WO2023122810A1

WO2023122810A1 - Method for checking the authorization of a person

Info

Publication number: WO2023122810A1
Application number: PCT/AT2022/060443
Authority: WO
Inventors: Bernhard KRÜPL-SYPIEN
Original assignee: Kruepl Sypien Bernhard
Priority date: 2021-12-30
Filing date: 2022-12-15
Publication date: 2023-07-06
Also published as: AT525780A1

Abstract

The invention relates to a method for checking the authorization of a person, said method having the following steps: • a) providing identity data of a person, said identity data being checked for authenticity, and generating a signed first 2D code, wherein the first 2D code contains first person-specific data, and the person-specific data contains biometric information relating to the person, • b) storing a credentials document assigned to a person in a database and/or a software application and generating a corresponding second 2D code, said 2D code containing information relating to the authorization of a person and second person-specific data of said person, • c) requesting the first and second 2D code, • d) visually producing the first 2D code and the second 2D code, • e) visually reading the first and second 2D code and analyzing the data stored in the first and second 2D code, and • f) outputting the result of the analysis according to step e).

Description

Procedures for verifying an individual's eligibility

The invention relates to a method for checking a person's authorization.

In order to prevent the spread and to contain pandemics, there has been a need to attach criteria to the authorization of a person, e.g. with regard to entry or access to certain events and/or locations. Especially in connection with the Covid-19 pandemic, entry eligibility criteria were created that require the submission of a negative infection test or the existence of immunization as a result of recovery from an infection or at least a vaccination. Other applications also rely on the existence of an authorization, such as picking up a physical package from a collection point, making or receiving payments, etc.

There is therefore a need for an automated, secure method in order to be able to prove and check the existence of authorizations.

For this purpose, a method was created which, according to the invention, comprises the following steps: a) providing authenticity-checked identity data for a person and creating a signed first area code, the first area code containing first person-specific data which are derived from the identity data, the first person-specific data containing biometric information about the person, b) depositing an authorization document assigned to a person in a database and/or a software application and generating an associated second area code, the second area code containing information on the authorization of a person and second person-specific data of this person, c) retrieving the first and second area code by a software application, d) visual presentation of the first area code and the second area code by a display device controlled by the software application according to step c), in particular a smartphone, e) visually reading out the first and second area code using a reading device and evaluating the data stored in the first and second area code

*Comparison of the derived first and second personal data, as well as

*Checking the information about the authorization, f) outputting the result of the evaluation according to step e).

By linking two area codes, the method according to the invention creates a particularly efficient, automatable and at the same time secure option for presenting an authorization. The biometric information about the person can in principle be any technically suitable proof. A fingerprint, a photo, or e.g. theoretically an iris scan of the person requesting/presenting an authorization is particularly suitable for this purpose. The result according to step f) can be output by the readout device, for example. Steps a) and b) can also take place in reverse order or at the same time. As already mentioned at the outset, the authorization can in principle be any type of authorization.

The first area code can be signed, for example, with a private key of an asymmetric RSA or EdDSA key pair. The term "proof of entitlement document" is not necessarily understood to mean a written document in the narrow sense, but can basically be any formatted data record such as a JSON. The "proof of entitlement document" can also be a finished QR code or its content , which was taken over by a third party. Scanners and computers, smartphones, etc. are suitable as reading devices. For the sake of completeness, it should be mentioned that additional area codes can of course also be displayed and the invention is therefore not restricted to the display of just two area codes. Several authorization codes can also be stored. The eligibility can then be determined by applying rules to all codes, e.g. in the case of a corona restriction that requires the existence of a valid vaccination/recovery and a PCR test ("2G-plus"), different area codes can be used for these aspects be that then can be checked one after the other or together. Unless explicitly requested, the databases and/or software applications mentioned can be configured independently of one another. As an alternative to this, individual or all aspects can also be combined to form a whole.

In particular, it can be provided that the biometric information about the person according to step a) comprises at least a partial section of an identity photo of the person and information on this is encoded in the first area code according to step a), with step d) also being derived from the first area code representation of the identity photo is presented visually. The information, which is encoded in the first area code, can also contain a link to an identity photo, which is then retrieved from the display device or from the reading device. It can also be provided that if the first and second personal data match and the existence of an authorization is determined according to the evaluation according to step e), the appearance of the person presenting the authorization is compared with the depiction of the identity photo derived from step e). and if the person's appearance matches the identity photo, the authorization is recognized, in particular access to a secure area is granted. This could be a bar or a festival site, for example. The appearance check can, for example, be carried out manually by an inspector or automatically through face recognition.

In particular, it can be provided that the biometric information about the person according to step a) comprises a fingerprint and/or a scan of the iris of an eye of the person and information about this is encoded in the first area code according to step a) and read out in step e). If a match between the first and second person-specific data and the existence of an authorization is determined according to the evaluation according to step e), a comparison of the fingerprint and/or the iris of the eye of the person presenting the authorization with that read out in step e). biometric information takes place, and if they match, the authorization is recognized, in particular access to an access-secured area is granted.

Furthermore, it can be provided that the provision of authenticated identity data according to step a) takes place on the basis of the following steps: -) Storing a personal profile assigned to a person in a database and/or a software application, the personal profile comprising the first person-specific data containing biometric information about the person, and

-) Checking the authenticity of the personal profile using a check algorithm.

The authenticity check can, for example, be carried out simply by only recognizing certain confidential sources as data sources, such as databases from state-certified institutions. For example, the public sector could operate the system and obtain personal data and personal photos from the e-card database. In addition or as an alternative to this, the presence of certain authenticity features can also be checked. The authenticity check can be carried out, for example, using computer vision methods such as analyzing the background noise in various areas, sharpness detection, copy-move detection, font change detection, document classification with or without machine learning, by evaluating check numbers present in the document and/or by analyzing metadata. The personal profile can be provided in the form of a photo of an official photo ID, with the photo representing the biometric information and the photo ID shown being subjected to an authenticity check.

In particular, it can be provided that the personal profile includes a visual representation of an official photo ID, with this photo ID being subjected to an authenticity check.

Furthermore, it can be provided that the visual area codes according to step e) are displayed simultaneously next to or one above the other.

In particular, it can be provided that the visual area codes according to step e) are displayed one after the other. The area codes preferably alternate in a recurring manner, in such a way that a flashing impression is created: first, for example, the first area code is displayed, then the second, then the first again, followed by the second area code. In this way, a quick and reliable evaluation can be carried out despite the small display area/scan area of the devices involved. The duration of the display is typically a compromise between maximum processing speed and support for as many older scanning devices (mobile phones) as possible. Currently one Display duration per area code of approx. 200ms selected, with newer devices a display duration of 20ms also works without any problems. The display duration can also be set variably, for example using a slider to adjust the speed. It would also be conceivable for the display duration of each area code to increase automatically in the course of the iterations up to a recognition, until the display is canceled by a user. The display function can be stopped manually, for example.

Provision can also be made for the visual area codes to be displayed alternately, in such a way that each area code uses at least 70% of the screen width/display width and/or height of the display device during the time it is displayed. This makes the area codes particularly easy to read.

The invention is explained in more detail below using an exemplary and non-limiting embodiment illustrated in the figures. In it shows

Figure 1 shows a schematic representation of individual elements of the invention,

FIG. 2 shows a schematic representation of application scenarios of the method according to the invention,

FIG. 3 shows an exemplary flowchart for a first group

application scenarios, and

FIG. 4 shows an exemplary flowchart for a second group

application scenarios.

Unless otherwise stated, the same reference symbols designate the same features in the following figures.

1 shows a schematic representation of individual elements of the invention. The invention relates to a method for checking the authorization of a person 2 (or a further person 2x, see FIG. 2), the method comprising the following steps: a) Providing authenticity-checked identity data 2a of a person 2 and creating a signed first area code Fl, the first area code Fl containing first person-specific data Flpd which are derived from the identity data 2a, the first person-specific data Flpd containing biometric information Flbm about the person 2 , b) depositing a proof of authorization document 4 assigned to a person 2, 2x in a database 3 and/or a software application and generating an associated second area code F2, the second area code F2 containing information F2B on the authorization of a person 2 (or possibly another person 2x ) and second person-specific data F2pd of this person 2 or 2x, c) retrieval of the first and the second area code Fl and F2 by a software application 5, d) visual presentation of the first area code Fl and the second area code F2 by means of the software application 5 display device 1 controlled according to step c) (see FIG. 2), in particular a smartphone, e) visual reading of the first and second area codes F1 and F2 by a reading device 6 and evaluation of the data stored in the first and second area codes F1 and F2

*Comparison of the derived first and second person-specific data Flpd and F2pd, as well as

*Examination of the information F2B on the authorization, f) Output of the result of the evaluation according to step e).

FIG. 2 shows a schematic representation of application scenarios for this method according to the invention. The person 2 stores, for example, an area code F1 assigned to their identity data 2a in a software application. If a proof of authorization of a person other than person 2, namely person 2x, is stored in the software application in the form of area code 2 and displayed for verification, the method according to the invention determines in step e) that the area codes F1 and F2 derivable person-specific data Flpd and F2pd do not match. There is therefore no proof of the authorization of person 2. If, on the other hand, an authorization document 4 that is actually correctly assigned to this person 2 is subsequently imported into the software application by the person 2, then the person-specific data Flpd and F2pd match. In a further aspect of step e), it is then checked whether the authorization document 4 itself is valid or whether the authorization status specified therein (eg Covid-vaccinated/recovered and/or PCR-tested) corresponds to the requirements of the respective requirement. If this is the case, the positive result can be output in a step f). Finally, a person 7 checking the authorization can also determine whether the person who shows the consistent area codes F1 and F2 is actually the person 2 to whom these area codes F1 and F2 are assigned. This can be done by checking the biometric features Flbm stored at least in the first area code F1 (see FIG. 1). In the example according to FIG. 2, this is an identity photo 2a′, which is displayed at least in part and can be compared by an examining person 7 with the appearance of the person presenting it. It is also conceivable that the biometric features Flbm only relate to a partial section of an identity photo (in order to reduce data and not to overload the data capacity of the area code), with the identity photo being stored separately in a software application or downloaded, with a match in the biometric features Flbm stored information such as an image section with the complete identity photo 2a 'is automatically checked and only then the identity photo is also displayed. It can thereby be ensured that the presenting person is actually the authorized person 2 .

In other words, it can be provided that if the first and second person-specific data Flpd and F2pd match and there is an authorization according to the evaluation according to step e), a comparison of the appearance of the person 2, 2x presenting the authorization with that from step e) derived representation of the identity photo 2a' takes place and if the appearance of the person 2, 2x matches the identity photo 2a', the authorization is recognized, in particular access to an access-secured area is granted.

The biometric information about the person 2 according to step a) can, in addition or as an alternative to the photo 2a' or a section of a photo, be a fingerprint and/or a scan of the Covering the iris of one eye of the person 2. Information on this can be encoded in the first area code Fl according to step a) and read out in step e), wherein if the first and second person-specific data Flpd and F2pd are found to match and the existence of an authorization according to the evaluation according to step e), the fingerprint and/or the iris of the eye of the person 2 and 2x presenting the authorization is compared with the biometric information read out in step e), and if they match, the authorization is recognized, in particular access to an access-secured area is granted.

Furthermore, it can be provided that authenticity-checked identity data 2a is provided according to step a) on the basis of the preceding following steps: storing a person profile 8 assigned to a person 2 (see FIG. 1) in a database 3 and/or a software application, the person profile 8 includes the first person-specific data Flpd containing biometric information about the person 2, and authenticity check of the person's profile 8 by using a check algorithm. In particular, provision can be made for the personal profile 8 to include a visual representation of an official photo ID 9, with this photo ID 9 being subjected to an authenticity check.

In principle, the visual area codes F1 and F2 according to step e) can be displayed simultaneously next to or one above the other. However, if it is advantageous for a sufficiently large display to utilize the available display area of a display device 1 largely completely with a single area code, it can be advantageous if the visual area codes F1 and F2 according to step e) are displayed one after the other. In particular, it can be provided that the visual area codes F1 and F2 are displayed alternately in such a way that each area code F1, F2 uses at least 70% of the screen width or height of the display device 1 during the time it is displayed.

FIG. 3 shows an exemplary flow chart for a first group of application scenarios of the method according to the invention. An application is started therein, with the area codes being scanned one after the other. If the person-specific data Flpd and F2pd do not match, it can be concluded that the wrong person has authorization. However, this data is correct match, the existence of an F2B authorization can be checked in a further step. Incidentally, it should be mentioned that the existence of authorization can also be checked first; this order can generally be freely selected. If there is no authorization, the process is aborted and a negative result is output. If, on the other hand, there is an authorization, then finally the identity of the person identifying himself or herself can be checked against the biometric data Flbm derived from the first area code F1. If this test is successfully completed, an authorization or associated consequences can be granted.

In addition to the processes mentioned above, FIG. 4 also shows a scenario in which no area codes are displayed. If no area code F1 or F2 exists, the method can of course be aborted. FIG. 4 also shows that the scanned area codes F1 and/or F2 can be checked for the presence of a signature, which makes it possible to identify a forgery of the area codes. This is followed by a comparison of the two or more area codes Fl to Fn, with definable release rules being applicable, which can also be specified by a third party such as an event organizer or an external software application. Finally, the personal identification already described can take place. If all of these test steps are successfully completed, authorization is given and a planned sequence can be linked to it.

The invention is not limited to the embodiments shown but is defined by the full scope of the claims. Individual aspects of the invention or the embodiments can also be taken up and combined with one another. Any reference signs in the claims are exemplary and only serve to make the claims easier to read, without limiting them.

Claims

PATENT CLAIMS

1. A method for checking an authorization of a person (2, 2x), the method comprising the following steps: a) providing authenticity-checked identity data (2a) of a person (2) and creating a signed first area code (Fl), the first area code (Fl) contains first person-specific data (Flpd) which are derived from the identity data (2a), the first person-specific data (Flpd) containing biometric information (Flbm) about the person (2), b) depositing a person (2 , 2x) associated proof of authorization document (4) in a database (3) and / or a software application and generating an associated second area code (F2), wherein the second area code (F2) information (F2B) on the authorization of a person (2, 2x) and second personal data (F2pd) of this person (2, 2x), c) retrieving the first and the second area code (Fl, F2) by a software application (5), d) visual presentation of the first area code (Fl) and the second Area codes (F2) by a display device (1), in particular a smartphone, controlled by the software application (5) according to step c), e) visual reading of the first and second area codes (Fl, F2) by a reading device (6) and evaluation of the in the data stored in the first and second area code (F1, F2).

*Comparison of the derived first and second person-specific data (Flpd, F2pd), as well as

*Checking the information (F2B) on the authorization, f) Output of the result of the evaluation according to step e).

2. The method according to claim 1, wherein the biometric information about the person (2) according to step a) comprises at least a partial detail of an identity photo (2a ') of the person (2) and information about this in the first area code (F1) according to step a) be encoded, where in step d) a representation of the identity photo (2a') derived from the first area code (F1) is also presented visually.

3. The method according to claim 2, wherein if the first and second person-specific data (F1pd, F2pd) match and the existence of an authorization is determined according to the evaluation according to step e), a comparison of the appearance of the person presenting the authorization (2, 2x) with the representation of the identity photo (2a') derived from step e) and if the appearance of the person (2, 2x) matches the identity photo (2a'), the authorization is recognized, in particular access to an access-secured area is granted.

4. The method of claim 1, wherein the biometric information about the person (2) according to step a) includes a fingerprint and / or a scan of the iris of an eye of the person (2) and information about this in the first area code (Fl) according to step a) are encoded, and are read out in step e), in the event that a match is found between the first and second person-specific data (Flpd, F2pd) and the existence of an authorization according to the evaluation according to step e), a comparison of the fingerprint and/or the iris of the eye of the person presenting the authorization (2, 2x) with the biometric information read out in step e), and if they match, the authorization is recognized, in particular access to an access-secured area is granted.

5. The method according to any one of the preceding claims, wherein authenticity-checked identity data (2a) according to step a) is provided on the basis of the preceding following steps:

-) Storing a personal profile (8) assigned to a person (2) in a database (3) and/or a software application, the personal profile (8) comprising the first personal data (Flpd), the biometric information about the person (2) included, and

-) Checking the authenticity of the personal profile (8) by using a check algorithm.

6. The method according to claim 5, wherein the personal profile (8) comprises a visual representation of an official photo ID (9), this photo ID (9) being subjected to an authenticity check.

7. The method according to any one of the preceding claims, wherein the visual area codes (F1, F2) according to step e) are displayed simultaneously next to or one above the other.

8. The method according to any one of claims 1 to 5, wherein the visual area codes (F1, F2) according to step e) are displayed one after the other.

9. The method according to claim 8, wherein the visual area codes (F1, F2) are displayed alternately in such a way that each area code (F1, F2) covers a screen width or height of the display device (1) by at least 70% during the period of its display. exploits.