EP4315115A1

EP4315115A1 - Method for checking individuals with simplified authentication

Info

Publication number: EP4315115A1
Application number: EP22715144.6A
Authority: EP
Inventors: Laurent Mercier; Pascal DUVILLE; Joost VAN PROOIJEN; Joel VIELLEPEAU
Original assignee: Idemia Identity and Security France SAS
Current assignee: Idemia Identity and Security France SAS
Priority date: 2021-03-24
Filing date: 2022-03-22
Publication date: 2024-02-07
Also published as: FR3121241B1; CA3205344A1; AU2022244306A1; FR3121241A1; WO2022200730A1; US20240070247A1; ZA202308124B; AU2022244306A9; KR20230158466A; JP2024510783A

Abstract

The invention relates to a method for checking an individual having an identity document on a support comprising an electronic chip in which is stored a reference biometric datum of the individual and able to display an automatic read region representing an optical read datum of the identify document, the method comprising the implementation, by a checking device (30), of steps of: (a) acquiring a candidate biometric datum regarding a biometric characteristic of the individual; (b) based on the candidate biometric datum, retrieving, from a memory (20), an optical read datum associated with the reference biometric datum corresponding to the biometric characteristic of the individual; (c) opening a secure communication channel with the electronic chip of the support for the individual's identity document using said optical read datum that has been retrieved.

Description

INDIVIDUAL CHECK PROCESS WITH SIMPLIFIED AUTHENTICATION

FIELD OF THE INVENTION

The invention relates to a method for checking an individual having an identity document on a medium comprising an electronic chip in which is stored biometric reference data of the individual and able to display an automatic reading zone representing optical reading data of the identity document. The invention applies in particular to the control of individuals for access to a protected area or service such as access to boarding an aircraft.

STATE OF THE ART

An identity check is sometimes required when an individual accesses a protected area or service, such as when crossing a border or when boarding a plane.

Electronic identity documents such as passports or electronic identity cards make it possible to implement an identity check by biometric authentication, that is to say by comparing a biometric datum acquired with a biometric trait of the individual to biometric data prerecorded in a chip contained in the identity document.

Such documents allow increased security because the biometric data which is contained in the document can be protected and signed by an official entity that issued the document, which can be verified during the check.

They also make it possible to automate the identity checks carried out, by means of dedicated control devices, by letting individuals handle their passports themselves in order to submit them to a control device for reading.

However, the physical handling of identity documents, and in particular documents in the form of a booklet such as passports, can pose difficulties for the individual wishing to identify himself.

Indeed, the biometric data contained in the identity documents are read-protected. It is necessary to access it to obtain the number of the identity document, which appears on a machine-readable zone, also called MRZ (for the acronym of English Machine-Readable Zone). Such a machine-readable zone is a part of the surface of the document (or, where applicable, of one of its pages) containing text printed in a standardized format, so capable of being read by a computer and deciphered by optical recognition of printed characters.

Therefore, in order to perform authentication, the individual must present the document to the particular page on which the machine-readable zone is located, in a specific direction allowing a reader of the controlling device to read it. Once the number has been acquired, it can be used to access the contents of the chip.

Therefore, failing to present the identity document correctly, the authentication of the individual may fail.

This physical manipulation step is time-consuming and tends to clog up queues, for example at airports. It is also the cause of a substantial proportion of failures to authenticate individuals.

It is therefore necessary, in order to ease the queues at the crossing points, to limit as much as possible the handling of these documents to authenticate an individual during a check.

A solution to this problem has already been proposed. It provides for splitting the individual control stage in two, in a first stage during which manipulation of the identity document is necessary, and a second stage during which authentication takes place, without manipulation of the document. of identity.

More specifically, during a first step, an individual manipulates his passport to position it correctly on a reader of a control device, which reads the automatic reading zone of the passport, and accesses the biometric data, in this case an image of the individual's face, contained in the passport.

A number is associated with this biometric data, and a ticket bearing this number is issued to the individual. The data as well as the number are saved in a database.

In the second step, the individual presents the ticket to a second control device. This device reads the number written on the ticket and accesses the database to retrieve the corresponding biometric data.

At the same time, a photograph of the individual is taken by the control device, and this photograph is compared to the biometric data retrieved from the database (and which corresponds to that stored in the passport) to carry out the biometric authentication of the individual. This solution therefore makes it possible to move the time-consuming step of handling the passport upstream of the authentication step which allows access to the secure area, and to unclog the queue for this step.

However, this solution does not completely solve the problem, because the ticket issued to the individual represents an additional document to keep, which can be lost or exchanged. In addition, it is still necessary to handle this ticket during the second step, which can still take time and cause errors.

More recently, an optimization of the process has been proposed in document EP3249569. For this, during each step, a photograph of the individual is taken, so that during the second step, the identity document number corresponding to the biometric trait of the individual is retrieved from the database.

This eliminates the manipulation of the identity document or even of an additional document (ticket) during the second stage including the biometric authentication of the individual, which simplifies and accelerates the crossing of this stage.

This solution is entirely satisfactory, but it would be desirable to lighten it further, while maintaining total security.

PRESENTATION OF THE INVENTION

The aim of the invention is to remedy the problem described above. In particular, one of the aims of the invention is to propose an automatic control method minimizing the manipulation of documents by the individual.

Another object of the invention is to reduce the time necessary for the implementation of the authentication step.

Another object of the invention is to propose a control method which is simple and practical to implement for individuals.

In this respect, the subject of the invention is a method for checking an individual who has an identity document on a medium comprising an electronic chip in which is stored biometric reference data of the individual and capable of displaying a machine read area representing read data of the identity document, the method comprising the implementation by a control device of steps of:

(a) acquisition of candidate biometric data on a biometric trait of the individual;

(b) from the candidate biometric data, retrieval, in a memory, of optical reading data associated with the reference biometric data corresponding to the biometric trait of the individual;

(c) opening a secure communication channel with the electronic chip of the holder of the identity document of the individual by using said retrieved optical reading data.

According to advantageous and non-limiting characteristics:

Step (c) does not include either the retrieval of the individual's reference biometric data from said electronic chip via said secure communication channel or the reading of said machine-readable zone of the identity document medium.

Step (c) comprises the implementation of an authentication of said electronic chip via said secure communication channel.

Said electronic chip stores a pair of a private key and a public key, said authentication of said electronic chip being chosen from active authentication and hardware authentication.

Said authentication of said electronic chip is an active authentication comprising the verification using said public key of an electronic signature received from the electronic chip in response to the sending of a nonce.

No data other than the data necessary for said authentication of the electronic chip is transmitted via said secure communication channel.

Said secure channel is opened in accordance with a protocol selected from Basic Access Control, BAC, and Password Authenticated Connection Establishment, PACE, using a key derived from said retrieved optical reading data.

Step (b) comprises: a comparison of the reference biometric data stored in the memory with the candidate biometric data, and the selection of at least one identity document optical reading datum corresponding to at least one reference biometric datum having a rate of similarity with the candidate biometric datum greater than a predetermined threshold.

If more than one identity document optical reading data has been selected, step (c) is attempted for each selected optical reading data until the secure communication channel is opened.

The control device comprises contactless communication means, step (c) being implemented by approaching said support to the control device in any orientation.

The method comprises a prior step (aO) implemented by an enrollment device, for retrieving the reference biometric data of the individual from said electronic chip; acquisition of the optical reading data of the identity document by reading the machine-readable zone; and recording, in said remote memory (20), the optical reading data of the identity document in connection with the reference biometric data of the individual. The identity document is a passport, and: during step (aO), the passport is presented open to the page of the machine-readable zone at the enrollment device for the implementation of the acquisition of the optical reading data of the identity document, and during step (c), the passport is presented closed to the control device.

According to a second aspect, the invention relates to a device for checking an individual having an identity document on a medium comprising an electronic chip in which is stored biometric reference data of the individual and capable of displaying a automatic reading zone representing an optical reading data of the identity document, configured for the implementation of steps of:

(b) from the candidate biometric datum, retrieval, in a memory, of an optical reading datum associated with a datum reference biometric corresponding to the biometric trait of the individual;

According to a third aspect, the invention relates to a system for checking individuals, comprising: a memory, a checking device according to the second aspect, and an enrollment device, configured for the implementation of steps for retrieving the reference biometric data of the individual from said electronic chip; acquisition of the optical reading data of the identity document by reading the machine-readable zone; and recording, in said remote memory, the optical reading data of the identity document in connection with the reference biometric data of the individual.

According to a fourth and a fifth aspect, the invention relates to a computer program product comprising code instructions for the execution of a method according to the first aspect of controlling an individual; and a computer-readable storage medium on which a computer program product includes code instructions for performing a method according to the first aspect of control of an individual.

DESCRIPTION OF FIGURES

Other characteristics, objects and advantages of the present invention will appear on reading the detailed description which follows, with regard to the appended figures, given by way of non-limiting examples and in which:

FIG. 1 schematically represents a control system for implementing the method according to the invention,

FIG. 2 schematically represents the main steps of a preferred embodiment of the control method according to the invention. DETAILED DESCRIPTION OF AT LEAST ONE EMBODIMENT OF THE INVENTION

Architecture

Referring to Figure 1, an individual control system 1 is shown. This system makes it possible to carry out the biometric authentication of individuals to authorize or prohibit the access of individuals to a zone or to a secure service.

To be able to carry out the control, the individual must have a physical or dematerialized identity document. In both cases, he has a physical medium for the identity document

According to a first embodiment, the identity document is a physical document (i.e. the medium is the document), such as a passport or an identity card, or even a chip card (“smartcard”), comprising a electronic chip, for example an RFID chip, in which is stored at least one biometric datum, acquired from a biometric trait of the individual.

The biometric data contained in the identity document is subsequently qualified as reference biometric data (as opposed to candidate biometric data, acquired on the fly on the individual).

The electronic chip generally also stores various alphanumeric data of the individual, which are in practice printed on the support of the identity document if it is "physical", called "visual data", chosen in particular from: o Full number of the identity document; o Expiry date; o Date of issue; o Name; o First name(s); o Nationality; o Date of Birth; o Place of Birth; o Gender; o Size; o Address; o Etc.

Each identity document also has an automatic reading zone representing optical reading data (that is to say intended to be easily transmitted visually to computers), for example of the MRZ type, QR code or PDF417, also printed on the media for a physical document. The machine-readable zone of a document is reserved for the reading, identification and validation of this document.

A distinction will be made between optical reading data, which is digital data (which is generally also stored in the electronic chip) coding for a set of information and in particular some of said visual data (at least the number of the identity document, the date of birth of the individual, and/or the date of expiry of the identity document, in practice their concatenation), referenced "DG1" in the ICAO specifications (the reference biometric data is referenced "DG2" , and a certain amount of optional information is referenced DG3 to DG16); its representation for optical reading, which is the automatic reading zone, in a format readable by a computer or any equivalent processing unit capable of implementing optical acquisition and extraction of the optical reading data and its decoding. In other words, the optical read data is the contents of the optical read area.

In the case of MRZ, the representation of the optical reading data is a character string (and its reading involves optical character recognition) and in the case of QR code it is a 2D barcode. In the rest of this description, the preferred example of the MRZ will be described, and by misuse of language, the corresponding optical reading data will be designated MRZ. The MRZ (in French ZLA) is standardized by the ICAO (ICAO/ICAO 9303), included in the ISO/CEI 7501-1:2008 standard (and the ICAO supplement).

In the preferred case of a passport, this document is in the form of a booklet comprising covers and a set of pages, the machine-readable zone (in MRZ format) appearing on one of the pages of the booklet, involving the opening to the correct page and the correct positioning of the passport for the reading of this zone.

According to a second embodiment, the identity document is dematerialized on a user terminal such as a smartphone or a watch connected, ie the document medium is said terminal, but in practice there is also an electronic chip (a terminal processor and storage means - for example a flash memory) and the same data. Such a terminal preferably comprises contactless communication means (typically NFC, but also BLE, or even UWB, and in general any proximity radio communication) making it possible to reproduce exactly the operation of an RFID chip such as that of a passport. .

The only difference with a physical identity document is that if the "dematerialized" document also includes the same optical reading data, the machine-readable zone (its MRZ, QR code or PDF417 representation) is not printed on the support and only displayable on demand. More precisely, this data is also stored in the storage means of the terminal, for display on an interface of the terminal. This display advantageously reproduces the original appearance of a physical identity document, for example by displaying the entire page of the equivalent passport.

In summary, it will be understood that whatever its format, the support of the identity document of the individual always comprises an electronic chip in which is stored a biometric reference data of the individual, and always allows the visual provision of optical reading data of the identity document, whether it is simply displayed or physically printed on the medium.

The people screening system can for example make it possible to check individuals before boarding an aircraft or before crossing the border of a country.

The individual control system 1 comprises a control device 30, a memory 20, and potentially an enrollment device 10.

The control device 30 is advantageously placed at the entrance to a secure access zone. It can take the form of a gate which the individual can only pass through if the control is successful.

The enrollment device 10 is advantageously a fixed control structure such as a kiosk, possibly located in the same infrastructure (for example the same building) as the control device 30 and at a distance from the latter (in the case of check in an airport before boarding an aircraft, the enrollment device can be located in the same departure terminal as the control device. However, it is not located in the queue of the control device to be able to split the flow of individuals using the two devices), but alternatively in an official building such as a town hall or any other trusted entity. Indeed, as will be seen, there is only need for a single initial use of the enrollment device, which must be secure, and then the present method of checking an individual can be implemented a a large number of times. To reformulate, there is no need for enrollment before each control, unlike the known methods of the state of the art

The enrollment device 10 comprises a computer 11, such as for example a processor, a microprocessor, a controller, etc.

It also comprises a module 12 for reading the content of the optical reading data of a document. The module 12 can for example comprise an image sensor 13, such as for example a digital still camera or a digital camera, adapted to acquire an image of the machine-readable zone, and a module 14 for character recognition. The module 14 can be a software application executable by the computer 11 or alternatively a hardware module. This may be the case when, for example, the control device is the individual's mobile phone or tablet or personal computer, and this device is configured to perform character recognition. Alternatively, the image processing of the machine-readable zone can be performed remotely if the individual's device does not have this functionality. In this case, the module 14 can be a software application executable by a computer of another processing unit remote from the winding device (not shown), and the enrollment device 10 then comprises a communication interface with the remote processing unit making it possible to send it the image of the machine-readable zone on which the character recognition must be carried out.

The enrollment device 10 further comprises a chip reader 16 of an identity document. Typically, either the chip contained in the support of the identity document is a radiofrequency chip (for example an RFID radio-identification tag or a UHF chip), or the support comprises contactless communication means (of the NFC type, etc. .), and the reader 16 is adapted to read the contents of the chip remotely, by radiofrequency communication with the chip. Finally, the enrollment device 10 comprises a remote communication interface 15 with a memory 20 of the control system 1. This interface allows the computer 11 to exchange information with the memory 20. The memory 20 is advantageously remote from the device. enrollment 10. Consequently, the communication interface 15 is preferably the combination of a wired communication interface, for example Ethernet, or wireless, for example of the Wifi or Bluetooth type or mobile telephone network (GPRS, 3G, 4G or other) and any other downstream communication network linking to memory 20.

Advantageously, but optionally, the enrollment device 10 can finally comprise an information input interface 17 such as a keyboard, a touch screen, etc.

The control device 30 comprises a computer 31, which can also be a processor, microprocessor, controller, etc.

In addition, the control device 30 comprises a module 32 for acquiring biometric data on a biometric trait of an individual. The biometric trait can for example be the shape of the face, one or more fingerprints of the individual, or even one or more irises of the individual. It can also be the structure of the venous network of one or more fingers or of one or both hands, or the respective sizes of phalanges or fingers.

The biometric data acquisition module 32 comprises an image sensor 33, and an image processing module 34 suitable for extracting biometric data from an image of a biometric line. The extraction of the biometric data is implemented by processing the image of the biometric trait which depends on the nature of the biometric trait. Various image processing operations to extract biometric data are known to those skilled in the art. By way of non-limiting example, the extraction of the biometric data can comprise an extraction of the minutiae of the fingerprints from a fingerprint image. Alternatively, it may comprise an extraction of particular points or of a shape of the face in the case where the image is an image of the face of the individual, etc. Alternatively, a convolutional neural network can be used.

The memory 20 of the control system 1, already mentioned above, can be a memory integrated into the control device 30. As a variant, it can be a memory remote from the control device 30, advantageously a base of data. In this case, the latter also comprises a remote communication interface 35 with the memory 20.

Finally, the control device 30 includes a chip reader 36 of an identity document. Typically, either the chip contained in the identity document medium is a radio frequency chip (for example an RFID radio-identification tag or a UHF chip), or the medium includes contactless communication means (of the NFC type, etc. ), and the reader 36 is adapted to read the content of the chip remotely, by radiofrequency communication with the chip.

The control device 30 can also include an information input interface 37 such as a keyboard, a touch screen, etc.

System 1 is suitable for implementing the control method described below.

Enrollment

With reference to FIG. 2, the main steps of a process for checking an individual have been represented. This process makes it possible to verify that the individual who presents himself for the control corresponds to the one to whom the identity document was issued, by carrying out a biometric authentication by comparing a biometric data newly acquired on the individual with the data biometric authentication stored in the chip contained in the document.

The method advantageously has a prior step (a0) of enrollment implemented by the winding device 10. As explained, this step only needs to be done once, and then the method can be implemented. work without understanding it. It should be noted that, preferably, provision will be made to re-implement it at regular intervals, for example once a year, for safety.

Step (a0) aims to create an entry in the memory 20 corresponding to the identity document of the individual, and typically consists of the generation of a DTC of the individual. By DTC, Digital Travel Credentials, in French Certificat de Voyage Numérique, we mean a container of the virtual version of an identity document, in a form recognized by the ICAO, see in particular the presentation https://www.icao .int/Meetings/TRIP-Symposium- 2019/Publishinglmages/Pages/Presentations/Digital%20Travel%20Credentials.pdf. To reformulate, the DTC contains all or part of the aforementioned data of an identity document, in particular the optical reading data (DG1) and the reference biometric data (DG2). Thus, step (aO) can be seen as a dematerialization of the identity document of the individual. It will be noted that the fact of using a terminal as a medium for the identity document already implies that the DTC exists and is loaded into the memory of the terminal, so that step (aO) is theoretically only to be implemented in the case of a physical identity document.

Thus, step (aO) first includes the recovery of the individual's reference biometric data from said electronic chip and the acquisition of the optical reading data of the identity document by reading the reading zone automatique. This action is classic and can be implemented in a conventional way (this is what is often done today at airport control devices and generates queues). It requires the individual to manipulate the identity document to present his document to the sensor 13, on the page of the automatic reading zone, and with the automatic reading zone in view of the acquisition zone of the sensor 13, c ie presented in a position and in a direction allowing the sensor to acquire an image of the zone. The reading module 12 of the enrollment device 10 acquires an image of the automatic reading zone and extracts from this zone the optical reading data of the document. The retrieval of the reference biometric datum can be substantially simultaneous because the optical reading datum can be used to access the content of the chip and to retrieve the reference biometric datum.

Alternatively, multiple biometric data of the individual corresponding to different biometric traits may be available and retrieved. For example, a first biometric data from the individual's iris, and a second from the face, or fingerprint, etc.

Then, the enrollment device 10 records, in said memory 20, the optical reading data of the identity document in connection with the reference biometric data of the individual. By way of non-limiting example, a datum can be generated by the computer 11, comprising the optical reading datum and the reference biometric datum, for example in the form of a doublet, and stored in the memory. The two data are thus associated in the memory 20. The fact of recording several biometric data in connection with the optical reading data of the identity document can allow the method to be compatible with different technologies implemented at different checkpoints, or to increase the security of the method by using in the continuation of the method several biometric data to find the optical reading data.

Advantageously, but optionally, step (aO) of the method can also comprise the acquisition (or the recovery from the electronic chip, as for the reference biometric data) of additional data comprising:

Identity data relating to the individual, this data being able for example to be confronted with data appearing on the identity document and allowing an increased security of the control (for example, surname, first name(s), date and place of birth),

Data allowing to discriminate the individual among a set of individuals crossing the same control. For example, in the case of boarding a flight, the data may include the flight number, the name of the airline, the airport of landing and/or take-off, etc. Alternatively, in the case of a border crossing, it may be a visa number, a country of origin, etc. and/or A public key, for example referenced DG14 or DG15, see below. This acquisition of additional data is advantageously implemented before the recording in the memory, and in this case the data making it possible to discriminate the individual are also recorded at the same time in connection with the optical reading data of the identity document and the individual's reference biometric data.

Process for controlling individuals

The control method itself is implemented by the control device 30. This step can be implemented completely uncorrelated from enrollment (aO).

The individual presents himself to the control device 30 and presents to the biometric data acquisition module 32 the same biometric trait as that to be from which the reference biometric data was obtained. Candidate biometric data is acquired on this trait during a step (a).

During a second step (b), the control device 30 retrieves from the memory 20, from this candidate biometric data, the optical reading data of the document previously recorded for the same individual. To do this, the device searches in the memory 20 for reference biometric data corresponding to the candidate biometric data, that is to say which has been acquired on the same line, by comparing the candidate biometric data with the biometric data references stored in memory. A match is established if a rate of similarity between two biometric data exceeds a predetermined threshold, which depends on the way in which the comparison is established and on the nature of the biometric trait. A non-limiting example of implementation of comparison between two data is by calculating the distance (Euclidean distance, Hamming distance, etc.) between the data.

The control device 30 then recovers the optical document reading data corresponding to each of the reference biometric data having a level of correspondence with the candidate biometric data above said threshold. The control device 30 can therefore recover one or more optical document reading data.

If several reference biometric data corresponding to different biometric traits were retrieved during enrollment (aO), then either several candidate biometric data are acquired on the same traits in step (a) and are used for step (b) searching for the optical reading data of the identity document, which increases security, or a single candidate biometric data is acquired and used for step (b). The diversity of data acquired in step (a) makes it possible in this case to increase the compatibility of the process with different control devices 30.

In the event that, during enrollment (aO), additional data making it possible to discriminate the individual have been recorded in connection with the first biometric datum and the document number, step (a) may further comprise the acquisition of additional data, during which the individual again enters the same data(s) as during enrollment (aO). Advantageously, this entry is not necessary if these additional data are intrinsically and therefore known beforehand by the control device 30, for example because of its location if these data designate the airport in which the control device 30 is located.

Any additional data is advantageously used in step (b) to restrict the set of reference biometric data of the memory to be compared with the candidate biometric data, by selecting only the biometric data recorded in the memory in connection with the same additional data (e.g. same country of origin, etc.).

This speeds up the implementation of step (b) and reduces the number of document optical reading data obtained at the end of this step.

Then the method comprises a main step (c) during which the individual presents his document to the reader 36 of the control device 30. In this step (c), the control device 30 opens, or at least attempts to open , a secure communication channel with the electronic chip of the support of the identity document of the individual by using said retrieved optical reading data.

The trick is that step (c) does not include either the retrieval of the individual's reference biometric data from said electronic chip via said secure communication channel, nor the reading of said automatic reading zone of the document medium of identity.

First, since the reader 36 only interacts with the electronic chip, and not the machine-readable zone, it is not necessary to present the document open or in a particular direction. In particular, the passport may be presented closed, in any orientation. This implies a considerable saving of time for the individual, who does not need any particular handling of the identity document, or any other document for which a reading zone or a barcode should be read and deletes the risks of failure linked to this manipulation.

But above all, in normal times, the control device 30 would have had to read the content of the document chip to recover the biometric authentication data from the optical reading data or data that it holds, which takes time. long enough.

In this case, the biometric authentication has in fact already taken place, since we have been able to identify at least one reference biometric datum corresponding to the candidate biometric datum, and we just want to verify this authentication (and identify the individual uniquely if there was still ambiguity) and ensure that the individual has the corresponding identity document.

Here we are content to check that we can open the secure communication channel, without recovering data in the chip, which only takes a very short time, further fluidizing the passage of users to the control device 30. the user also does not need to leave his medium resting on the reader 36 for several seconds, he can pass it nearby briefly (less than 1s), further reducing contacts and the risk of contamination of surfaces.

Reader 36 opens the channel using said retrieved optical read data as a password. In the event that it has recovered at the end of step (b) several numbers, the reader tries to open the channel by trying the optical reading data recovered one after the other until trying those which correspond to the identity document of the individual and which authorizes access to the content of the chip.

In known manner, said secure channel is opened in accordance with a protocol selected from Basic Access Control, BAC, and Password Authenticated Connection Establishment, PACE, using a key derived from said retrieved optical reading data. In particular, said key is preferably, in accordance with ICAO specifications, for MRZ optical reading data, a hash of the concatenation of the number of the identity document, the date of birth of the individual, and the expiry date of the identity document.

In the case where the support is a mobile terminal, step (c) may in fact comprise the opening of two interleaved channels: a first "protocol" channel between the contactless communication module of the terminal and the reader 16 (for example a BLE channel), and in this channel the secure “application” communication channel is opened using said retrieved optical reading data.

In a particularly preferred manner, step (c) comprises the implementation of authentication of said electronic chip via said secure communication channel, in particular active authentication (“active authentication”) or hardware authentication (“chip authentication”). “), and we will also mention PACE with chip authentication mapping (PACE-CAM), see for these three mechanisms part 11 of the ICAO/ICAO 9303 specification (chapter 6). Indeed, the opening of the secure channel makes it possible to ensure that the individual has in hand an identity document medium with a chip which contains the expected data, but it could be falsified. Indeed, we call "cloning" the fraudulent action consisting in duplicating an identity document by manufacturing a false medium (and generally by using an unauthorized medium) comprising an electronic chip on which the data read from the original chip.

To prevent this, the original/authorized chips store a pair of a private key and a public key, the private key being inaccessible in reading and the public key being accessible (for example referenced DG14 for chip authentication and referenced DG15 for active authentication). Note that this public key can be retrieved using the secure channel (it is much lighter than biometric data for example), or even directly retrieved during the creation of the DTC (enrollment step (a0)), this which is preferred to avoid any need to read data from the electronic chip. Thus, it is possible to copy the public key if one tries to clone the chip, but not the private key.

Chip authentication is well known to those skilled in the art, and is based on a Diffie-Hellman key agreement protocol and consists of an exchange of public keys with the electronic chip (the electronic chip provides its so-called static public key, and the control device 30 provides a so-called ephemeral public key), then the generation of a common secret (the electronic chip uses its private key corresponding to the static public key and the control device 30 uses its private key corresponding to the key ephemeral public), and finally changing the encryption key of the secure channel from this common secret (the new session key is derived from the common secret). If the control device 30 “understands” the identity document after this change of key (i.e. each party has indeed obtained the same session key), then the electronic chip of the identity document is correctly authenticated.

In the other more recent case of active authentication, this authentication is called active because it involves a challenge/response mechanism: said active authentication of said electronic chip comprises verification (by the control device 30) using said key public of an electronic signature received from the electronic chip in response to the sending of a nonce (the challenge). In more detail, the control device 30 generates a nonce, sends it via the channel to the secure chip. This calculates its signature using its private key: the chip hashes the nonce (with a cryptographic hash function), then encrypts (among other things) the hash using the private key, with a cryptographic function such as RSA, and returns the signature in response to the control device 30 which decrypts it with the public key and verifies that the hash of the nonce is indeed found.

It should be noted that the public key of one or other of the mechanisms can itself be signed with a private key of a government body or issuer of the identity document to ensure that we have not put a false private key/public key pair on the electronic chip.

It will be understood that in a particularly preferred manner, no data other than the data necessary for said authentication of the electronic chip is transmitted via said secure communication channel, so as to retain the benefit of an absence of recovery of the data contained on the chip.

Depending on the result of step (c) (and in particular the active or hardware authentication), access to the zone is authorized or denied for the individual.

Note that step (c) may include additional biometric authentication of the individual. This step comprises the comparison of the reference biometric data corresponding to the chip of the formally authenticated document with a new candidate biometric data acquired on the same trait. This other datum may be a second biometric datum acquired by the control device 30 (or another control device) exclusively for the purposes of authentication. This is particularly the case if the biometric trait corresponds to another reference biometric datum than the reference biometric datum corresponding to the first candidate datum, or if there are several control devices, for example in an airport a first device when crossing the border and a second when boarding.

Thus the proposed method completely eliminates any reading of the automatic reading zone in the recurring control process (the user can go from entering the departure airport to exiting the arrival airport without ever having to present the machine-readable area) and further simplifies handling the support of the identity document since the contactless communication can be much shorter, while ensuring the presence of the identity document during said control and allowing the control of the individual using the data of said identity documents.

Claims

1. Method for checking an individual having an identity document on a medium comprising an electronic chip in which is stored a reference biometric data of the individual and capable of displaying an automatic reading zone representing a data of optical reading of the identity document, the method comprising the implementation by a control device (30) of steps of:

(b) from the candidate biometric data, retrieval, in a memory (20), of optical reading data associated with the reference biometric data corresponding to the biometric trait of the individual;

2. Method according to claim 1, in which step (c) comprises neither the retrieval of the individual's reference biometric data from said electronic chip via said secure communication channel nor the reading of said machine-readable zone of the support of the identity document.

3. Method according to one of claims 1 and 2, wherein step (c) comprises the implementation of an authentication of said electronic chip via said secure communication channel.

4. The method of claim 3, wherein said electronic chip stores a pair of a private key and a public key, said authentication of said electronic chip being selected from active authentication and hardware authentication.

5. Method according to claim 4, in which said authentication of said electronic chip is an active authentication comprising the verification in using said public key of an electronic signature received from the electronic chip in response to sending a nonce.

6. Method according to one of claims 3 to 5, wherein no data other than the data necessary for said authentication of the electronic chip is transmitted via said secure communication channel.

7. Method according to one of claims 1 to 6, wherein said secure channel is opened in accordance with a protocol chosen from Basic Access Control, BAC, and Password Authenticated Connection Establishment, PACE, using a key derived from said read data retrieved optics.

8. Method according to one of claims 1 to 7, in which step (b) comprises: a comparison of the reference biometric data stored in the memory with the candidate biometric data, and the selection of at least one optical reading of an identity document corresponding to at least one reference biometric datum having a rate of similarity with the candidate biometric datum greater than a predetermined threshold.

9. The method of claim 8, wherein if more than one ID document scan data has been selected, step (c) is attempted for each selected scan data until opening secure communication channel.

10. Method according to one of claims 1 to 9, wherein the control device (30) comprises contactless communication means, step (c) being implemented by bringing said support of the control device (30 ) in any orientation.

11 . Method according to Claims 1 to 10, comprising a prior step (aO) implemented by an enrollment device (10), of retrieving the reference biometric data of the individual from the said electronic chip; acquisition of the optical reading data of the identity document by reading the zone of automatic reading; and recording, in said remote memory (20), of the optical reading data of the identity document in connection with the reference biometric data of the individual.

12. Method according to claim 11, in which the identity document is a passport, and: during step (a0), the passport is presented open to the page of the machine-readable zone at the enrollment device (10) for the implementation of the acquisition of the optical reading data of the identity document, and during step (c), the passport is presented closed to the control device (30).

13. Control device (30) of an individual having an identity document on a medium comprising an electronic chip in which is stored biometric reference data of the individual and able to display an automatic reading zone representing optical reading data of the identity document, configured for the implementation of steps of:

(b) from the candidate biometric datum, retrieval, in a memory (20), of an optical reading datum associated with a reference biometric datum corresponding to the biometric trait of the individual;

14. System (1) for controlling individuals, comprising: a memory (20), a control device (30) according to claim 13, and an enrollment device (10), configured for the implementation of steps of recovering the individual's reference biometric data from said electronic chip; for acquiring the optical reading data of the document identity by reading the machine-readable zone; and recording, in said remote memory (20), of the optical reading data of the identity document in connection with the reference biometric data of the individual.

15. Computer program product comprising code instructions for the execution of a method according to one of claims 1 to 12 for controlling an individual, when said method is executed on a computer.

16. Storage medium readable by computer equipment on which a computer program product comprises code instructions for the execution of a method according to one of claims 1 to 12 for monitoring an individual.