FR2934748A1 - Digital image i.e. user photo, authenticating method for portable telephone, involves modifying blocks based on code so as to modify visual rendering of blocks, and decompressing modified image and displaying modified image on terminal - Google Patents

Abstract

The method involves segmenting a digital image into blocks that are juxtaposed with respect to one another and not intersected with one another, and compressing the segmented image. The compressed image is stored in a secure storing and processing unit e.g. Universal Integrated Circuit Card (UICC)such as smart card, and numbers are allocated to the corresponding blocks. The blocks are modified based on a code containing the allocated numbers, so as to modify the visual rendering of the blocks. The modified image is decompressed and displayed on a terminal i.e. portable telephone. An independent claim is also included for a system for authenticating an image, comprising a portable telephone.

Description

IMAGE AUTHENTICATION METHOD AND SYSTEM

The present invention relates to the field of image authentication. In particular, it relates to the field of authentication of images contained in a secure element and displayed on an unsecured device. Today, more and more contactless applications are being developed, such as the validation of a ticket or an authorization to access a secure place, for example. These applications are implemented in mobile media, easily transportable by the user. It is desirable in some cases to be able to verify the identity of the holder in order to know if the person in possession of the mobile support is the one who has the rights conferred by the possession of this mobile support. The mobile support can be a smart card integrating the RFID technology (for Radio Frequency Identification or Radio-identification in French) and including information on the user. In this case, a photograph of the user of the card can be printed on it, allowing an identity verification. The smart card is a secure element in that access to its memory is protected.

The mobile medium can also be an electronic device such as a mobile phone, now widely used and adopted by a large number of people. The mobile phone is indeed a good candidate for the implementation of various applications, such as, for example, a payment application or a ticket application. A mobile phone is however not a secure item. Documents and / or information stored in its own memory are effectively unsecured and therefore liable to be falsified (e) s.

In particular, in the case where these documents and / or information are used for an identity check to verify, for example, a right to use an application (payment, ticket. ..), it will be relatively easy for anyone to falsify these documents and / or information that is not secure. This person may then claim, unduly, to have a right to use the application.

An object of the invention is then to allow an authentication of an image displayed on a screen of a mobile phone or any other device for displaying a digital image. For this purpose, the invention proposes a method of authenticating an image comprising the steps of: partitioning the image into tiles that are juxtaposed and without intersection; - compression of the image thus decomposed; storage of the image in a storage and secure processing unit in compressed form; - assigning a number to each of the tiles; modification by the storage and secure processing unit of a first set of tiles according to a code consisting of a series of numbers included among the numbers assigned so as to substantially modify the visual rendering of this set of numbers; roof tiles ; - decompression and display of the image thus modified on the terminal.

An advantage of the method according to the invention is to make it more difficult to falsify the image used for an identity check. Other optional and nonlimiting features of the method are: it further comprises displaying the unmodified image on the terminal; it further comprises a step of modifying information of a second set of tiles, the visual rendering of the second set of tiles remaining substantially unchanged; the first set of tiles comprises either the tiles whose assigned numbers are those of the code, or all the tiles whose assigned numbers are different from those of the code; the storage and processing unit is a UICC card; the terminal is a mobile phone in which the storage and processing unit is integrated; the terminal is a control device intended for the identity check of a user of the image; the secure storage and processing unit generates the code consisting of the series of numbers randomly; a control device for the identity check of a user of the image generates the code composed of the series of numbers, and the code consisting of the series of numbers is transmitted in a secure manner to the storage unit and secure processing; the image is compressed in a format implementing the wavelet decomposition, for example in JPEG2000 format; the image is downloaded by or transmitted to the terminal in a secure manner after the modification step and before the decompression step; each of the tiles of the stored and compressed image is divisible into layers of sharpness thanks to the EBCOT compression method, a modification of the layers of sharpness of the tile modifying its visual rendering in an imperceptible or perceptible manner for a human eye, and the information of the first set of tiles are modified by modifying so-called low sharpness layers, the lower layers corresponding to low spatial frequencies and therefore to a general appearance of the image; the information of the second set of tiles is modified by modifying so-called high sharpness layers, the upper layers corresponding to high spatial frequencies and therefore to image details; - The tiles are delimited by a grid on the modified image and displayed on at least one terminal; the numbers assigned to the tiles are displayed in a visible manner on the modified image so as to be superimposed, respectively, on the tiles; it furthermore comprises a triggering step caused by an action on the terminal or by remote connection; and it further comprises a step of visually checking the modified image by comparison of this modified image with the code comprising the series of numbers. Other features, objects and advantages will become apparent from the following description, with reference to the drawings given by way of example and illustration, among which: FIG. 1 is a schematic representation of a mobile telephone; FIG. 2 is a flowchart showing schematically an example of a succession of the steps of the method according to the invention; FIG. 3 is a schematic representation of an unmodified image; FIG. 4 is a schematic representation of an image modified by the method according to the invention; FIG. 5 is a schematic representation of a packet of an image.

The method according to the invention allows the authentication of images displayed on a display means such as a screen of a mobile phone or any other device for displaying a digital image. For the sake of clarity, the method according to the invention will be described below with reference to use with a mobile phone. This description can not be considered as limiting the application of the method to the use of a mobile phone as storage medium and / or display of the digital image, but the skilled person will adapt this process to any device for storing and / or displaying a digital image.

A digital image 3, for example a picture of the user, is previously stored in a storage and processing unit 2, for example a UICC card (also called SIM card). As already mentioned above, a mobile phone 1 is an insecure element. It is therefore unlikely to store in a mobile phone's own memory 1 an image used to authenticate a person. Indeed, the falsification of this image is too easy. That is why it is advantageous to store this image in the UICC card 2 (or SIM card) and not directly in the memory of the mobile phone. Indeed, this UICC card is a secure smart card. In order to modify the information contained in this smart card, you must have the corresponding authorizations. Today, only the issuers of these cards (telephone operators, banks, inserters, transport organizations, etc.) can make such modifications. Thus, if a photo is stored in the user's UICC 2 card, it can not be modified or replaced by the latter or a third party (especially an unauthorized third party). Of course, the invention is not limited to UICC cards but extends to any storage unit and processing for the secure storage of an image. The image 3 is typically stored in the UICC card 2 in compressed form, preferably in a data compression format of the image based on a wavelet transform. For example, the image is compressed in JPEG2000 format. Once the image 3 is compressed and stored in the UICC card 2, and the UICC card 2 installed in a base provided for this purpose in a mobile phone 1, an application implemented in the mobile phone 1 can decompress the image 3 and the display on the screen 12 of the mobile phone 1. When a controller, who checks whether the holder of the mobile phone has rights he claims to have, wishes to verify the identity of the carrier, the identification process according to the invention is triggered E2. The triggering E2 can be carried out in several ways according to the envisaged implementation of the method according to the first aspect of the invention. This trigger E2 will be detailed later. After triggering the process E2, the UICC card 2 modifies the image 3 stored therein.

Indeed, if it is the stored and unmodified image 3 which is displayed after decompression on the screen 12 of the mobile phone 1, the controller performing a check on the identity of the carrier of the mobile phone 1 can not know if the image 3 displayed on the screen 12 of the mobile phone 2 is indeed the image 3 stored in the UICC card 2 or simply an image 3 stored in the mobile phone's own memory 1. The modification of the image is performed in several steps that are not here described successively. Partitioning El of image 3 in tiles 32 Before initiating the process, it is necessary that image 3 has been stored in the UICC card 2. Some compression formats, for example the JPEG2000 format, allow partitioning El of the image. image 3 in several tiles 32. A tile 32 is a rectangular subset of the image 3. The image is composed of a set of tiles juxtaposed and without intersection. For example, the image is partitioned into tiles so as to reproduce a grid 34. The grid is preferably a 4x4 grid, but can also be a grid with a number of columns and / or lines different from four. A tile 32 is encoded in one or more pack (s) 32 'compressed (s) or not. A packet 32 'is a succession of adjacent digital data having a certain length. The modifications of the image 3 are made by tile 32 by modifying the package (s) 32 'coding for the tile 32. In order to identify the package (s) 32' corresponding to a tile 32, a table pointers is planned. A packet 32 'is identified by means of a pointer contained in the table. The pointer can be, for example, of the following form: (offset, length). The offset or offset in English determines a location in the compressed or non-encoded data of the image 3 from which a portion of the compressed or non-compressed digital data corresponding to a packet 32 'begins. The length determines how far from the offset the computer code portion of the packet 32 'extends. A tile 32 'can be determined by a single pointer, in the case where it comprises only one packet 32', or by several pointers, if it comprises several packets 32 '. Each tile 32 is assigned a number 36. The assigned numbers 36 are different two by two.

Once partitioned, the image 3 as well as the array of pointers are stored in the UICC card 2. The image 3 is preferably stored in the UICC card 2 after compression, for example in JPEG2000 format. Generation E3 of a code After or simultaneously with the triggering E2, a code is generated.

The generated code is a code consisting of a series of numbers. The generation E3 of the code is performed randomly either by the UICC card itself, or by an external verification device, for example an identity control device of the controller wishing to verify the identity of the carrier of the mobile phone 1.

In the case where it is the identity control device that randomly generates the code composed of the series of numbers, this code is then transmitted to the UICC 2 card in a secure manner. The secure transmission takes place between the external verification device and the storage and processing unit 2, via a contactless channel.

The data is transmitted encrypted between the external verification device and the UICC card 2. Each number in the series corresponds to a number 36 assigned to a tile 32 of the picture 1. The numbers of the code series are different two by two .

Thus, for example, if the image 1 is partitioned according to a grid 34 4x4, the UICC card 2 assigns each of the tiles 32 a number 36 between 1 and 16. The numbers making up the series of the code are then understood between 1 and 16. The numbers in this series correspond to the tiles 32 that will undergo a modification.

As a variant, the numbers of this series correspond to the tiles 32 which will not undergo modification. The numbers assigned to tiles 32 are not necessarily successive numbers. The security level of the method depends on the number of squares of the grid 34 and the number of numbers making up the series. Thus for a grid 34 mxn, and a number p <mxn of numbers making up the series of the code, the probability of realization of a series is 1 where Cmxn Cmxn is the number of possible combinations. Thus, for a 4x4 grid and a series with 4 numbers, the probability of completion of a series is 1/1820. Display E4 of unmodified image 3 You can choose to display unmodified image 3 to allow easy comparison with the modified 4 image that will be displayed later.

An application of the mobile phone 1 decompresses the image 3 contained in the UICC card 2, then displays it on the screen 11 of the mobile phone 1. The image 3 displayed is said to be unmodified because the computer data, concerning the image 3 to decompress and which is actually displayed, are not modified. Nevertheless, the UICC card 2 can add layers on the image 3. For example, as shown in FIGS. 3 and 4, a first layer is a grid 34 corresponding to the grid. Another example, a second layer is a grid of numbers 36 identifying the tiles 32 of the image. The first and second layers can of course both be applied to the image 3 to decompress. Thus, the displayed image is composed of the unmodified image 3 and the grid and / or numbers filigree, transparency or otherwise. Modification E5 Tiles 32 In order to modify the tiles 32, the UICC 2 card includes the table of pointers for pointing to the package (s) 32 'corresponding to the tile 32 to be modified. In the variant where the serial numbers of the code correspond to tiles 32 to be modified, the UICC card 2 modifies with the help of the pointers of the packets 32 'corresponding to the tile to be modified 32. The modifications made by the UICC card 2 are simple. For example, the UICC card 2 generates a binary series of the same length as the binary and compressed data coding for a packet 32 'and applies an operation, for example an XOR, on some or all of the compressed and pointed binary data of the packet. 32 '. This modification can be performed on one or more packets 32 'coding for the tile to be modified 32. In the variant where the numbers of the code series correspond to tiles 32 not to be modified, the UICC card 2 modifies using pointers the data corresponding to the compressed data of the tiles 32 not being part of the numbers of the series. There are several ways to change the 32 tiles to edit. A first possibility is to play on the sharpness of the image. Thus, for example in the JPEG2000 format, a tile 32 is divisible into several layers of sharpness thanks to the compression method EBCOT (High Performance Scalable Image Compression with EBCOT or High Performance Scalable Image Compression, Taubman, D., Image Processing, IEEE Transactions on, July 2000 (9.7), 1158-1170). The so-called high layers are those which correspond to high frequencies, and thus contain information relating to the details of the image 3. The so-called low layers correspond to low frequencies, and therefore contain information relating to the general appearance of the image. picture 3. The pointer table will then contain an indicator to indicate whether the packet is coding a low or high layer. The human eye is not sensitive to spatial frequencies in a homogeneous way. Indeed, the highest frequencies are invisible to humans. Thus, a modification of the upper layers does not have much effect on the perception of the human eye and a tile 32 whose corresponding upper layers have been modified does not appear to be altered, whereas a modification of the lower layers has affect the general perception of the human eye. It is then possible for a tile 32 of the image whose lower layers have been modified to generate an image with, for example, either an area corresponding to the modified tile 42, fuzzy, or an area corresponding to the modified tile 42. where snow appears or any other alteration that makes the image indistinguishable.

The number of layers is different depending on the compression ratio and / or the size of the image 3. It is also necessary to determine which are the lower layers and which are the upper layers. This determination can be made during the storage of the image 3 in the UICC card 2 by an operator by modifying the successive layers.

Thus, the UICC card 2 carries out operations aimed at modifying the lower layers of the tiles 32 to be modified. The tiles 42 of the modified image 4 corresponding to the tiles 32 to be modified then appear altered. Another possibility is to play on chrominance and luminance.

The principle is similar to that of playing on the sharpness. The tiles 42 of the modified image 4 corresponding to the tiles 32 to be modified then seem to contain chromatic aberrations. These modifications of the image 3 are made in the compressed file of the image 3. This has the advantage of making fraud more difficult. Indeed, since the modification is performed by the UICC card 2, while the image is still compressed, a third party viewing the modified image can not go back to the compressed data of the series of numbers and can not then modify any of its photos according to the code in order to falsify the photo actually contained in the UICC 2 card.

Display E6 of the modified image 4 Once the compressed image has been modified by the UICC card 2, an application of the mobile phone 1 decompresses the compressed and modified image 4 and displays it on the screen 12 of the mobile phone 1. Alternatively, the decompressed image 4 is transmitted and then displayed only or also on the controller's identity control device. The modified and displayed image 4 then presents tiles 42 whose visual rendering has been substantially deteriorated (for example blurred or having chromatic aberrations). These tiles 42 whose visual rendering has been substantially deteriorated correspond to the packs 42 'which have been modified by the UICC card according to the code. There are then two sets of tiles 42, 44. A first set of tiles 44 whose visual rendering has not been damaged and a second set of tiles 42 whose visual rendering has been deteriorated.

In a variant, a grid 34 and / or a number grid 36 may also be displayed (e, s) at the same time as the image modified and displayed in the same manner as for the unmodified image previously described. Verification of the identity of the wearer The controller wishing to verify the identity of the mobile phone holder can do so by the method according to the invention simply by looking at the modified image and displayed and comparing it with the code comprising a series of numbers . The controller knows the code because it is displayed either on the screen 12 of the mobile phone 1, possibly in addition to the numbered marks on the modified and displayed image, and / or on its identity control device. In the variant where the numbers of the code series correspond to the tiles 32 to be modified, the controller checks that the tiles 42 whose visual rendering has been substantially deteriorated correspond to the numbers of the code series. If the tiles 42 whose visual rendering has been substantially deteriorated correspond to the numbers of the series of code, then the modified and displayed image 4 has not been falsified and corresponds to the image 3 stored in the UICC card 2. Otherwise, the modified and displayed image 4 has been falsified and does not correspond to the 3 stored in the UICC card 2.

In the variant where the numbers in the code series correspond to the tiles 32 not to be modified, the controller checks that the tiles 44 whose visual rendition has not been deteriorated correspond to the numbers of the code series. If the tiles 44 whose visual rendition has not been damaged correspond to the numbers of the code series, then the modified and displayed image 4 has not been falsified and corresponds to the image 3 stored in the UICC card. 2. Otherwise, the modified and displayed image 4 has been falsified and does not correspond to that 3 stored in the UICC card 2. Process trigger E2 The process is triggered either by a mechanical intervention of an operator (carrier or controller) directly on the mobile phone 1 (for example, triggering by the wearer on pressure of one or a series of buttons), or by intervention of the controller on the control device which then controls the triggering of the process by the UICC card 2, for example by sending a control signal, for example radiofrequency, to the UICC card 2. In the case where the code composed of the series of numbers is generated by the control device, the method can be de triggered by sending the code consisting of the series of numbers. The fact of being able to trigger the process by the control device, and especially if the modified image 4 and the composed code of the series of numbers are displayed on the control device, allows the controller to carry out the verification even if the carrier cell phone is recalcitrant. Adding lures It is also possible with the method according to the invention to add lure tiles. These decoy tiles are tiles modified by the UICC 2 card. These decoy tiles are distinct from the tiles to be modified. Indeed, the visual rendering of the lure tiles is little deteriorated or not at all, and at least almost invisible to the human eye. For example, in the case where the changes are made on the sharpness of the image, it is possible to obtain lure tiles by modifying the high layers of these tiles. These high layers corresponding to high frequencies, their modification does not result in an alteration substantially visible for the human eye corresponding tiles of the image. For the human eye, therefore, the lure tiles and the unmodified tiles are part of the same set of tiles 44 complementary to that of the tiles 42 whose visual rendering has been significantly deteriorated. The addition of lure tiles has the advantage of making tile detection to be modified and / or modified 32, 42 more difficult by a computer system.

Indeed, such a system does not differentiate between a lure tile and a modified tile 42, for him both have undergone a modification. While for the human eye, only the tiles corresponding to the tiles 32 to be modified have been modified, those corresponding to the decoy tiles will appear intact or almost intact.

Claims (19)

Revendications1. A method of authenticating an image (3) comprising the steps of: - (E) dividing the image (3) into tiles (32) juxtaposed and without intersection; compression of the image (3) thus decomposed; storing the image (3) in a secure storage and processing unit (2) in compressed form; assigning a number (36) to each of the tiles (32); - (E5) modification by the unit (2) of storage and secure processing of a first set of tiles according to a code composed of a series of numbers included among the numbers allocated so as to substantially modify the visual rendering of this set of tiles; - (E6) decompression and display of the image (4) thus modified on the terminal. 2. Method according to the preceding claim, further comprising the display (E4) of the image (3) unmodified on the terminal. 3. Method according to one of claims 1 or 2, characterized in that it further comprises a step of modifying information of a second set of tiles, the visual rendering of the second set of tiles remaining substantially unchanged. 4. Method according to one of the preceding claims, characterized in that the first set of tiles comprises either the tiles whose assigned numbers are those of the code, or all the tiles whose assigned numbers are different from those of the code. 25 30 5. Method according to one of the preceding claims, characterized in that the unit (2) for storage and processing is a UICC card. 6. Method according to one of the preceding claims, characterized in that the terminal is a mobile phone (1) in which is integrated 5 unit (2) for storage and processing. 7. Method according to claims 1 to 5, characterized in that the terminal is a control device for the identity check of a user of the image. The method according to the preceding claims, wherein the storage and secure processing unit (2) generates the code consisting of the series of numbers (36) in a random manner. 15 9. The method according to claims 1 to 7, wherein a control device for the identity check of a user of the image generates the code consisting of the series of numbers, and in that the code composed of the series. numbers are securely transmitted to the storage and secure processing unit. 20 10. Method according to one of claims 2 to 9, characterized in that the image is compressed in a format implementing the wavelet decomposition, for example in JPEG2000 format. 25 11. Method according to one of the preceding claims, characterized in that the image (4) is downloaded by or transmitted to the terminal in a secure manner after the modification step (E5) and before that of decompression. 30 12. Method according to one of the preceding claims, characterized in that each of the tiles (32) of the image (3) stored and compressed is divisible into sharpness layers (38) by the compression method EBCOT, a modification layers of sharpness of the tile modifying its visual rendering in an imperceptible or noticeable manner for a human eye, and in that the information of the first set of tiles is modified by modifying so-called low sharpness layers, the low layers corresponding to frequencies low spatial and therefore to a general appearance of the image. 13. Method according to the preceding claim in combination with claim 3, characterized in that the information of the second set of tiles are modified by changing so-called high sharpness layers, the upper layers corresponding to high spatial frequencies and therefore to details of the image. 14. Method according to one of the preceding claims, characterized in that the tiles are delimited by a grid (34) on the modified image (4) and displayed on at least one terminal. 15. Method according to one of the preceding claims, characterized in that the numbers (36) assigned to the tiles (32) are displayed visibly on the modified image so as to be superimposed, respectively, to the tiles (32). 16. Method according to one of the preceding claims, characterized in that it further comprises a step (E2) of triggering caused by an action on the terminal or by setting remote connection. 17. Method according to one of the preceding claims, characterized in that it further comprises a step of visually inspecting the modified image by comparison of this modified image with the code comprising the series of numbers (36). 18. System implementing the method according to one of the preceding claims, comprising: - a mobile phone (1); - a control device; and - a unit (2) for storage and secure processing. Mobile telephone comprising a unit (2) for storage and secure processing for the implementation of the method according to one of claims 1 to 17.