a citizen. Features such as B .:

• - distance between eyes, nose, ears, mouth,
• - size relationships of the sensory organs,
• - Characteristics of the head shape and individual parts, etc.

These biometric features are obtained from the portrait data and lead to a variable individual data set. The more accurate the biometric Characteristics are evaluated, the more extensive the data set becomes.

Manufacturers of such systems specify a size of 1,000 to 2,000 bytes, with who can clearly characterize the portrait of a person. With that stands a data format or amount of data available that optimally Requirements for storage on a card chip are sufficient. The following Execution is this reference data set, which has the characteristic features of a portrait describes, called bio-record (Bio-ref).

In order to meet the second condition mentioned above, a To use a process that is based on an asymmetrical Cryptographic encryption guarantees that the bio data record is not tampered with. Asymmetric encryption methods are based on a key pair a private and a public key. The encryption is done with the private key and decryption with the public key carried out. The manufacturer of the identity documents has the certified private key of the asymmetric cryptographic process such as B. RSA. A essential requirement is that this private key is unauthorized  Never becomes known to third parties, otherwise the entire system will be vulnerable. Out for this reason, the private key must never be the crypto box of the Leave the production system of the security company. Even the generation this key takes place inside the crypto box. A key length of 1024 bit is currently considered unassailable.

The bio data set obtained from the pixel data in the production system is included encrypted the private key of the asymmetric cryptographic process. in the The result is an encrypted bio data set that is based on the Process inherence only generated by the crypto box of the security operation can be. This encrypted bio record is stored in the chip's memory of the identity document. The decryption of the record is possible with the help of the public key. This may be known be, because the asymmetrical cryptographic methods are characterized in that in contrast to the symmetrical process from the familiarity of a Key that does not allow the other to be derived.

The invention describes the use of an asymmetric cryptographic method such as e.g. B. RSA to encrypt and decrypt the biometric data set. This Methods are generally known. A standard description of the procedures can be found in "Applied Cryptography" by Bruce Schneier, ISBN 0471-11709-9.

The invention also relates to a test device which in the field Authenticity of an identity document, especially of graphical data.

For reasons of efficiency, a hash algorithm can be used when generating data sets (e.g. RIPEMD160) can be used, which from the present up to 2 kByte organic data set z. B. hash bit value of 160 bits. This offers the advantage that for storing the data on the Security document takes up very little space and the procedure verification of the identity document can be carried out more quickly in practice can.  

The invention is described below using an exemplary embodiment Reference to several drawing figures explained in more detail. Go out the drawings and the associated description further features and Advantages of the invention.

Fig. 1 shows a simple stylistic representation of a portrait with a few biometric features entered;

Fig. 2 schematically shows the process flow and the flow of data during the personalization and verification of a security document;

Fig. 3 shows a possible structure of a verification apparatus with introduced security document.

In Fig. 1 a portrait is illustrated in which some physical (biometric) features are entered:

• 1. A: ear distance
• 2. B: Eye relief
• 3. C: mouth width
• 4. D: Eye-mouth distance
• 5. E: nose-eye distance

Of course there are a variety of other features that are needed to generate the Bio data set can be used, e.g. B. shape of the chin area, Shape of the nose, scars, liver spots etc.

In biometrics (teaching about the measurement of living characteristics) are known various methods, the z. B. Recognize facial features, assign and measure. The result is a characteristic data set Available. The quality of the data set depends on the type of procedure and the quantity dependent on the data. These biometric methods are state of the art and their mode of operation will not be explained in more detail here.  

A portrait in CMYK color representation with passport size and a digital one 600 dpi resolution requires approximately 3.5 million bytes in uncompressed format. Common methods such as TIFF, JPEG, Wavelet or fractal compression allow the reduction of the above Amount of data. However, they are always suffers from loss of quality of the original data, which is a clear No longer allow recognizability for a verification system.

The biometric methods solve the problem because they are only the consider essential physical characteristics. Example: Should the eye relief determined in a range of 20 mm with an accuracy of 0.1 mm the result can be specified in just one byte. Under Taking z. B. a thousand such biometric features can be Portrait with an extremely low probability of error in just one kbyte Write storage space.

The biometric method is used in two places in the invention. At Personalization is done using the biometric method of bio-record (Bio-ref) generated, which is encrypted and in the chip memory of the ID document is filed. In the test device (verification device) is using the same biometric method from the scanned portrait a second bio data set (Bio-scan) generated. A comparison of both bio data sets shows that Verification result.

The data flow in the personalization and in the verification of the identity document is shown in FIG. 2.

When personalizing the ID document, file 1 with the pixel portrait data of a person is initially available. These data are subjected to a suitable biometric method 2 , which results in a bio dataset (Bio ref) which is greatly reduced in scope of data. This bio data record is encrypted using an asymmetrical encryption method 3 using a private key and stored in a memory chip 4 arranged on the ID document.

During verification, the ID document is inserted into a test device. The test device has an optical reading device by means of which the pictorial portrait is scanned on the ID document, so that a pixel portrait file 5 results, which is stored in a memory of the test device. This pixel file is subjected to the same biometric method 6 as was already used in the personalization of the document, resulting in a biometric data record 7 (bio-scan), which is also stored in the memory of the test device. The test device has a contact-based and / or contactless read-out device with which the Bio-ref data can be read from the memory chip of the ID document, decrypted and stored in the memory of the test device.

Both bio data sets, Bio-ref and Bio-scan, are now present in the test device and are now compared by means of a verification method 8 from a microcomputer in the test device. This comparison leads to a result 9 , which is displayed to the user optically and / or acoustically. If the two bio-data sets agree to a large extent, the authenticity of the ID document is proven. If they do not match sufficiently, a forged document can be assumed.

FIG. 3 shows an embodiment of the test device 10 with a housing 11 approximately the size of a video cassette. The test device 10 has a positioning unit on a narrow side, with the aid of which the identity document 13 can be brought into a defined position. This can e.g. B. be an insertion slot 12 or a support surface. The correct positioning can be recognized automatically by a sensor system that initiates the start of the test. However, the start can also be triggered manually by pressing a button. Geometrically compared to the graphic to be checked (here: Portrait 15 ) there is a recording unit, e.g. B. a scanner 16 or a camera. The microchip 14 , on which the bio reference data is stored, is electrically connected via a contacting unit 17 . In a special embodiment, the connection is made contactlessly via an electromagnetic antenna system. The test device 10 has a microcomputer 18 to which the scanner 16 and the chip contacting unit 17 are connected. The microcomputer 18 executes the digital test functions and outputs the calculated test result via a display unit (not shown).

The functions run as follows. After positioning the identity document 13 and the start triggering, the portrait 15 is recorded via the scanner 16 and converted into digital signals. The portrait 15 is thus available as a pixel file in a form similar to that used to personalize the identity document in security operation. This pixel file is stored in the memory of the microcomputer 18 . The processor generates a second bio data record (bio scan) from this pixel file using the same algorithm as for personalization, which is also stored in the memory of the microcomputer 18 .

In a further step, the processor reads the encrypted bio data record (bio ref) from the chip 14 of the identity document 13 and stores it in the memory of the microcomputer 18 of the test device 10 . Due to the initialization of the microcomputer 18, the public key of the cryptological system is available in this memory. With the help of this key, the first bio data set (bio ref) is decrypted from the chip 14 . Both bio data sets (Bio-ref and Bio-scan) are thus available in comparable form in the test device 10 and the verification can be carried out.

As already described, the two bio data sets cannot be absolutely identical due to the recording tolerances of the scanned portrait 15 . Similar methods of biometric verification deliver results with deviation rates in the subpromille range. Taking into account a threshold value from this range, these deviations are tolerated.

It should be noted that the deviation rates are significantly lower than for example when visually comparing a portrait with a living one Person z. B. by an inspection officer.  

The processor provides the verification result via an output unit on the surface of the test device 10 . In the simplest case, this can be a red / green lighting unit, but also the digital representation of the verification result, e.g. B. in percent of agreement of the data or an acoustic "OK" signal.

By a suitable selection of the mechanical and electronic components, in particular the microcomputer 18 , the testing process can be restricted to a few seconds. The structure of the test device 10 is designed so that it is suitable for mobile use. For these reasons, it has an energy supply from batteries or rechargeable batteries and / or a connection to a mains adapter or the 12-volt supply network of a car.

Drawing legend

1

file

2nd

Biometric method

3rd

Encryption

4th

Memory chip with Bio-ref data set

5

Pixel portrait data

6

Biometric method

7

Biometric data set (bio-scan)

8th

comparison

9

Result

10th

Tester

11

casing

12th

Slot

13

ID card

14

Microchip

15

portrait

16

scanner

17th

Contact unit

18th

Microcomputer

Claims (20)

1. Identity or security document, which has personal data, which is applied to and / or incorporated into the document in alphanumeric and / or graphic form, characterized in that the personal data ( 15 ) and / or data correlated with them in a second, machine-readable form is present on / in the document, and the data present in the second, machine-readable form are data generated by a biometric method. 2. Identity or security document according to claim 1, characterized characterized in that in the second, machine-readable form existing data is available in compressed form. 3. Identity or security document according to one of claims 1 or 2, characterized in that in the second, machine-readable form existing data is available in encrypted form. 4. Identity or security document according to one of claims 1 to 3, characterized in that it comprises a non-volatile electronic storage medium ( 14 ). 5. Identity and security document according to claim 4, characterized in that the data available in the second, machine-readable form are stored in the electronic storage medium ( 14 ). 6. Identity or security document according to claim 4 or 5, characterized characterized in that the storage medium connection contacts for reading and / or reading out the data stored thereon.   7. identity or security document according to one of claims 4 to 6, characterized in that the storage medium means for wireless Read in and / or read out the data stored thereon. 8. identity or security document according to one of claims 1 to 7, characterized in that in the second, machine-readable form existing data in the form of a barcode inserted on / in the document are. 9. procedure for personalizing an identity or security document, where the personal data in alphanumeric and / or graphic Form is applied to and / or incorporated into the document, characterized, that the personal data and / or data correlated with them in applied a second, machine-readable form to the document and / or introduced into it, and that in the second, machine-readable form of existing data using a biometric Process from which personal data are generated. 10. The method according to claim 9, characterized in that personal Data can be used in digitally processable form. 11. The method according to any one of claims 9 or 10, characterized in that the data available in the second, machine-readable form by means of be encrypted using an asymmetrical encryption method. 12. The method according to any one of claims 9 to 11, characterized in that compresses the data available in the second, machine-readable form become. 13. The method according to any one of claims 9 to 12, characterized in that the data available in the second, machine-readable form in an on / in  non-volatile electronic storage medium available in the document get saved. 14. The method according to any one of claims 9 to 13, characterized in that the data in the second, machine-readable form as a barcode stored in / on the document. 15. Device for verifying an identity or security document, characterized by:

• - A positioning means ( 12 ) for correctly positioning the identity and / or security document ( 13 );
• - a first scanning means ( 16 ) for capturing personal data ( 15 ) attached / attached to the identity or security document;
• - a second scanning means ( 17 ) for acquiring comparison data present on the identity or security document;
• - Means ( 18 ) for storing, processing and processing the acquired data and for outputting and displaying result data.
• - Means ( 18 ) for processing the personal data using a biometric method.

16. A method for verifying an identity or security document which has personal data which is applied to and / or incorporated in the document in alphanumeric and / or graphic form, characterized by the following steps:

• - Sampling / reading out the personal data and storing this data in digital form;
• - Reading out comparison data stored on the document;
• - comparing the personal data with the comparison data;
• - Output the result of the comparison.
• - Processing of personal data using a biometric process
• - Storage of the resulting biometric data

17. The method according to claim 16, characterized in that the biometric Data with biometric comparison data available on / in the document be compared. 18. The method according to any one of claims 16 or 17, characterized in that the personal data means of an optical image sensor be read from the document. 19. The method according to any one of claims 16 to 18, characterized in that data in a second, machine-readable form read the electronic storage medium available in the document become. 20. The method according to any one of claims 16 to 19, characterized in that the data available in the second, machine-readable form as a barcode present the document and by means of an optical image sensor be read out.