WO2012101389A1

WO2012101389A1 - Biometric identity verification system using a success signal and interacting with a portable object

Info

Publication number: WO2012101389A1
Application number: PCT/FR2012/050175
Authority: WO
Inventors: François Grieu; André AMPELAS
Original assignee: Spirtech
Priority date: 2011-01-28
Filing date: 2012-01-27
Publication date: 2012-08-02
Also published as: FR2971109B1; MX2013008675A; EP2668738A1; BR112013018631A2; FR2971109A1

Abstract

The invention relates to a system including: a subsystem (100) for the biometric verification of the identity of a first person, and a portable object (300) which is carried by a second person and which can be temporarily coupled to the biometric verification subsystem. According to the invention, a success signal (202) is selectively activated when the biometric verification is successful and when the authenticity of the biometric verification subsystem has been confirmed by a cryptographic protocol implemented between the portable object and a coupler (250), a microcircuit (207) and a secret datum (206). The signal can be activated directly by the portable object and/or can comprise a feature (text, melody, etc.) such that observation of said signal by the second person is a guarantee that the secret datum (206) matches a reference datum (306) previously stored in the portable object, and therefore that the identity of the first person is validly verified. A subsequent financial transaction can be selectively authorised in the event of success.

Description

Biometric identity verification system with a success signal cooperating with a portable object

The invention relates to biometric systems for verification of identity, where a physical characteristic of a person is automatically compared to a reference to verify his identity.

In such systems, a sensor acquires data representative of a physical characteristic of an individual, the resultant data is compared to a reference datum, and the individual is authenticated if the two data have sufficiently similar characteristics. Such systems, for example based on the characteristics of finger dermatoglyphs, commonly referred to as "fingerprints", have been known for a long time, for example according to US 4 151 5 2 A.

WO 2009/097604 A1 discloses a biometric system capable of being temporarily coupled to another system and selectively providing it with certain information in the event of successful authentication (and also a biometric system in which graphic information is disclosed or hidden according to the result of the authentication).

The WO 2010/022129 A1 describes a biometric system integrated into an identification card that can be temporarily coupled to a terminal, such that the success of the authentication is necessary for the activation of the functions of the card, and therefore its use.

WO 2005/096214 A1 discloses a biometric system integrated into an identification card that may be temporarily coupled by radio to another device subject to successful authentication.

WO 2008/137206 A1 describes a biometric system integrated into an RFID transponder provided with a memory that can be accessed by this means subject to successful authentication.

US 7,360,688 B1 as well as EP 1 840 788 A2 describe a biometric system of which at least the sensor is integrated in an identification card that can be temporarily coupled to a terminal (without precise indication of what is produced by the device). authentication).

The implementation of such systems poses a challenge when it comes to providing proof of the identity of a first individual to a second individual who does not hold the biometric verification system. The problem is in particular the recognition of true taxi drivers, police officers, public services, or, more generally, "authorized" or "accredited" personnel.

This may be useful in many applications where currently known biometric identity verification systems are not usable.

Such a need exists, given the growing feeling of insecurity, the aging of the population, that many assaults are perpetrated by usurpation of appearance.

A particular example is the situation encountered when a customer rides a taxi. The customer is supposed to check that the taxi in which he rides is operated by a driver holding a valid license, based on a plate attached to the vehicle and / or a driver's authorization card. This is sometimes insufficient: these elements of identification are difficult to verify, may be counterfeit, or be stolen from their legitimate holder, for example with the vehicle, in order to strip the customers of this fake taxi with the complicity of the false driver. In some cities the problem is so acute that various embassies (France, USA, ...) indicate: "In town, it is strongly discouraged to hail a taxi at random and to borrow free taxis".

If the driver used a conventional biometric system to prove his identity to the customer, the risk would be that a device of identical appearance is used by a false driver and gives false assurance to the customer that the driver holds a valid license.

The invention proposes, essentially, to solve this difficulty by completing the biometric verification system of the identity by a success signal of a nature to bring the proof to the second individual (the person requesting the verification) that the identification of the first individual (that which is the object of the verification) is validly carried out, this signal of success cooperating with a portable object held by the second individual and in which he can have confidence. It could possibly be a pre-existing secure portable object such as transport card, passport or contactless identity card, mobile phone, etc.

In a particular mode of implementation of the invention, the customer will see for example a sentence he has chosen, from a card he holds, displayed on the housing performing the biometric authentication, the system of the invention ensuring that this is possible only if the identity of the driver has been validly verified.

The system of the invention can also validate a flow of the race by means of electronic money, which reduces the risk of aggression of the driver by an unscrupulous customer, since the latter has no way to recover the dematerialized currency held by the chauffeur.

More specifically, the invention proposes a biometric system for verifying identity of the general type disclosed by the aforementioned WO 2009/097604 A1, that is to say comprising:

a biometric verification subsystem of the identity of a first individual;

a portable object that can be temporarily coupled to the biometric verification subsystem;

means for selectively issuing a success signal under the condition that: i) the biometric verification succeeds; and ii) that the authenticity of the biometric verification subsystem has been ensured by a cryptographic protocol between the biometric verification subsystem and the portable object. ; and

means for reproducing in a visual or auditory form the success signal perceptibly by a second individual.

Characteristically, the invention

the biometric verification subsystem is held by the first individual and the portable object is held by the second individual;

the means for selectively delivering a success signal are means included in the biometric verification subsystem;

the cryptographic protocol is a protocol capable of producing a result determining a characteristic of the success signal and representative of the concordance between a secret datum and a datum contained in the portable object; and

the means for restoring in visual or auditory form the success signal are means controlled by a circuit of the biometric verification subsystem held by the first individual, so that the perception of this signal by the second individual assures him that the identity of the first individual is validly verified. The invention also relates to a biometric method for verifying the identity of a first individual by a second individual, comprising the following steps:

a) providing the first individual with a biometric verification subsystem;

b) providing the second individual with a portable object;

c) temporary coupling of the portable object to the biometric verification subsystem;

(d) performing (i) a biometric verification and (ii) verifying the authenticity of the biometric verification subsystem by a cryptographic protocol between the biometric verification subsystem and the portable object;

(e) by the biometric verification subsystem, selective issuance of a successful success signal: (i) a biometric verification and (ii) a verification of the authenticity of the biometric verification subsystem by a cryptographic protocol between it and the portable object,

this cryptographic protocol being a protocol capable of producing a result determining a characteristic of the success signal and representative of the concordance between a secret datum and a datum contained in the portable object; and

f) by a circuit of the biometric verification subsystem held by the first individual, visually or audibly returning the success signal in a manner perceptible by the second individual, so that the perception of this signal by the second individual ensures by the fact that this signal has the expected characteristics, that the identity of the first individual is validly verified.

0

An embodiment of the device of the invention will now be described with reference to the appended drawings in which the same reference numerals designate identical or functionally similar elements from one figure to another.

Figure 1 illustrates in block diagram form functional the system of the invention in its most general form. FIG. 2 illustrates a particular embodiment of the invention.

0

Figure 1 illustrates the system of the invention in its most general form.

The system of the invention comprises a subsystem 100 for biometric verification of the identity of a first individual. A sensor 101 produces a biometric 102 characteristic of the first individual. This datum is compared with a reference datum 103 by an automatic comparison device 104 which produces a comparison result 105 capable of taking at least two distinct values, True or False, depending on whether the data have, or do not have, sufficiently similar characteristics.

The system further comprises a portable object 300 held by a second individual to whom proof of the identity of the first individual is to be provided; the portable object 300 comprises a means 350 for temporary coupling and information exchange with a coupler 250 for portable objects, a microcircuit 307 forming information processing means, in particular data 306 previously introduced and stored in this portable object. The portable object 300 may be, for example, a contact (ISO / IEC 7816) or non-contact (proximity) magnetic proximity card according to ISO / IEC 14443 standards or Near Field Communication (NFC) standards, or magnetic neighborhood coupling according to ISO / IEC ISO / IEC 15693 standards), or a mobile phone with an NFC interface. The temporary coupling of the portable object 300 with the rest of the system may be for example an inductive coupling between the coupler 250 and the coupling means 350.

The system of the invention implements a cryptographic protocol, between the microcircuit 307 for an operation concerning the data 306, and a microcircuit 207 for an operation concerning a secret datum 206; the messages of this protocol are exchanged through the coupler 250 collaborating with the microcircuit 207, and the coupling means 350 collaborating with the microcircuit 307, the coupler 250 and the coupling means 350 carrying out their temporary coupling and transfer function. infor- mation; the result 201 of the cryptographic protocol depends on the concordance between the secret datum 206 and the datum 306.

The system of the invention comprises a success signal 202 accessible to the senses (visual, auditory, etc.) of the second individual, activated according to the result 201 AND that the comparison result 105 is True. A good way to achieve this result is to produce the result 201 and selectively transfer it to the success signal 202 when the comparison result 105 is True, as shown in FIG. 1. An equivalent means is that the microcircuit 207 does not implement the cryptographic protocol only selectively if the comparison result 105 is True, and the microcircuit 207, or respectively the microcircuit 307, controls the success signal 202 as a function of the result 201 when the cryptographic protocol comes to its normal end.

Advantageously, this success signal 202 is obtained in the manner that will be described below.

In this particular embodiment, the success signal 202 is in the form of a characteristic such as the text of a message or the notes of a melody chosen by the second individual. This characteristic is recognizable by the second individual but is initially unknown to the first individual. It is determined from the result 201 and that the result of the comparison 105 is True.

This embodiment is well suited to the case where the presentation of the success signal 202 is carried out by the first individual and controlled by the microcircuit 207. Since the result 201 depends on the concordance between the secret datum 206 and the datum 306, the signal expected success is produced only if the secret data 206 is concordant with the data 306 and the result of the comparison 105 is True, that is to say if the identity of the first individual has been validly verified.

Figure 2 illustrates a particular form of this embodiment of the system of the invention.

The cryptographic protocol is that the microcircuit 207 decrypts the data 306 with the key formed by the secret data 206 selectively when the result of the comparison 105 is True. Each letter of the data item 306 is, for example, shifted in the alphabet, especially since the corresponding figure of the secret data item 206, and the result 201 of the tocole, generated by the microcircuit 207, is presented by a display revealing the success signal 202 to the second individual, who for example recognizes a text ("monica") to which he expects. It will be appreciated that if the secret datum 206 is altered or absent, this text would not be displayed. The display of the expected text is therefore for the second individual a factor of assurance that the system used is not counterfeit.

For better security, the physical implementation should ensure that an alteration of the comparison device 104, the result 105 of the comparison, or the microcircuit 207, as well as, as far as possible, an alteration of the sensor 101, the data 102, or reference datum 103, would destroy the secret datum 206 and / or prevent by a similar means the normal activation of the success signal 202.

To do this, the elements 102 to 207 can be made for example by means of a SecurCore ARM security microcontroller connected closer to the sensor 101 and collaborating closely with it, for example by operating its mechanical, optical elements or / and electronic. In addition, the secret data 206 may constitute the secret key of a cryptographic algorithm, the data 306 being the same key, a paired public key, or a value encrypted by the key constituted by the secret data 206.

The data item 306 is written into the portable object during its manufacture or subsequently by appropriate input for example on dedicated equipment, and results from an encryption operation according to a symmetric cryptographic algorithm (for example AES, described by the FIPS publication No. 197 NIST) of a message chosen by the second individual, with a key whose value coincides with the secret data 206. In the implementation of the system, the data 306 is transferred from the portable object through the coupling means 350 and the coupler 250, and decrypted by the microcircuit 207 under control of the key formed by the secret data 206, producing the result 201 constituting the success signal that is displayed, this selectively when the result of the comparison 105 is right. The expected message is observable by the second individual selectively only if the cryptographic protocol has succeeded and the identity of the first individual has been verified.

Those skilled in the art in applied cryptography can easily define a protocol using asymmetric type cryptography (such as RSA, DSA or ECDSA, described by FIPS publication NIST 186-3), which allows data 306 to be a public datum corresponding to the secret datum 206.

Various improvements can be made to the system just described.

Thus, the activation of the success signal 202 is advantageously conditioned on the fact that the use of the sensor 101 has occurred within a time period below a predetermined threshold. This prevents a circumvention of the system where the identity of the first individual is verified, then usurped later by a third individual.

In addition, the implementations of a system element are advantageously recorded in a newspaper and / or broadcast remotely, each record of the newspaper or each broadcast being accompanied by at least one item of data from a system element, such as a serial number, part of the reference data 103, secret data 206, and / or data 306, and transferred through the coupling means 350 and the coupler 250; the cryptographic protocol used can also ensure the integrity of this data. The recording can for example be done in a cyclic file of a microcircuit, as described in the ISO / IEC 7816, part 4. The diffusion can be done by a data telecommunication system (SMS, MMS, GPRS, ...).

Advantageously, there is provided a payment system by means of the portable object 300 held by the second individual, which system can be activated only if the success of the cryptographic protocol makes it available, selectively if the result of the Comparison 105 is true, flow-through information transferred from the portable object through the coupling means 350 and the coupler 250. This allows the flow of the portable object 300 only if the identity of the first individual is verified. Advantageously, the flow rate is conditioned on the activation of a confirmation signal of the flow authorization in a predetermined time window relative to the implementation of a system element, and / or the flow rate with flow-through information. is inhibited by a new implementation of an element of the system. This helps to prevent unauthorized flow. For increased security, advantageously, at each implementation of a certain element of the system the data 306 evolves so that the success signal 202 evolves in a predetermined manner. The evolution may consist, for example, in the increment of a usage counter directly displayed by the success signal 202, or / and the selection of one of several messages or melody in a cyclic list. This gives increased assurance on the confidentiality of the expected value for the success signal 202.

An embodiment of the system of the invention will now be described in an exemplary application to taxis, as an illustration of the aforementioned embodiment and some of the above improvements.

In this system, the driver holds a biometric authentication box including the biometric verification subsystem 100, the secret data 206, the microcircuit 207, the coupler 250 and the success signal 202. The customer, meanwhile, holds a portable object including including information 306 known to the customer, such as an account number or / and a message he has chosen.

In the care of the customer, the driver presents his finger on the sensor 101, and its identity is verified by the biometric system on the basis of the characteristics of the dermatoglyphs of the finger compared to the reference characteristics 103.

The client approaches his portable object 300 of the reader 250 and the temporary coupling is established with the coupling means 350. The data item 306 is read, decrypted under control of the key formed by the secret data item 206 selectively if the result 105 of the comparison is True, as described above, and the activation signal 202 is revealed by displaying the message known to the client on a screen of the box.

As soon as the data 306 is transferred through the coupler 250, a record is added to the on-demand log of the microcircuit 207 and / or the microcircuit 307, including the serial number of the portable object of the client read through the coupler 250 and the coupling means 350, as well as the date. As a variant or in addition, this information is broadcast, for example by an SMS message sent on command of the microcircuit 207 and / or the microcircuit 307. This record, which can be used in the case of an inquiry, constitutes an indication of the support for this customer in this taxi at this precise moment, and this as soon as the intention of the customer to use the taxi is constituted, that the identity of the driver is checked or not. This also deters a legitimate taxi driver from becoming an accomplice to wrongdoing.

The system can be connected to the taximeter, the activation of its "support" mode constituting the confirmation signal of the debit authorization. If this activation occurs within a predetermined time window relative to the activation of the activation signal 202 or some other element of the system, the credentials of the customer, such as the account number, are used for debiting the amount of money. the race, which can come from the taximeter, or otherwise be obtained via an ad hoc keyboard. This credential information is then cleared, as is the case where another customer's support occurs without a debit, preventing the new customer from being charged to the previous customer.

In some applications where more than one individual (rather than a single first individual) must be identified with the same system, the reference data item 103 may be searched automatically among a plurality; and / or the reference datum 103 may be derived from an additional portable object held by the identified individual, which may collaborate with the coupler 250 or the like; in the example of application to taxis, it may be for example several drivers sharing the same vehicle. The sensor 101 and / or the automatic comparison device 104 and / or the secret key 206 and / or the log support can be integrated with this additional portable object. Moreover, the reference datum 103 may be protected by a cryptographic certificate, and / or be associated with a validity expiry date, and / or with a known carrier code of the first individual.

It is possible to make mutual verification of the identity of the two individuals, by using the system twice. For example, two individuals each equipped with NFC mobile phones can demonstrate to each other their identity, provided that one (at least) of the two mobile phones, or an intermediate device, includes a biometric verification subsystem.

Claims

1. A biometric system for verifying the identity of a first individual by a second individual, comprising:

a biometric verification subsystem of the identity of the first individual;

means for reproducing in visual or auditory form the success signal in a manner perceptible to the second individual,

characterized in that

the biometric verification subsystem (101, 102, 103, 104, 201, 206, 207) is held by the first individual and the portable object (300) is held by the second individual;

the means for selectively delivering a success signal (202) are means included in the biometric verification subsystem;

the cryptographic protocol is a protocol capable of producing a result (201) determining a characteristic of the success signal and representative of the concordance between a secret datum (206) and a datum (306) contained in the portable object; and

the means for restoring in visual or auditory form the success signal (202) are means controlled by a circuit (207) of the biometric verification subsystem held by the first individual, so that the perception of this signal by the the second individual assures him, by the fact that this signal possesses the expected characteristics, that the identity of the first individual is validly verified.

2. A biometric method for verifying the identity of a first individual by a second individual, comprising the steps of:

a) providing the first individual with a biometric verification subsystem (101, 102, 103, 104, 201, 206, 207); b) providing the second individual with a portable object (300);

(e) by the biometric verification subsystem, selective issuance of a success signal (202) subject to success: (i) biometric verification and (ii) verification of the authenticity of the biometric verification subsystem. biometric verification by a cryptographic protocol between the latter and the portable object,

said cryptographic protocol being a protocol capable of producing a result (201) determining a characteristic of the success signal and representative of the concordance between a secret datum (206) and a datum (306) contained in the portable object; and

f) by a circuit (207) of the biometric verification subsystem held by the first individual, visually or audibly restoring the success signal perceptibly by the second individual, so that the perception of this signal by the second individual individual assures him, by the fact that this signal has the expected characteristics, that the identity of the first individual is validly verified.