Method for generating at least one derived identity

The invention provides a method of generating at least one derived identity of an individual 1, the method comprising the following steps:

BACKGROUND OF THE INVENTION

Nowadays each individual is in possession of a certain number of a wide variety of “cards”, e.g. an identity card, a bank card, a Social Security card, etc., all of which may be characterized firstly by a function they perform, and secondly by means they use to recognize the individual. Thus, traditional identity cards enable individuals to prove their identities during checks, providing third parties making the checks recognize the individuals from photographs on the cards. Likewise, bank cards enable individuals to make purchases, providing the individuals are in a position to provide respective confidential codes associated with each bank card.

Proposals have also been made to replace conventional recognition means with biometric recognition means. A card is then provided with a chip containing previously acquired biometric data of the individual, which data is representative of a physical characteristic of that individual (fingerprints, retina or iris of an eye, etc.). When an individual presents such a card, the individual is recognized by acquiring that individual's biometric data once more and then comparing the acquired data with the data in the card. For example, a French biometric passport stores data representative of two fingerprints of an individual.

The advantage of biometric data in terms of recognition reliability and personal security is undeniable.

Proposals have also been made to use the biometric data present in a single card to perform a variety of functions or to access a variety of services. It is thus possible to envisage biometric data stored in an identity card enabling an individual to access various different public services, such as Social Security, tax authorities, etc. Once more, the advantage in terms of reliability of authentication and of simplifying the management of identification means cannot be disputed. Nevertheless, such an identity card would then constitute a unique identity vector giving access to that individual's data as associated with the use of a variety of different services, which can lead to problems relating to protecting people's personal data.

It would thus be particularly advantageous to succeed in using the biometric data for recognizing an individual in a manner that facilitates that individual gaining access to a service, while ensuring that it is not possible to identify the individual in question from data stored by the service supplier.

OBJECT OF THE INVENTION

An object of the invention is to respond to the above-raised problems.

SUMMARY OF THE INVENTION

In order to achieve this object, the invention provides a method of generating at least one derived identity of an individual, the method comprising the following steps:generating a first identifier from biometric data of the individual;defining a serial number associated with the individual;generating first check data for verifying consistency between the first identifier and the serial number; andconcatenating the serial number, the first identifier, and the first check data in such a manner as to form a first derived identity of the individual.

The derived identity of the individual as formed in this way may be associated by a service supplier with personal data of that individual. The service supplier can thus access the individual's personal data without storing the identity of that individual, and without being able to access that individual's biometric data.

The invention can be better understood in the light of the following description of a particular, non-limiting implementation of the invention.

DETAILED DESCRIPTION OF THE INVENTION

With reference toFIGS. 1 and 2, there follows a description of the method of the invention applied to an individual1, specifically a user1of the Social Security system in France, who needs to be able to access various services made available by Social Security, e.g. reimbursement of a medical expense. The user1has an identification medium, specifically a national identity card2having first processor means3and memory means4storing digital biometric data5of the user. The digital biometric data5in this example is representative of two of the user's fingerprints, and it was acquired and then stored in the identity card2when it was issued to the user1. It is thus possible, during any verification (police check, etc.), to verify the identity of the user in very reliable manner, by acquiring the user's fingerprints and comparing them with the biometric data5stored in the identity card2.

In addition to its prime function of providing identification, the identity card2is used to enable the user1to benefit from Social Security services, which requires the user1personally, or else a Social Security operative6(e.g. a civil servant), to have access to personal data7of the user, the personal data7including for example identification data, data concerning previous medical procedures, data relating to particular reimbursement conditions, etc. When the user1visits Social Security premises8, the biometric data5corresponding to the user's fingerprints is acquired and then compared with the data stored in the memory means4of the identity card2. By way of example, the premises8may include a reception terminal9having biometric acquisition means10enabling the user's fingerprints to be compared with the biometric data5in the identity card2. This acquisition and this comparison make it possible to verify that the user1who is present is indeed the legitimate bearer of the identity card2, thus making it possible to identify the user1in certain and reliable manner. It is specified at this point that the biometric acquisition means10are completely independent of other means of the reception terminal9and they do not transmit any data to Social Security.

The method of the invention begins with a step during which the first processor means3of the identity card2generate a first identifier id1from the biometric data5of the user1and from at least one derivation parameter as supplied by Social Security, and they transmit this first identifier id1to Social Security.

Specifically, the reception terminal9in the premises8includes is or connected to second processor means11. The second processor means11transmit to the identity card2: a first derivation parameter h1; a randomly defined second derivation parameter r1; and a third derivation parameter or modulus M. h1, r1, and M in this example are positive integers. The first processor means3of the identity card2then generates the first identifier id1, which is obtained using a trapdoor function. The term “trapdoor function” is used to designate a function that is relatively easy to calculate, but difficult in practice to invert. Specifically, the first identifier id1in this example is obtained by modular exponentiation. The first processor means define the first identifier id1as being equal to h1db.r1mod M, where db is a numerical value representative of the individual's biometric data. The purpose of this operation is to encrypt the biometric data, this encryption of the biometric data naturally being more effective with increasing size of the integers h1and r1.

The encrypted first identifier id1is then transmitted to the second processor means11. Only this first identifier id1is transmitted by the identity card2to Social Security, so Social Security has no access to the biometric data5of the user1.

The method of the invention then includes a step during which the second processor means11generate a serial number ns associated with the individual, followed by a step during which the second processor means11generate a digital key cln enabling them to recover the first, second, and third derivation parameters.

Thereafter, the method of the invention includes a step during which first check data ctrl1is generated that contains the result of a consistency check calculation (e.g. of the parity check, cross-redundancy check, etc., type) serving to verify consistency between the first identifier id1, the serial number ns, and the digital key cln.

Thereafter, the method of the invention includes a step during which a first derived identity ident1of the individual is generated. This first derived identity ident1in this example is the result of concatenating a first data field containing the serial number ns, a second data field containing the first identifier id1, a third data field containing the digital key cln, and a fourth data field containing the first check data ctrl1.

The first derived identity is thus presented in the following form:
ident1=ns∥id1∥cln∥ctrl1
where the symbol “∥” is used herein to mean “concatenated with”.

The first derived identity ident1is presented in the form of a succession of bits, with the number of bits naturally corresponding to the size of the data in each of the fields. The order in which the fields are arranged is naturally given purely by way of example.

The first derived identity ident1is associated by Social Security with the personal data7of the individual1. Thus, Social Security has storage means13suitable for co-operating with the second processor means11and storing the personal data of all of the users of Social Security, and in particular the personal data7of the user.

Just like the requirements for security and encryption reliability, the total number of bits that may be stored by the memory means4of the identity card2for Social Security service (given that the card might possibly be used in the same way by other services) may be a determining element in dimensioning both id1and ident1. By way of example, provision may be made to use six bits for the first identifier id1, six bits for the serial number ns, six bits for the digital key cln, and four bits for the check data ctrl1.

Advantageously, the method of the invention includes a step during which the second processor means11generate a second identifier trunc(id1), where this second identifier trunc(id1) is the result of an operation seeking to reduce the size of the fields making up the first identifier id1, and a step during which the second processor means11generate second check data ctrl2for verifying consistency between the second identifier trunc(id1), the serial number ns, and the digital key cln. A second derived identity ident2is then constituted by concatenating the serial number ns, the second identifier trunc(id1), the key cln, and the second check data ctrl2. The second derived identity ident2thus has the following form:
ident2=ns∥trunc(id1)∥cln∥ctrl2

The purpose of the second derived identity is described below.

This second derived identity ident2is supplied to the user1.

In addition to the second derived identity ident2, the second processor means11transmits to the individual a fourth derivation parameter h2such that h2=g2s2, where g2is a fifth derivation parameter and s2is a “private” sixth derivation parameter known to and stored by Social Security. The first processor means3of the identity card2then perform a modular exponentiation calculation so as to define a static identity idi such that idi=h2ident1mod M′, where M′ is a modulus for a purpose that is described below.

This static identity idi is stored in the memory means3of the identity card2.

Once the identity card2has been activated, at least with respect to its function associated with accessing Social Security services, the user1can obtain real access.

In the description below, a distinction is made between two kinds of access: access referred to as “manual access” during which the user accesses the desired service with the help of the Social Security operator6, and access referred to as “remote access” during which the user accesses the service remotely using remote communication means of the Internet or telephone network type.

During manual access, as shown inFIG. 3, the user visits Social Security premises8and provides the Social Security operator6with the second derived identity ident2. The operator6then manually inputs the second derived identity ident2into interface means, e.g. the reception terminal9, suitable for co-operating with Social Security's second processor means11. By using the second derived identity ident2, the second processor means11recover the first derived identity ident1, which identity is associated with the individual's personal data7. The personal data7can then be recovered from the storage means13, and used by Social Security or by the user while the user1is engaged in manual access.

During remote access by a user1, as shown inFIG. 4, where the user may for example be connected to the Social Security Internet site, the biometric data corresponding to the fingerprints of the user1is acquired and then compared with the data stored in the memory means of the identity card. This acquisition and this comparison are performed by biometric acquisition means14held by the user1, e.g. of the universal serial bus (USB) biometric reader type connected to a piece of equipment15(a computer, etc.) belonging to the user and connected to the Internet16. If the comparison is successful, the identity card2defines a random seventh derivation parameter r2that is characteristic of the present remote access. The identity card2also receives from Social Security an eighth derivation parameter c that depends on the transaction and/or the service provided by Social Security at the time of the transaction. Thereafter, the identity card calculates a third derived identity or dynamic identity ident3formed by a first identification term of the form a=g2r2and by a second identification term of the form b=h2(r2+c).ident1=idir2+c. The third derived identity ident3is recalculated on each remote access by the user. This dynamic third identity ident3is transmitted via the Internet16to Social Security and to the second processor means11. This third dynamic identity ident3is taken directly from the static identity idi and thus from the first derived identity ident1. In order to verify the integrity of the third derived identity ident3, the second processor means11verify that (a.g2c)s2.ident1=b. By using this third derived identity ident3, the second processor means11recover the first derived identity ident1that is associated with the personal data7of the individual1. This personal data7can thus be used by Social Security during access by the user1, and it may possibly be transmitted to the user1personally.

Thus, both for manual access and for remote access, a manual or derived identity is generated from the first derived identity ident1, either by Social Security (as for ident2), or by the card itself (as for ident3). These derived identities give access to the personal data7of the individual1without using any information specific to the real identity of the user1or to the user's biometric data5.

As a result, only the user1, with the help of the identity card2, is in a position to access the user's personal data7or to allow Social Security's processor means or an operator6to access that personal data, with it not being possible for the processor means or the operator6to identify the user from this personal data.

It may also be assumed that the State of France possesses biometric files with reliable links to the identities of individuals. In the event of a problem (e.g. suspected fraud or identity theft), Social Security can verify whether the individual who has access to the data is indeed the authorized individual.

The invention is not limited to the particular implementation described above, but on the contrary covers any variant coming within the ambit of the invention as defined by the claims.

Although the description makes use of the identity card as the document appropriate for co-operating with Social Security, it would naturally be possible to use some other identification medium, such as an electronic terminal, a mobile telephone, a passport, . . . , providing it contains biometric data of the individual.

Although the description refers to Social Security as being the sole service supplier with which the identity card is adapted to co-operate, it is naturally possible to make provision for the card to be capable of giving access to services from other suppliers.

Although it is stated that the first derived identity is the result of concatenating a first data field containing the serial number, a second data field containing the first identifier, a third data field containing the digital key, and a fourth data field containing the first check data, the first derived identity could perfectly well be formed by using not all of these data fields, but only some of these data fields.