BE1023971B1 - METHOD FOR ELECTRONIC SIGNATURE OF A DOCUMENT - Google Patents

Abstract

Method of electronic signature, of a document of a recipient, by a signer having a mobile telephone terminal (1) chip and camera, by the Internet network (5) and a signature server and a store d applications (9), connected to the Internet network and having a signature application (7 ', 7' '), with a secure cryptography library. - The recipient sends the server (6) the document to be signed and the telephone number of the signatory, - the signer downloads the application (7 ', 7' ') on his terminal (1) and connects to it, - he displays on the terminal (1) the document to be signed accompanied by the telephone number, - we proceed to the authentication of the signatory, - we proceed to the creation of a certificate of signature and the electronic transformation of the document to be signed, - the signatory proceeded to the signature of the electronic document, before sending it to the server ( 6), for the attention of the addressee.

Description

Electronic signature process of a document

The present application relates to the electronic signature of documents, such as insurance contracts, but, more generally, all documents of a service provider or a product supplier.

It can also be an authentication document to access his bank account.

It is already known to electronically sign documents with a smart identity card, a suitable reader for receiving the card with its chip and a personal computer in which is installed a signature software. For this purpose, it is proceeded as briefly described below.

The document to be signed is accompanied by a certificate of characterization of the signatory and his signature. The certificate contains the surname, first name, date of birth of the signatory and an identification number. The signed document contains a quick reference QR code that represents an internet link to the signed document.

A signature software irreversibly transforms the PDF document to be signed into a string of characters (HASH) that the signatory must sign.

The signature is made using a Public Key Infrastructure (PKI).

The smart ID card contains this public key and a private key. The public key is associated with a PKI certificate issued by the PKI server, which is an electronic file that defines the owner of the public key.

The identity card of the signatory having been introduced in his reader, and the document to sign transformed into HASH, it is with the signature of the HASH that one proceeds. By the signature software, the personal identification number (PIN) is requested from the signer to access the private key stored and recorded in the chip. Then the HASH is encrypted by means of the private key and the signed HASH, which results, as well as the certificate are sent to the signing server which adjuncts them to the PDF document, together with the exact date and time. With the signature of the HASH, the recipient can, by means of the public key of the PKI certificate, verify the integrity of the document and the authenticity of the signer. Note that the pairing of both public and private keys is impossible, unless you have exorbitant means.

The electronic signature method of the prior art, as described above, is of high security. However, it has disadvantages.

It requires a compatible ID card reader, a computer, the installation of a signature software in the computer, the memorization of the PIN code of the chip of his identity card including, in addition, a number of 'identification. This is why the applicant has endeavored to propose an electronic signature process using only a smart telephone and smart phone mobile terminal, that is to say a "smart phone" or a tablet and , of course, a signature server and the Internet.

And this is how the invention relates to a method of electronically signing a document of a recipient, by a signatory having a smart telephone mobile terminal and to a camera, via the Internet and to the using a signature server and an application store, connected to the Internet and having a signature application, with a secure cryptography library, in which process - the recipient sends the server to the document to be signed and the number of the signer's phone, - the signer downloads the application on his terminal and connects to it, - he displays on the terminal the document to be signed accompanied by the telephone number - the signatory confirms his telephone number, - the server sends a service message (MS) to the terminal with a one-time code for the continuation of the application, code that the terminal returns to him for security, - the signatory, using his terminal, takes at least one picture of his identity document which is sent to the server via the Internet, - the terminal creates, from the secure library, a private key and a key public which is sent to the server, - the server creates the HASH of the document to be signed and a signature certificate and sends them to the terminal, - the terminal, as a signature, encrypts the HASH using the private key and a PIN code; and the terminal sends the encrypted HASH and the certificate to the server that recompose the signed document thus available to the recipient of the document.

Advantageously, after reception by the server of the photo of the signer's identity document, the server checks the authenticity of the signer's identity document, preferably by character recognition and image processing.

The steps of sending a service message (MS) and returning the code, taking the photo of the identity document and authentication of the signer's identity document constitute a global step of authentication of the signatory.

The preceding steps and those starting with the creation of the private and public keys constitute a global step of creation of the signature certificate, before the global signature step.

The method of the invention can therefore be extended to an electronic signature method, a document of a recipient, by a signer having a smart telephone mobile terminal and to a camera, via the Internet and to using a signature server and an application store, connected to the Internet network and having a signature application, with a secure cryptography library, in which process the recipient sends the document to be signed to the server and the telephone number of the signatory, - the signer downloads the application on his terminal and connects to it, - he displays on the terminal the document to be signed accompanied by the telephone number, - the signatory is authenticated , then - it is proceeded to the creation of a certificate of signature and to the electronic transformation of the document to be signed, - the signer proceeds the signature of the electronic document before sending it to the server where it is available to the recipient of the document.

As previously, advantageously, the authentication of the signer includes the steps according to which - the signer confirms his telephone number, - the server sends a service message (MS) to the terminal with a single-use code for the continuation of the application , code that the terminal returns to him for security, - the signer, using his terminal, takes at least one photo of his identity document which is sent to the server by the Internet, - after reception by the server of the photo of the signatory's identity document, the server checks the authenticity of the signatory's identity document.

Similarly, and preferably, the signature of the document comprises the steps according to which - the terminal creates, from the secure library, a private key and a public key that is sent to the server, - the server creates the HASH document to sign and the signature certificate and sends them to the terminal, - the terminal, as a signature, encrypts the HASH using the private key and a PIN code and - the terminal sends the encrypted HASH and certificate to server that recompose the signed document thus available to the recipient of the document. The invention will be better understood with the aid of the following description, with reference to the appended drawing, in which: FIG. 1 is a general diagram of the system by means of which the method of the invention is implemented; FIG. 2 is a block diagram of the steps of the method of the invention; - Figure S is a block diagram of the signatory authentication step; FIG. 4 is a block diagram of the certificate creation step; Figure 5 is a copy of a signature certificate; and Figure 6 is a copy of the electronically signed document.

The method that will now be described aims to have a signatory equipped with a mobile telephone terminal 1, here smart phone type, and who has a camera 2 and a chip 3, a document proposed by a recipient, here a insurance broker, intended to receive the signed document and which has a terminal 4, the two terminals 1 and 4 can be connected to the Internet network 5 as well as to a signature server 6 and an application store 9, so that also be connected to the Internet 5.

A signature application is implemented in a first part 7 'in the server 6 and in a second part 7' in the application store 9. The part 7 'is the "server" application, the part 7 ", the mobile application A secure cryptography library 8 is located in the store 9, preferably, as here, in the mobile application 7 ".

The recipient, begins, through its terminal 4, to send, via the Internet 5, to the server 6 the document to be signed by the owner of the terminal 1, that is to say the signatory. With the document to be signed, is also sent the phone number of the signer who knows the recipient. The signer downloads, in his terminal 1, the signature application 7 'of the server 6 and the signature application 7 "of the store 9 and connects to this application, here through a user code and a password.

Then appear on the screen of the terminal 1 of the signer, here insurance data and a request for signature of the document. With a click, the signer displays the document to be signed and the phone number provided by the recipient, which he can view.

The signatory then clicks on the icon "to sign", then, by another click, must accept the general conditions of the use of the signature application.

Then, by a new click on the icon "to begin", will proceed the steps leading to the signature (figure 2).

Four main general steps follow one another that are a signatory authentication step 10, a step 11 of creating the signature certificate, a step 12 of electronic transformation of the document to be signed and the actual signing step 1 3.

Signatory authentication step (Figure 3)

After viewing on the screen of its terminal 1, its telephone number as noted by the recipient, the signatory proceeds to the confirmation 101 of this number.

Then the recipient sends him (102) directly via the Internet 5 a service message (MS), here an SMS, with a single-use code for the continuation of the application, code that the terminal 1 sends back to the recipient for security for once again confirm that his phone number is the right one.

After that, the recipient proceeds to take a picture 103 and takes pictures of the front and back of his identity card, if it is this piece of identification. Note that other pieces of identity are possible such as a passport.

The shooting conditions are inevitably random, as to the orientation of the map, the ambient light and the disturbing reflections. For subsequent control this should be taken into consideration.

It should also be noted that identity documents, to avoid counterfeits, have many visual elements that create noise that disrupts the recognition of their data. In addition, there may be several types of identity documents in each country, with different zone compositions, which must also be taken into account in their recognition.

Terminal 1 sends the photos to the server 6.

The control 104 of the authenticity of the identity card of the signer is carried out as follows, by character recognition and image processing. The data areas are recognized with precision, by a pre-cut that remains difficult given the freedom of the shooting by the signatory, with a background, orientation and lighting that can leave something to be desired. In any case, arbitration and corrections are necessary.

More precisely, the image is decomposed, the detection of the orientation, the detection of the elements and the determination of the zones. Decomposition of the image

It is performed by decomposing the three channels "hue," saturation "and" value "(Hue, Saturation, Value, HSV). The saturation channel makes it possible to detect the chip of the identity card. The value channel is used to detect the orientation, the face, the machine readable zone (readable zone, MRZ) and, if it exists, the barcode. Orientation detection

Points are detected that may be on an object outline in the image. These points are connected to form candidate lines representing the real edges of all the photographed objects of the image. To straighten the image, we extract from the set D candidate lines dj, a set of orientation angles EE = {tan-1 (mdi), tan-Umdij + nldieD} where mdi is the calculated orientation of the line d, relative to the horizontal. All orientations are sorted according to the number of occurrences. The most present orientation E, is retained and all orientations whose difference with E, in the implementation here performed, less than 3 degrees are rejected. If an element of the line of orientation E can not be detected, we deduce that the orientation is bad and we start again by rejecting the orientation E, and by selecting the Detection of the elements of the map

With a determined orientation, depending on the element to be detected, the image can undergo an "advanced morphological transformation" that highlights the element. An iteration loop on one of the threshold parameters makes it possible to cover some photographs of more extreme contrasts. As soon as the element is detected, we leave the iteration. Determination of zones

For an identity card from Belgium, the table of contents is as follows:

T are text areas, F, areas to be blurred. One may wish to proceed to an adjustment step by comparing names determined by character recognition of the front and back faces, which are therein in two different formats. It will be noted that the applicant, for these control steps, made use of the "Open Computer Vision" library via Emgu Computer Vision.

The purpose of this check is to ensure, with a sufficient degree of certainty, that the person using the signing application is who they claim to be. We make sure that the photographed part is probably a true identity document, that the front face of the part corresponds to its back side, that the part is not outdated and that the holder is major.

After the authentication step 10, here we proceed to a cleaning step 14 which aims to expunge from the certificate that will be created data relating to the privacy of the signatory, such as the national registry number.

Certificate creation step (Figure 4)

Based on the data captured to identify the signer, the entire terminal 1 of the signer and the server 6 will create data for certification of the signature.

This data includes the signer's first and last names, date of birth, email address, "reduced" phone number, and the unique serial number of his / her certificate. From the secure library 8 of the application (7 "), the terminal 1 creates (111) a private key and a cryptographic public key stored in the mobile application 7". This library can be provided by Whitecryption-Approval NIST FIPS 140-2Level 1 (http: //csrc.nist.qov/qroups/STM/cmvp/documents/l 40-1 / 1 40sp / l 40sp 2284.pdf ). The terminal 1 sends (112) the public key to the server 6 to link the data of the signer to the public key, sealed by a signature of a certification authority. The server creates (11 B) then the certificate (FIG. 5) that it sends (11 4) to the terminal 1.

In parallel with the creation of the certificate, the server 6, in which was entered the document to be signed in PDF format, electronically transforms (12) this document into a string of characters (HASH) and it is it that the signatory must sign. The server 6 sends it to the terminal 1.

Signature stage (Figure 2)

The terminal encrypts the HASH using the private key and a PIN code that occurs at this time of the process. This PIN code has been chosen by the signer (numeric or alphanumeric) for the purpose of signing and to allow access to the private key.

Then the terminal sends the HASH and certificate to the server that recomposes the signed document (Figure 6) before making it available to the signer. He could also send it to the recipient.

It will be understood that this electronic signature method that has just been described is to be implemented by a signer of a document of a recipient when the signatory wants to make this signature for the first time with a terminal with which he had never made such an electronic signature. In other words, it is a first signature with a new empty terminal of the signature application.

To subsequently proceed to a new electronic signature with the same terminal which has thus, as it were, been initialized, it suffices to carry out only a part of the steps: the recipient sends to the server the document to be signed and the telephone number of the signatory, - the signatory connects to the application (7 ', 7 "), - it makes appear on the terminal (1) the document to be signed, - the server (6) creates the HASH document to sign and send it to the terminal (1), - the terminal (1), by way of signature, encrypts the HASH using the private key and the PIN code previously chosen by the signatory and - the terminal (1) sends the encrypted HASH and the certificate to the server (6) which recompose the signed document thus available to the recipient of the document. The signature application has been uploaded to the terminal, the server already has the photo of the signer's ID, the private and public keys have already been created and sent to the server, and the signing certificate has already been created .

Claims (5)

1. A method of electronically signing a document of a recipient, by a signer having a mobile telephone terminal (1) chip and camera, via the Internet network (5) and with the aid of a signature server (6) and an application store (9), connected to the Internet and having a signature application (7), with a secure cryptography library (8), in which the recipient sends to the server (6) the document to be signed and the telephone number of the signatory, the signatory downloads the application (7 ', 7 ") on its terminal (1) and connects to it, it appears on the terminal (1) the document to be signed accompanied by the telephone number, -the signatory confirms his telephone number, -the server (6) sends a service message (MS) to the terminal (1) with a single-use code for the continuation of the application, code that the terminal (1) returns to it by s security, the signatory, using his terminal (1), takes at least one photo of his identity document which is sent to the server (6) by the Internet (5), -the terminal (1) creates, from the secure library (8), a private key and a public key that is sent to the server (6), -the server (6) creates the HASH of the document to be signed and a signature certificate and sends them to the terminal (1), -the terminal (1), by way of signature, encrypts the HASH using the private key and a PIN code and -the terminal (1) sends the encrypted HASH and the certificate to the server (6) which recomposes the signed document thus available for the recipient of the document. 2. Method according to claim 1, wherein after reception by the server (6) of the photo of the signer's identity document, the server (6) checks the authenticity of the signer's identity document. B. Method of electronic signature, of a document of a recipient, by a signer having a mobile telephone terminal (1) chip and camera, via the Internet network (5) and using a signature server and an application store (9), connected to the Internet network and having a signature application (7 ', 7 "), with a secure cryptography library (8), in which process - the recipient sends to the server (6) the document to be signed and the telephone number of the signer, - the signer downloads the application (7 ', 7 ") on his terminal (1) and connects to it, - he makes appear on the terminal (1) the document to be signed accompanied by the telephone number, - the authentication of the signatory is carried out, then - the creation of a signature certificate and the electronic transformation of the document to be signed, -the signatory proceeds to the signing the electronic document, before sending it to the server (6) where it is available to the recipient of the document. 4. Method according to claim 3, wherein the authentication of the signer comprises the steps according to which - the signer confirms his telephone number, - the server (6) sends a service message (MS) to the terminal (1) with a single-use code for the continuation of the application, code that the terminal (1) returns to him for security, -the signatory, using his terminal (1), takes at least one photo of his identity document which is sent to the server (6) via the Internet (5), after the server (6) receives the photo of the signer's identity document, the server (6) checks the authenticity of the document identity of the signatory. 5. Method according to one of claims 3 and 4, wherein the signature of the document comprises the steps according to which - the terminal (1) creates, from the secure library (8), a private key and a public key that is sent to the server (6), - the server (6) creates the HASH of the document to be signed and the signature certificate and sends them to the terminal (1), - the terminal (1), as a signature, encrypts the HASH using the private key and a PIN and the terminal (1) sends the encrypted HASH and the certificate to the server (6) which recompose the signed document thus available to the recipient of the document.