FR3093836A1 - Numeric identity - Google Patents

Abstract

This system (1) for generating an authenticated document (2), comprising input means (3) comprising a screen (4) for the input by a user of characteristic information (5) of said authenticated document (2), means for transmitting (10) a request (6) comprising said characteristic information (5) to an authentication unit (11) having a computer (12) configured to analyze said request (6), the unit of authentication (11) being configured to generate a digital identity (Id1) using said characteristic information (5) and to associate said digital identity (Id1) with said characteristic information (5) in a document called authenticated document (2), a database of data (14) in which said computer (12) stores said authenticated document (2), the authentication unit (11) being configured to implement a one-way hash function having as input parameters said characteristic information s (5) and outputting said digital identity (Id1). Figure for the abstract: Fig 1

Description

Numeric identity

The present invention relates, in general, to the authentication of administrative documents.

More specifically, the invention relates to a system making it possible to create a digital identity on a document with probative value to verify the absence of modification of the data on copies of the document.

Prior techniques

Currently, documents such as identity cards, driving licenses, residence permits, etc. have information characteristic of the document stored on an element of the document which can be read to authenticate the information in relation to the document.

Among this information included on the document, there are generally text elements relating to certain civil status elements, possibly an image, etc.

However, these chips have a high cost and are therefore technically unsuitable for mass use on many document formats, for example on digital formats. In addition, they must have a duration of operation at least equal to the period of validity of the document in which they are contained, generally more than ten years as on a birth certificate.

In addition, the need to read the information contained on the chip for the authentication of the document can pose security problems, in particular disclosure or hacking, the sensitive information having to be protected as much as possible against attacks, in particular attacks aimed at to discover or modify the stored data.

With reference to the drawbacks mentioned above, the present invention relates to a system making it possible to improve and make the authentication of a document more reliable, and also making it possible to verify the conformity of a copy of the document with respect to the original. thanks to its digital identity, while remaining inexpensive to manufacture and usable on many media, including digital ones.

There is therefore proposed a system for generating an authenticated document, comprising input means comprising a screen for the input by a user of information characteristic of said authenticated document, means for transmitting a request comprising said characteristic information to a authentication unit having a computer configured to analyze said request, the authentication unit being configured to generate a digital identity using said characteristic information and to associate said digital identity with said characteristic information in an authenticated document, a database in which said computer records said authenticated document, the authentication unit being configured to implement a one-way hash function having said characteristic information as input parameters and delivering said digital identity as output, consisting of a digital key and info information contained in the document.

Advantageously, the input means comprise a mobile terminal able to collect the characteristic information via a dedicated software application.

Preferably, the transmission means are wireless transmission means and use the mobile terminal.

In one embodiment, the mobile terminal includes a mode for locking its use.

The software application can further be configured to query the database and communicate with the database through a telecommunications network.

Advantageously, one of the characteristic information items includes text.

Preferably, the input means comprise means for extracting from the database the characteristic information of the authenticated document and for displaying this information on a screen of the input means.

Advantageously, the digital identity includes a 2D code

In one embodiment, the input means comprise a memory and the software application is configured to save the request in said memory, the transmission means furthermore being capable of postponing the transmission to the authentication unit of said request previously recorded, for example until a connection of the input means to the telecommunications network.

The invention also relates to a method for verifying the conformity of a copy of an authenticated document with respect to said authenticated document, said authenticated document having a digital identity assigned beforehand thanks to an authentication system as defined above, comprising a step of inputting information characteristic of the copy using the input means, a step of establishing a verification request by the input means, said verification request comprising information characteristic of said copy, a step of transmitting of said verification request to the authentication unit by the transmission means, a step of analyzing said verification request by the computer of the authentication unit, a step of generating a verification identity by the one-way hash function from said characteristic information of said copy of the document, and a step of comparing on from the verification identity to the digital identity by the authentication unit.

Other aims, advantages and characteristics will emerge from the following description made with reference to the appended drawings in which:

illustrates the system according to the invention and its use for the authentication of a document; and

illustrates the use of the system according to the invention for checking a copy of a document against its original.

detailed description

As can be seen in Figure 1, the system 1 for generating an authenticated document 2 comprises input means 3 comprising a screen 4 and which allow a user to enter characteristic information 5 which can be found on the authenticated document 2. The characteristic information 5 is mainly text but may contain images, photographs, etc. The authenticated documents 2 which can be generated by the authentication system 1 have a known format for this type of document, for example a standard format. For example, the system 1 is used to create an authenticated document 2 corresponding to a document relating to the identity of its holder, such as an identity card, a residence permit, a driving license, a passport, etc. a travel document. In particular, the document to be authenticated can be of the birth, death, marriage certificate, residence certificate or any other administrative document. These types of documents are particularly subject to scanning and digital copies that can be fraudulently altered.

Thus, the input means 3 can be adapted to one or more specific document formats. An operator wishing to enter the characteristic information 5 for the generation of a document can then refer via the input means 3 to the category of document so as to have to enter information 5 of precise quantities and natures for the generation of the authenticated document. 2 in question.

By way of example, the input means 3 can comprise a computer interfaced to its user by a keyboard and a screen 4 which allow him to enter characteristic information 5.

The input of the characteristic information 5 makes it possible to establish a request 6 by the input means 3 which includes said characteristic information 5.

Advantageously, the input means 3 comprise a mobile terminal 7. An operator can thus, for example in the case of a census, go with his mobile terminal 7 to a remote location of a birth, observe the event and use the system 1 of the invention to directly issue a request 6 to establish an authenticated document 2 of birth certificate.

The mobile terminal 7 can include a mode for locking its use. Thus, the use of the mobile terminal 7 can be reserved for a group of operators who know how to unlock it, for example by a password. For example, the use of the mobile terminal 7 can be reserved for authorized official authorities, including for example sworn agents, of a member state of the Economic Community of West African States (ECOWAS).

The entry can be manual or at least partially automatic thanks to the entry means 3. The entry of at least certain characteristic information 5 can be carried out from a source document 8 which comprises characteristic information 5 to be entered. Such a source document 8 can be electronic or physical, for example printed. Thus, the input of textual characteristic information can be carried out by copying or else by recognition of a pre-existing text on a source document 8. For this purpose, the input means 3 may comprise means 9 for reading the source document 8 , associated for example with text recognition software. For example, the reading means 9 comprise a camera, which, with the screen 4 of the input means 3, is incorporated in the mobile terminal 7.

In addition, the document 2 obtained can include more information 5 than the source document(s) 8 used, the operator entering the information 5 being able, for example, to add the type of document, the name and the first name of the issuer , the civility, the address, an invoice number, a reference S0 of the issuing authentication unit 11, the place or the date of authentication of the document or of issue of its digital identity Id1, etc.

The system 1 can advantageously comprise means 10 for transmitting the request 6 to an authentication unit 11 via a telecommunications network of the Internet network type, preferably via a wireless Internet connection, or for example by Bluetooth™ technology.

Authentication unit 11 can be located on one or more remote servers. It comprises at least one computer 12 which uses for example a microprocessor. This computer 12 is able to analyze the request 6, that is to say to extract the characteristic information 5 therefrom to generate a unique digital identity Id1, from the characteristic information 5 of the request 6, and possibly from additional information such as for example a private key S0 which identifies the authentication unit 11. In order to guarantee the origin and the integrity of the document, the digital identity Id1 incorporates an electronic signature calculated on the hash of the data that it contains.

To this end, the generation of the digital identity Id1 comprises the implementation of a one-way function having as input parameters at least said characteristic information 5 of the first document and delivering said digital identity Id1 as output. The one-way function is for example included in a digital key certificate of the “server stamp” type known to those skilled in the art. The secure digital key used is notably composed of authentication, signature and encryption certificates, timestamp and code signing certificates, and server authentication and client authentication SSL certificates.

According to one embodiment, the computer uses a hash function making it possible to calculate the unique digital identity Id1 corresponding to the input parameters. Any cryptographically secure hash function can be used, for example the function known to those skilled in the art under the name SHA 256.

For example, the generated digital identity Id1 includes a code 13. The code 13 is intended to be carried by the authenticated document 2. It can be, for example, a 2D code or even a QR code. Advantageously, said code 13 comprises a 2D code, which, thanks to the one-way function, is unique with respect to the input characteristic information 5.

The computer 12 associates and saves said characteristic information 5 and the digital identity Id1 in one or more databases 14. The characteristic information 5 may be stored when filing the request intended to establish an authenticated document 2.

The mobile terminal 7 represented in FIG. 1 is a multifunction mobile telephone. In another embodiment, provision may also be made for the mobile terminal 7 to be a computer, a tablet or any other suitable, identified and authorized means, for reading the code 13 carried by the authenticated document 2.

Preferably, the mobile terminal 7 implements an embedded software application 15 for querying the database 14 which communicates with the database 14. The database 14 is in this respect incorporated into a telecommunications network.

The interrogation software application 15 is preferably encrypted and secure to limit access to the database 14 to authorized persons, for example offering a locking mode which only allows access to the use of the terminal 3 subject to identification which may include a user name and a password.

In addition, the input means 3 can comprise a memory 16 and the software application 15 is configured to save the request 6 in said memory 16, the transmission means 10 being further able to postpone the transmission to the processing unit. authentication 11 of said previously recorded request 6, for example until a connection of the input means 3 to the telecommunications network.

Advantageously, the means for generating digital identity Id1 are capable of assembling, in the intended format, said digital identity Id1 with the characteristic information to obtain an authenticated document 2. An authenticated document 2 can sometimes correspond exactly to a source document 8 on which is visibly added, for example on the first page of said document, its digital identity Id1.

In one embodiment, the system 1 further comprises recognition means 17 configured to read a digital identity Id1 and thus extract from the database 14 the characteristic information 5 of the previously authenticated document which corresponds to the digital identity Id1 read . The system 1 is then configured to display on a screen 4, for example coupled to the input means 3 or to the authentication unit 11, the characteristic information 5 extracted from the database 14. Furthermore, the recognition means 17 are chosen so as to be suitable for reading code 13.

For example, during a document authentication check, the code 13 carried by the document is read using recognition means 17 of the mobile terminal 7. The software application 15 provided on the mobile terminal 7 queries the database 14 of documents.

For example, the code 13 of the document 3, as well as its characteristic information 5 can be displayed on the screen 4 of the mobile terminal 7. Thus, a digital identity Id1 can, in this particular embodiment, give access to the characteristic information 5 corresponding to a digital identity Id1, which makes it possible to verify that a copy 18 of an authenticated document 2 includes the same characteristic information 5 as that associated in the database 14 with the digital identity Id1 visible on said copy 18.

Nevertheless, for the sake of information security, it is also possible, thanks to the system 1 of the invention, to check the conformity of information contained in a copy 18 of a document 2 authenticated by the same system 1, without having to read (nor risk compromising) the characteristic information 5 which corresponds to the digital identity Id1 of an authenticated document 2.

Indeed, such a verification method can be implemented for example in six steps as illustrated in Figure 2, using copy 18 as source document 8 in a new entry using the software application 15.

A first step 21 therefore allows the entry of the characteristic information 5 of the copy 18 thanks to the entry means 3.

It is followed by a step 22 of establishing a verification request 6 by the input means 3, said verification request 6 comprising the characteristic information 5 of said copy 18 entered in the first step 21.

Said verification request 6 is transmitted during step 23 to the authentication unit 11 by the transmission means 10 leads to a step 24 of analysis of said verification request 6 by the computer 12 of the unit authentication 11.

Step 25 enables the generation of a digital identity (called verification identity Id2) by the one-way hash function from said characteristic information 5 of said copy 18 of document 2. If no information 5 has been modified in the copy 18 compared to its original 2, the code 13 of the verification identity Id2 does not change.

Finally, a last step 26 compares the verification identity Id2 to the digital identity Id1 in the authentication unit 11.

Thus, in the example illustrated in FIG. 2, if the comparison of step 26 indicates that the digital identities Id1, Id2 of the original 2 and of the copy 18 are identical, it is certain, thanks to the one-way function used, that no information has been modified in the copy 18 which is therefore consistent with the authenticated document 2 original. An identity between the code 13 of the authenticated document 2 and any code generated from characteristic information 5 found in a copy 18 of said authenticated document 2 therefore makes it possible to certify the non-modification of said copy 18 and therefore to authenticate it. by transitivity. A difference between the two codes 13 makes it possible to alert on a probable modification of copy 18.

Advantageously, no particular resemblance is expected between the codes 13 generated by the system 1 for two very similar documents, whatever their degree of analogy, and preferentially a slight modification of the information of a document generates a code very distinct from the code of the unmodified document, the first code being for example immediately distinguishable by the human eye from the second.

The authenticated document 2 is thus no more expensive to produce than a conventional document without a system 1 for generating and assigning a digital identity. The code 13 can be secured and configured so as not to be read and used by standard recognition means 17, and to limit access to authorized persons.

Such a system 1 therefore facilitates the process of authenticating a document 8 and makes it possible to determine with great reliability whether a copy 18 of an authenticated document 2 actually conforms to the original.

Claims (10)

System (1) for generating an authenticated document (2), comprising:
- input means (3) comprising a screen (4) for the input by a user of characteristic information (5),
- transmission means (10) of a request (6) comprising said characteristic information (5) to an authentication unit (11) having a computer (12) configured to analyze said request (6), the unit d the authentication (11) being configured to generate a digital identity (Id1) using said characteristic information (5) and to associate said digital identity (Id1) with said characteristic information (5) in a document called authenticated document (2),
- a database (14) in which said computer (12) stores said authenticated document (2),
the authentication unit (11) being configured to implement a one-way hash function having as input parameters said characteristic information (5) and outputting said digital identity (Id1). System (1) according to Claim 1, in which the input means (3) comprise a mobile terminal (7) capable of collecting the characteristic information (5) via a dedicated software application (15). System (1) according to claim 2, wherein the transmission means (10) are wireless transmission means and use the mobile terminal (7). System (1) according to any one of claims 2 and 3, wherein the mobile terminal (7) includes a mode for locking its use. System (1) according to any one of claims 2 to 4, characterized in that the software application (15) is configured for querying the database (14) and communicates with the database (14) by a telecommunications network. A system (1) according to any preceding claim, wherein one of the characteristic information (5) comprises text. System (1) according to any one of the preceding claims, characterized in that the input means (3) comprise means for extracting from the database (14) the characteristic information (5) of the authenticated document (2) and to display this information on a screen (4) of the input means (3). System (1) according to any one of the preceding claims, in which the digital identity (Id1) comprises a 2D code (13). System (1) according to claim 8, wherein the input means (3) comprise a memory (16) and the software application (15) is configured to store the request (6) in said memory (16), the means transmission (10) being further able to postpone the transmission to the authentication unit (11) of said previously recorded request (6), for example until a connection of the input means (3) to the telecommunications network . Method for verifying the conformity of a copy (18) of an authenticated document (2) with respect to said authenticated document (2), said authenticated document (2) having a digital identity (Id1) assigned beforehand by means of a system ( 1) authentication according to any one of the preceding claims, comprising:
- a step (21) of entering characteristic information (5) of the copy (18) using the input means (3),
- a step (22) of establishing a verification request (6) by the input means (3), said verification request (6) comprising characteristic information (5) of said copy (18),
- a step (23) of transmitting said verification request (6) to the authentication unit (11) by the transmission means (10),
- a step (24) of analysis of said request (6) for verification by the computer (12) of the authentication unit (11),
- a step (25) of generating a verification identity (Id2) by the one-way hash function from said characteristic information (5) of said copy (18) of the document (2),
- a step (26) of comparing the verification identity (Id2) with the digital identity (Id1) by the authentication unit (11).