Abstract:
The invention relates to electronic document security systems and in particular to user authentication and to the certification and secure transfer of sensitive document information of various type, like whole documents, certificates, signatures, stamps, etc., especially by verifying its correctness and safety/immunity from fraud.

Description:
FIELD OF THE INVENTION 
       [0001]    The invention relates to electronic document security systems and in particular to user authentication and to the certification and secure transfer of sensitive document information of various type, like whole documents, certificates, signatures, stamps, etc., especially by verifying its correctness and safety/immunity from fraud. 
       BACKGROUND OF THE INVENTION 
       [0002]    Current systems use stickers, thermal stamps and watermarks to safeguard against and to discover fraud, mostly by using the naked eye as a detector. The naked eye poses the problem that it is relatively unreliable so that many cases of fraud occur. 
         [0003]    Further, a conventional approach for securing transfer, verification and storage of sensitive data which uses smart cards is still rather costly. 
         [0004]    EP 1 688 891 describes an electronic certification and authentication system comprising a plurality of hierarchically structured modules which can be accessed by entering an enrolled identity and a corresponding passwords and/or a corresponding signature. Document information can be entered, certified, and saved in and, at a later date, read out from a system database by an authorized person. 
         [0005]    However, there still exists a need to improve certification, authentification, and transfer of sensitive information by more reliable and more economical means. 
       SUMMARY OF THE INVENTION 
       [0006]    According to the present invention, there are provided a system and a method for electronic certification and authentication as defined by independent claims  1  and  10 . 
         [0007]    Further advantageous features of the invention are defined in the dependent subclaims. 
         [0008]    According to a first aspect of the invention there is provided a system for electronic certification and authentication, comprising a main module, a first subordinate module, a database for storing personal data and biometric data, and a biometric device for capturing biometric data, wherein the main module is configured to: 
         [0000]    generate a first asymmetric key pair for encrypting and decrypting biometric data;
 
generate a second asymmetric key pair for encrypting and decrypting personal data; enroll a client for the first subordinate module by:
       capturing personal data of the client;   encrypting personal data of the client with a first key of the second asymmetric key pair;   storing the encrypted personal data of the client in the database;   capturing biometric data of the client by means of the biometric device;   encrypting the captured biometric data of the client with a first key of the first asymmetric key pair;   storing the encrypted biometric data of the client in the database; and   providing a client identity and a client password;
 
and wherein the first subordinate module is configured to:
   certify an identity of a client by:
           capturing biometric data of the client by means of the biometric device;   decrypting the biometric data of the client which is stored in the database with a second key of the first asymmetric key pair; and
 
comparing the biometric data captured by the biometric device with the decrypted biometric data stored in the database.
   
               
 
         [0019]    According to a second aspect of the invention, there is provided a method for electronic certification and authentication for use in a system comprising a main module, first subordinate module, a second subordinate module, a database for storing biometric data, and a biometric device for capturing biometric data; 
         [0000]    wherein the method comprises the following steps carried out by the main module:
 
generating a first asymmetric key pair for encrypting and decrypting biometric data;
 
generating a second asymmetric key pair for encrypting and decrypting personal data;
 
enrolling a client for the first subordinate module by:
       encrypting personal data of the client with a first key of the second asymmetric key pair;   storing the encrypted personal data of the client in the database;   capturing biometric data of the client by the biometric device;   encrypting the captured biometric data of the client with a first key of the first asymmetric key pair; and   storing the encrypted biometric data of the client in the database;
 
assigning a client password and a client identity to the client;
 
and wherein the method further comprises the following steps carried out by the first subordinate module:
 
certifying an identity of a client by:
   capturing biometric data of the client by means of the biometric device;   decrypting the biometric data of the client which is stored in the database with a second key of the first asymmetric key pair;
 
comparing the biometric data captured by the biometric device with the decrypted biometric data stored in the database.
       
 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0027]    In order that the invention may be more readily understood and put into practice, preferred embodiments of the invention will now be described with reference to the accompanying drawings, in which: 
           [0028]      FIG. 1  shows a simplified exemplary schematic diagram of a system according to an embodiment of the invention implemented in a communication network; 
           [0029]      FIG. 2  shows a simplified exemplary flowchart of steps carried out by a capturing plug-in module according to a further embodiment of the invention; 
           [0030]      FIG. 3  shows a simplified exemplary flowchart illustrating steps for verifying identity data offline; 
           [0031]      FIG. 4  shows a simplified exemplary flowchart illustrating steps for verifying an identity of a client and member, respectively, offline; 
           [0032]      FIG. 5  shows a simplified exemplary flowchart illustrating steps for verifying document data offline. 
       
    
    
       [0033]    It is understood that this exemplary description does not limit the scope of the invention. 
       DETAILED DESCRIPTION OF THE INVENTION 
       [0034]    The system according to the invention comprises a plurality of hierarchically structured modules. The embodiment shown in  FIG. 1  includes three hierarchically structured modules, main module  11 , first subordinate module  12 , and second subordinate module  13 , but other embodiments comprising four or more hierarchically structured modules are also possible. For example, the modules run on a server connected to a database  14 . A computer  21  is connected, e.g. by an internet connection with the server  10 . Further, the computer  21  is connected to a biometric device  22 , a scanner  23 , and a printer  24 . In  FIG. 1 , there is also shown a further computer  31 , which is connected to a further biometric device, a further scanner  33 , and a further printer  34 . However, the further computer  31  is not connected to the server  10  and is therefore also called “stand alone computer” in the following. 
         [0035]    The server  10  is preferably placed in a trusted environment (e.g. a trust center), as for example in the data centre of certification offices. 
         [0036]    The main module  11  updates its data by connecting to the database  14  and/or by connecting to one of the subordinate modules  12  and  13 . The main module  11  is preferably accessed by means of an internet browser plug-in from a computer having an internet browser installed. 
         [0037]    The process to use the system usually starts with an authorized person causing the main module to generate three asymmetric key pairs. A first asymmetric key pair will be used to certify biometric data of clients of the first subordinate module  12  and members of the second subordinate module  13 , respectively, a second asymmetric key pair will be used to authenticate identity data of clients and members, respectively, and a third asymmetric key pair will be used to authenticate document data. The system may generate these key pairs at the first time the system is used, but authorized persons may generate a new set of key pairs at a later time. Each key pair set may be assigned a name and a number which identifies the generation number of the respective set. 
         [0038]    As a next step, the authorized person may enroll a client for the first subordinate module  12  to grant a further person, the client, access to the first subordinate module  12 . In order to enroll a client for the first subordinate module  12 , personal data of the client is entered, encrypted with a first key of the second asymmetric key pair, and stored in the database  14 . Then, biometric data of the client is captured by the biometric device  22 , encrypted with a first key of the first asymmetric key pair, and stored in the database  14 . After storing encrypted identity data of the client, i.e. the encrypted personal and biometric data of the client, in the database  14  a client identity and password is assigned to the client for accessing the first subordinate module  12 . 
         [0039]    Further, a 2D barcode of the client identity data may be generated. 
         [0040]    A 2D barcode usually has bars placed on the horizontal and the vertical dimensions and is generated using a 2D barcode generation program which transfers information into bars form. To be able to transform longer documents in barcode form, the document information is compressed. 
         [0041]    For the 2D barcode of the client identity data, the personal data and the biometric data of the client are compressed and encrypted with a system generated random key, the system generated random key is encrypted with a first key of the second asymmetric key pair, and the 2D barcode is then generated from the encrypted system generated random key concatenated with the compressed personal and biometric data of the client. 
         [0042]    The 2D barcode serves as a sort of “certificate of authenticity” for confirming that the associated data of the client is authentic to the system. 
         [0043]    After generating the 2D barcode, a client identity card comprising the 2D barcode may be printed. 
         [0044]    The first subordinate module  12 , which preferably runs on the server  10  in a trusted environment, can be accessed by clients which have been enrolled for the first subordinate module  12  in two different ways: 
         [0045]    First, on the computer  21  which is connected, e.g. by an internet connection with the server  10 , the first subordinate module  12  may be preferably accessed by means of a plug-in for an internet browser which will be described in detail with reference to  FIG. 2 . The client then enters his client identity and password to be granted access to the first subordinate module  12 . 
         [0046]    Second, either on the computer  21  or on the “stand alone” computer  31 , the client may scan his client identity card by means of the scanner  23  and  33 , respectively, and enter his client password to be granted access to the first subordinate module  12 . 
         [0047]    The first subordinate module  12  may be used by a certified client to enroll a further person, a so-called member, for the second subordinate module  13 . 
         [0048]    To certify an identity of the client online, e.g. on the computer  21 , which is connected to the server  10 , biometric data of the client is captured by means of the biometric device  22  and biometric data of the client which is stored in the database  14  is decrypted with a second key of the first asymmetric key pair and, as last step, the biometric data captured by the biometric device  22  is compared with the decrypted biometric data stored in the database  14 . If the comparison is accepted the identity of the client is certified. 
         [0049]    Additionally or alternatively, the biometric data of the client captured by the biometric device  22  can be compared with the biometric data of the client stored on his client identity card. 
         [0050]    To enroll a member for the second subordinate module, personal data of the member are entered, encrypted with the first key of the second asymmetric key pair, and stored in the database  14 . Then, biometric data of the member is captured by the biometric device  22 , encrypted with the first key of the first asymmetric key pair, and stored in the database  14 . After storing encrypted identity data of the member, i.e. the encrypted personal and biometric data of the client, in the database  14  a member identity and password is assigned to the member for accessing the second subordinate module  13 . 
         [0051]    Further, a 2D barcode of the member identity data may be generated: The personal data and the biometric data of the member are compressed and encrypted with a system generated random key, the system generated random key is encrypted with the first key of the second asymmetric key pair, and the 2D barcode is then generated from the encrypted system generated random key concatenated with the compressed personal and biometric data of the member. After generating the 2D barcode, a member identity card comprising the 2D barcode may be printed. 
         [0052]    The second subordinate module  13 , which preferably runs on the server  10  in a trusted environment (but which can also run on a further server or computer connected to the server  10 ) can be accessed by members enrolled for the second subordinate module  13  in two different ways: 
         [0053]    First, on the computer  21  which is connected, e.g. by an internet connection with the server  10 , the second subordinate module  13  may be preferably accessed by means of the internet browser plug-in. The member enters his member identity and password to be granted access to the second subordinate module  13 . 
         [0054]    Second, either on the computer  21  or on the “stand alone” computer  31 , the member may scan his member identity card by means of the scanner  23  and  33 , respectively, and enter his member password to be granted access to the second subordinate module  13 . 
         [0055]    The second subordinate module  13  may be used by a member to authenticate data and print the data or authorize a further member to print the data. 
         [0056]    As first steps, document data may be entered and uploaded, respectively, and an identity of the member has to be certified. 
         [0057]    To certify the identity of the member online, e.g. on the computer  21 , which is connected to the server  10 , biometric data of the member is captured by means of the biometric device  22 , and biometric data of the member which is stored in the database  14  is decrypted with the second key of the first asymmetric key pair, and the biometric data captured by the biometric device  22  is compared with the decrypted biometric data stored in the database  14 . If the comparison is accepted the identity of the member is certified. 
         [0058]    Additionally or alternatively, the biometric data of the member captured by the biometric device  22  can be compared with the biometric data of the member stored on his client identity card. 
         [0059]    Then, the certified member can cause the second subordinate module  13  to generate a document 2D barcode for document data. Thereupon, the second subordinate module  13  generates a data hash code from the document data, encrypts the data hash code with a first key of the third asymmetric key pair, compresses the document data, and generates the document 2D barcode from the encrypted hash code concatenated with the compressed document data. 
         [0060]    Subsequently, the certified member can print the document data together with the generated document 2D barcode or can authorize a further member to print the document data together with the generated document 2D barcode by assigning a member identity and password to the further member. 
         [0061]    Some of the functionalities of the system  10 , which are often used, may be implemented as separate modules, which may be called by the main module or one of the subordinate modules. This is especially advantageous for systems comprising a plurality of subordinate modules. 
         [0062]    For example, the functionalities of enrolling a client, member and/or user for a further subordinate module and/or of certifying an identity of a client, member of a further subordinate module may be implemented as respective modules. 
         [0063]    As mentioned before, the computer  21  is connected to the server  10 , preferably by an internet connection. For this purpose, a plug-in module may be implemented in the computer  21  of a client/member to secure transfer of sensitive data (especially captured biometric data), between the server  10 , the computer  21 , and the biometric device  22 . 
         [0064]    The steps carried out by the plug-in module are illustrated, by way of example, for the process of capturing biometric data online, in the simplified flowchart of  FIG. 2 : 
         [0065]    Before using the plug-in module for the first time, a client/member downloads,  200 , the signed plug-in module with a signed first asymmetric key pair from the server  10  and installs it on e.g. computer  21 . The client/member requests,  201 , the server  10  to send a server time stamp to the plug-in module. The plug-in module checks,  202 , its own signature. If it is ok, the client/member can transfer,  203 , biometric data captured by the biometric device  22  to a trusted memory (TM) by means of the plug-in module. TM can be encrypted memory, a trusted platform module or protected memory and may be part of the database  14 . The plug-in module generates,  204 , a random symmetric key and stores it in the TM. The plug-in module encrypts,  205 , the captured client/member biometric data and the server time stamp with the symmetric key. The plug-in module reads and stores,  206 , the first asymmetric key pair in the TM. The plug-in module checks,  207 , the signature of the first asymmetric key pair. If it is ok, the plug-in module encrypts,  208 , the symmetric key with the first asymmetric key pair. The plug-in module sends,  209 , all the encrypted data to the server  10 . The server  10  decrypts,  210 , the symmetric key with the first asymmetric key pair and decrypts,  210 , the biometric data and the server time stamp with the symmetric key. The server  10  finally checks,  211 , the server time stamp and if it is ok, accepts the biometric data captured by the biometric device  22 . 
         [0066]    Though the functionality of the plug-in module has been exemplarily illustrated for the process of capturing biometric data online, the plug-in module may certainly be used for secure transfer of any kind of sensitive data. 
         [0067]      FIG. 3  refers to an example of a separate module having a special functionality, the certification of document and/or identity data. In  FIG. 3 , a simplified exemplary flowchart illustrating steps for providing a certificate of authenticity for data entered or uploaded on a document or an identity card. 
         [0068]    If data is entered for a document a 2D barcode is generated,  301 , from the hash code of the data, the hash code is encrypted,  302 , with a document private key, the data is compressed,  303 , and a hash code is generated,  304 , from the encrypted hash code and the compressed data. 
         [0069]    If data is entered for an identity card the identity data is compressed,  311 , encrypted,  312 , with a symmetric key randomly generated, the symmetric key is encrypted,  313 , with an identity private key, and a 2D barcode is generated,  314 , from the encrypted symmetric key and the encrypted compressed data. 
         [0070]    The 2D barcode respectively serves as a “certificate of authenticity” which marks the associated data as authentic to the system and created by a certified client/member. 
         [0071]    The system shown in  FIG. 1  further provides a facility to verify document data and identity data of clients and members offline on the “stand-alone” computer  31 . 
         [0072]      FIG. 4  shows a simplified exemplary flowchart illustrating steps for certifying identity data offline carried out by a offline verification module implemented in the computer  31 . First, a printed 2D barcode comprising client/member identity data, i.e. personal and biometric data of the client/member, is scanned by means of the scanner  33  and read out,  401 , for example from a client/member identity card, and the client/member enters,  402 , his password. Then, the second asymmetric key pair, also referred to as “identity public key”, is decrypted  403  with the client/member password, if necessary, i.e. if the identity public key has been encrypted with the client/member password before. The encrypted system generated random key is decrypted,  404 , with the second key of the second asymmetric key pair and the decrypted system generated random key is used for decrypting the identity data and the decrypted identity data which comprises the biometric data of the client/member is decompressed,  405 . 
         [0073]    Additionally, biometric data of the client/member to be certified is captured,  406 , by means of the biometric device  32  connected to the computer  31 . 
         [0074]    To certify the identity of the client/member, the biometric data from the 2D barcode of the e.g. identity card of the client/member is compared,  407 , with the biometric data of the client/member captured by means of the biometric device  32 . If the comparison is acceptable,  408 , the identity of the client/member is certified offline,  409 . 
         [0075]      FIG. 5  shows a simplified exemplary flowchart illustrating steps for verifying document data carried out offline by the offline verification module or a further separate module implemented in the computer  31 . First, a document 2D barcode is scanned by means of the scanner  33  and read out,  501 , for example from a print-out comprising document data and the corresponding document 2D barcode. Then, the encrypted hash code is decrypted,  502 , with a second key of the third asymmetric key pair (also referred to as “system public key”), the data is decompressed,  503 , and a hash code is generated,  504 , from the decompressed data. Thereafter, the just generated hash code is compared,  505 , with the decompressed hash code. If both hash codes match,  506 , the document data can be displayed,  507 , for verification purposes.