ES2559851B1 - Method and system for obtaining sensitive information via mobile device - Google Patents

Abstract

Method of obtaining sensitive information by mobile device, comprising: # - capturing (302), using a camera of a mobile device (12), a two-dimensional code (9) containing unencrypted public information (104) and encrypted sensitive information (108) by means of a symmetric key, where said data is arranged according to a certain internal structure; # - obtain the binary information (304) of the two-dimensional code (9); # - obtain, from said binary information (304) and knowing the internal structure of the data, the public information (104) of the two-dimensional code (9); and # - perform a symmetric decryption (308) of the part of the binary information (304) corresponding to the encrypted sensitive information (108), obtaining the sensitive information (106). # The invention also relates to a program product to execute the above method, a mobile device for obtaining sensitive information and a method of generating two-dimensional code with sensitive information for reading by mobile device.

Description

Field of the Invention The present invention falls within the field of sensitive data protection systems and the concealment of information only available to authorized readers.

BACKGROUND OF THE INVENTION At present, mobile devices equipped with a camera are of general use and allow the realization of high added value services in most cases based on the data connectivity of said devices. On the other hand, two-dimensional codes are used in multiple supports for the realization of the encoding / decoding of information related mainly to web page addresses or contact data as a business card. Thus, two-dimensional image codes offer the possibility of obtaining digital information by using the cameras of mobile devices to subsequently access a remote system (information from a link to a web page) or store decoded data in a data base. local data (updating the contact information of the mobile device). However, in no case is control over who can obtain this data and there is no protection in case of sensitive data.

In emergency situations there are actions and decisions that depend on the information available by the manager of the situation at that time. Access to important information protected by the data law can be in many cases of vital importance. In these cases, the owner of the data cannot provide such data for several reasons: not being present, not being of age, not being aware, not speaking the language, difficulty remembering / providing such information.

The present invention proposes to use mobile devices equipped with a camera for use in emergency or insecurity situations to help identify or improve the performance of professionals in such situations through the treatment of two-dimensional codes that contain protected information. .

Description of the invention The invention relates to an encoding platform, a management platform for sensitive data readers protected in two-dimensional codes and a method for protecting sensitive data in two-dimensional images. The present invention is an important aid in emergency situations in which it is not possible to contact, the source that owns the information is not available or there is simply no data coverage for the query of information stored on servers, allowing to obtain and dispose of the Sensitive information for decision making in such emergency situations.

In the present invention, a platform for the encoding of sensitive data incorporated by means of encryption in a two-dimensional code and its application for the visualization of data susceptible to protection and privacy is claimed. In the present invention, the owner of the sensitive data is provided with a two-dimensional code, the information contained in said two-dimensional code being possible to include both unencrypted and encrypted data. The encrypted data includes the set of sensitive data that the owner protects for use by authorized readers and only in case of extreme need or consultation by authorized agencies. In an emergency situation, a two-dimensional code image can be obtained with a mobile device equipped with a camera. From this image, the unencrypted data is obtained and if it is an authorized mobile device, the sensitive data that the owner has considered to protect is also obtained by applying a decryption process.

The reader management platform contemplates the authorization of reading applications and authorized users to read protected data by means of an activation system comprising a server that acts as a verification agent for authorized users, an application that makes the activation request for proceed to read protected data in two-dimensional codes and an asymmetric encryption mechanism that allows the updating of data from reading applications allowing the activation process, indicating expiration date of the authorization and exchange of statistics of readings made , thus improving the management of authorized readers. The asymmetric encryption mechanism allows the update of the symmetric keys between the platform and the authorized reading applications allowing to increase the security of the whole set by varying the data coding keys.

A first aspect of the present invention relates to a method of obtaining sensitive information by mobile device. The method comprises at least the following stages:

-

Capture, using a camera of a mobile device, a two-dimensional code that contains unencrypted public information and sensitive information encrypted by means of a symmetric key, where said data is arranged according to a specific internal structure.

-

Obtain the binary information of the two-dimensional code.

-

Obtain, from said binary information and knowing the internal structure of the data, the public information of the two-dimensional code.

-

Perform a symmetric decryption of the part of the binary information that corresponds to the encrypted sensitive information, obtaining the sensitive information.

The method can also comprise the step of displaying on the mobile device screen the public information and the sensitive information obtained.

A second aspect of the present invention relates to a mobile device for obtaining sensitive information, which comprises a camera and a two-dimensional code reader application installed in the mobile device. The two-dimensional code reader application is configured to:

-

Capture, using the camera of the mobile device, a two-dimensional code that contains unencrypted public information and sensitive information encrypted by means of a symmetric key, where said data is arranged according to a specific internal structure.

-

Obtain the binary information of the two-dimensional code.

-

Obtain, from said binary information and knowing the internal structure of the data, the public information of the two-dimensional code.

-

Perform a symmetric decryption of the part of the binary information that corresponds to the encrypted sensitive information, obtaining the sensitive information.

The two-dimensional code reader application can also be configured to display on the mobile device screen the public information and the sensitive information obtained.

In a preferred embodiment, the two-dimensional code reader application has been previously activated by exchanging data with asymmetric encryption with a management platform, from which the application receives the symmetric key for reading the two-dimensional code, the internal structure of the data and the expiration date of the activation.

A third aspect of the present invention relates to a program product comprising means of program instructions for carrying out the method defined above when the program is executed on a mobile device. The program product is preferably stored in a program support medium, such as a flash drive, a CO, an OVO or a hard disk.

A fourth aspect of the present invention relates to a two-dimensional code generation method with sensitive information for reading by mobile device, comprising the following steps:

-

Receive a data processing unit a series of data broken down into public information and sensitive information that you want to protect. - Encrypt sensitive information using a symmetric key, obtaining encrypted sensitive information. -Generate a two-dimensional code containing unencrypted public information and encrypted sensitive information.

The data is preferably entered by a user in a web form and is received by a web server, which sends the generated two-dimensional code to the user.

BRIEF DESCRIPTION OF THE DRAWINGS A series of drawings that help to better understand the invention and that expressly relate to an embodiment of said invention that is presented as a non-limiting example thereof is described very briefly below.

Figure 1 shows a block diagram of the two-dimensional code generating platform.

Figure 2 shows a block diagram of the management platform of the readers authorized to read the two-dimensional code.

Figure 4 shows the functional scheme of the activation process of the reader application installed in authorized readers.

Figure 5 shows the scheme of the process of reading the protected information by authorized and previously activated readers.

DETAILED DESCRIPTION OF THE INVENTION The present invention relates to a platform that allows the encryption of sensitive data by means of two-dimensional codes and their subsequent reading and use. Sensitive data may be of a different nature, for example medical data.

Figure 1 represents a functional scheme of the two-dimensional code generating platform. A user 1 (for example, a tourist about to travel to a region of his country or another country) enters a web form, using an electronic device 2 (a computer, a PDA, a smartphone, etc.) a series of data 3 that are sent via the Internet 4 to a web service / API 5 managed by a web server 6. The data 3 is broken down into public or general data and private or confidential data (such as information user's medical) that user 1 wants to protect.

The generating platform or web server 6 is responsible for generating a two-dimensional code (in particular, a QR code) that contains unencrypted information (public data) and encrypted information (private, confidential data). Public and private data are arranged either consecutively or mixed, according to a specific structure that does not follow any pattern that allows indicating where public data begins and where private data begins, in order not to establish guidelines that allow Obtaining information for the breakage of the encryption protection of private data. The generated two-dimensional code 9 is sent to the user, either digitally 7 by the web server 6 itself to the electronic device 2 for the user 1 to print, or by a physical delivery 8 whereby the user receives physical support 10 (eg a card or carnel) with the two-dimensional code 9 printed on it. The generating platform does not store any information that the user has submitted to create the two-dimensional code, which once generated and sent back to the user is also not stored on the server.

Figure 2 represents a scheme of the reader management platform authorized to read the two-dimensional code 9 previously created by the generating platform. The users 11 of this management platform would be for example the members of the different emergency services (doctors, police, etc.), who use a mobile device 12 (for example, a smartphone or an electronic tablet) with a camera and a two-dimensional code reading application, through which the user 11 can read the information contained in the two-dimensional code 9 that is printed on the physical support 1 Q. For this the user 11 focuses 13 the camera of the mobile device 12 to the two-dimensional code 9, takes a photo of it and the reading application installed on the mobile device 12 will be able to obtain the encrypted data of the code without the need for data connectivity. For access to sensitive information and the correct treatment of the data read by the reading application, the ordering and internal structure of public and private data within the two-dimensional code is known by the reading application itself. The application activation process provides, through encrypted communication, the necessary information of both the internal structure of the sensitive information, as well as the keys for its reading, as well as the validity date of the activation. Therefore, the application activation process must be carried out prior to the capture of two-dimensional codes through the use of some data connection mechanism with the reader management platform (Wi-Fi, 3G).

At this point it is necessary to remember that the two-dimensional code integrates two levels of data: open data and encrypted data. The selection of the level of protection of the data entered by the user in the generating platform is carried out by the same user in the generation process. Open data will be accessible through a general two-dimensional image reader application with text output. In this case the reader user can identify the open text that will be consistent characters, from the encrypted text that will appear as a random sequence of nonsense characters. The encrypted data will only be accessible through the specific reading application prior to the activation or authorization process.

The activation process of specific reading applications is based on the authorization by the management platform of each official agency involved in emergency tasks (security agents, health, firefighters, etc.). Each official body The activation process will consist of an exchange of data 17 between a reader management platform 20, managed by a server 16, and the reading applications of mobile devices 12. This data exchange is carried out by means of data communication with encryption asymmetric The registration of the reading application and its unlocking to carry out the process of obtaining encrypted data is carried out as follows:

one.

The specific reading application is installed on the agent's mobile device 12.

2.

The specific reading application asks for agent identification code. This code must be provided by the official agency to which the agent is attached.

3.

The specific reading application communicates said code to the management platform 20 that once the identification has been validated without duplication the data exchange 17 will be carried out to proceed with the unlocking and updating of the application. This exchange updates both the symmetric reading key and the maximum date of the authorization, as well as information regarding the data format.

Once the application is activated, the information contained in the two-dimensional code 9, both the public data and the duly decrypted confidential data, is shown on the screen of the mobile device 12. In this way, if the person possessing the physical support 10 with the two-dimensional code 9 printed had for example an accident, the emergency services would be able to read the encrypted information (relevant medical data including blood group, medications or active ingredients to which you are allergic, etc.) using a mobile device 12 reader in order to assist you quickly. An important part of the present invention is that the QR code contains both types of information, public and encrypted (data connection is not required for access to information), and that the latter can only be viewed by users ( eg doctors, police) previously authorized.

Figure 3 represents a schematic of the process of generating 100 the two-dimensional image with protected information. In a first step 102, the owner of the sensitive information is connected to the two-dimensional code generating platform. As previously indicated in the description of Figure 1, in a particular embodiment the user 1 fills in a web form with public information 104 (non-sensitive information) and with sensitive information 106 (private information). The sensitive information 106 is then encrypted by means of symmetric encryption with a key that will be established for all users and that must be related to the key of the reading application, obtaining sensitive information encrypted 108. Subsequently, the two-dimensional code 110 is generated without storing the sensitive data in the generating platform. The owner finally receives 112 the generated two-dimensional code, either in digital format for printing or in already printed format.

Figure 4 shows a diagram of the activation process 200 of the two-dimensional code reading application (reading app) installed in the mobile device 12. The managing platform 20 of the reading app is managed by different authorized agencies. An authorized agent is responsible for accessing the management platform 20, downloading and installing 202 the specific reading app on the mobile device 12 to proceed with its activation or unlocking along with the authorized agent identifier. The activation 204 of the reading application is then carried out. For this, the reading app asks for the identifier for its activation. The reading app then communicates with the managing platform 20 and receives a reading key and an activation expiration date. The reading application is active 206 until the expiration date. The reading app is activated to decrypt the encrypted information contained in the two-dimensional code 9.

Figure 5 shows an outline of the process of reading 300 of the protected information in the two-dimensional code 9. The mobile device 12 that has a duly authorized activated app installed, takes a photo 302 of the two-dimensional code 9. Next, the information is obtained 304 binary of the two-dimensional code 9, from which the reading application obtains the non-sensitive public information 106 and performs a symmetric decryption 308, using the received reading key, of the encrypted information included in the two-dimensional code 9, obtaining the sensitive information 106 The public information 104 obtained can be read 312 by any two-dimensional code reader, as it is not encrypted. However, the sensitive information 106 obtained is only accessible by the specific reading application as long as it is unlocked by identifying the authorized agent. Both the sensitive information 106 and the public information 104 are shown 314 on the screen of the mobile device 12 and the authorized agent then accesses said information.

Claims (8)

1. Method of obtaining sensitive information by mobile device, characterized in that it comprises:

-

generate a two-dimensional code (9) that contains unencrypted public information (104) and encrypted sensitive information (108) by means of a symmetric key, where said data is arranged according to a certain internal structure;

-

activate (206) a two-dimensional code reader application installed on a mobile device (12) by exchanging data (17) with asymmetric encryption with a management platform (20), from which the reading application receives the symmetric reading key of the two-dimensional code (9) and its internal data structure;

-

capture (302), using a camera of the mobile device (12), the previously generated two-dimensional code (9);

-

obtain the binary information (304) of the two-dimensional code (9);

-

obtain, from said binary information (304) and knowing the structure

internal data, public information (104) of the two-dimensional code (9); and - perform a symmetric decryption (308) of the part of the binary information (304) that corresponds to the encrypted sensitive information (108), setting the sensitive information (106).

2.

Method according to claim 1, characterized in that it comprises displaying (314) on the screen of the mobile device (12) the public information (104) and the sensitive information (106) obtained.

3.

Method according to any of the preceding claims, characterized in that the generation of the two-dimensional code (9) comprises: - receiving a data processing unit a series of data (3) broken down into public information (104) and sensitive information (106) that you want to protect; -encrypt sensitive information (106) using the symmetric key, obtaining encrypted sensitive information (108); Y

-

generate (110) the two-dimensional code that contains the unencrypted public information (104) and the encrypted sensitive information (108).

4. Method according to claim 3, characterized in that the data (3) is entered (102) by a user (1) in a web form and are received by a generating platform (6), which sends the generated two-dimensional code to the user (1). 5. System for obtaining sensitive information through a mobile device, characterized in that it comprises: a generating platform (6) configured to generate a two-dimensional code (9) containing unencrypted public information (104) and encrypted sensitive information (108) by means of a symmetric key, where said data is arranged according to a certain internal structure; a management platform (20) configured to activate (206) a two-dimensional code reader application installed in a mobile device (12) by data exchange (17) with asymmetric encryption with the mobile device (12), from which the Reader application receives the symmetric key for reading the two-dimensional code (9) and its internal data structure; Y a mobile device (12) with a camera and the two-dimensional code reader application installed in the mobile device (12), where the two-dimensional code reader application is configured to:

-

capture (302), using the mobile device camera (12), the code

two-dimensional (9) previously generated by the generating platform (6);

-

obtain the binary information (304) of the two-dimensional code (9);

-

obtain, from said binary information (304) And knowing the

internal data structure, public information (104) of the two-dimensional code (9); Y

-

perform a symmetric decryption (308) of the part of the binary information (304) that corresponds to the encrypted sensitive information (108), obtaining the sensitive information (106).

6.

System according to claim 5, characterized in that the two-dimensional code reader application is configured to display (314) on the screen of the mobile device (12) the public information (104) and the sensitive information (106) obtained.

7.

System according to any of claims 5 to 6, characterized in that the exchange of data (17) between the management platform (20) and the two-dimensional code reading application includes the expiration date of the activation.

8.

System according to any of claims 5 to 7, characterized in that the generating platform (6) is a web server.