Masking of sensitive data during user identification

Abstract

Method for sending masked image data depicting an identification document (200) to a central server (50), the method comprising: - Capturing image data (302) with a camera (65) of a user terminal device (60), wherein the image data (302) depict the identification document (200), - Capturing additional image data (301) with the camera (65) of the user terminal device (60), wherein the additional image data (301) depict the identification document (200), wherein the additional image data (301) are of lower resolution than the image data (302), wherein the resolution of the additional image data (301) is so low that sensitive data of the identification document (200) are not recognizable, - Recognition of the identification document (200) in the further image data (301), - Obtaining tax data from an image recognition of the further image data (301), - Changing pixel values ​​in the image data (302) in the area of ​​a mask (502) to mask the identification document (200), wherein the mask (502) is determined depending on a pose of the identification document (200) in the image data (302) and depending on the control data that define a type of identification document (200), - Sending at least parts of the image data (302) with the changed pixel values ​​to the central server (50).

Description

[0001] There are known scenarios in which identifying a user is desirable. Identifying a user can mean verifying or providing the user's identity, or verifying or providing one or more of the user's identity criteria. In various scenarios, such identity criteria can include the user's age, the user's place of residence, and / or the user's name.

[0002] Such scenarios can include, for example, identity-critical transactions, such as purchase contracts or bank transfers or access controls, where, due to legal regulations or personal interests, it must be ensured that the identity of the transaction partner is established and / or that the identity criteria meet certain requirements - such as being of legal age or residing in a certain country, etc. This means that, depending on the identification, the user can be authenticated.

[0003] However, even in other scenarios where identity is not or not particularly critical, it may be desirable to provide simple and fast techniques for user identification.

[0004] Typically, such scenarios may require a comparatively high degree of reliability and / or security against forgery and / or fraud in identification. For example, it may be desirable to make user identification secure against forgery of identification documents and / or deliberate deception.

[0005] Identification techniques are known in this regard that rely on a user appearing in person at an authorized location. There, an identification document containing the user's photograph can then be used for identification. Various types of identification documents are known, such as passports, identity cards, driver's licenses, and / or other official documents.

[0006] However, identification techniques are also known that rely on the user transmitting image data from an identification document to a central location, such as an identification server (see, for example, German patent application DE 10 2013 100 635.3). In this case, it may be desirable – for example, for data protection reasons – that not all data provided by a typical identification document is transmitted to the central location. In other words, it may be desirable to ensure that only relevant data is transmitted. Certain sensitive data can be excluded from transmission.

[0007] Therefore, there is a need for technologies that, on the one hand, enable a high degree of reliability and / or forgery-proofness of user identification by means of a user identification document; on the other hand, however, protect certain data on the identification document from unauthorized access.

[0008] This object is solved by the independent claims. The dependent claims define further embodiments.

[0009] According to a first aspect, the invention relates to a method for sending masked image data of an identification document to a central server. The masked image data depicts an identification document. The method comprises capturing image data with the camera of the user terminal. The image data depicts the identification document. The method comprises capturing further image data with the camera of the user terminal, wherein the further image data depicts the identification document, wherein the further image data has a lower resolution than the image data, wherein the resolution of the further image data is so low that sensitive data of the identification document cannot be recognized. The method comprises recognizing the identification document in the further image data. The method comprises obtaining control data from image recognition of the further image data.The method further comprises modifying pixel values ​​in the image data in the region of a mask for masking the identification document. The mask is determined depending on a pose of the identification document in the image data and depending on the control data that defines a type of the identification document. The method further comprises sending at least portions of the image data with the modified pixel values ​​to the central server.

[0010] The central server can, for example, be set up to authenticate and / or identify the user based on the sent image data. Identification can mean, for example, determining an identity or at least certain identity parameters of a user. Identity parameters can include, for example, name, address, age, citizenship, etc. Authentication can mean, for example, comparing certain identity parameters with predefined values.

[0011] Masking can mean: locally changing pixel values—for example, compared to measured pixel values—to obscure information represented by the pixel values, which may be sensitive data. For example, the pixel values ​​can be set to a uniform value, such as black, white, or yellow. Other effects, such as smearing, are also possible. Changing pixel values ​​can mean, for example, changing them relative to a reference value, changing them relative to a measured value, and / or changing them relative to a value of a neighboring pixel, etc. When changing them, pixel values ​​of neighboring pixels can also be taken into account.

[0012] Using the techniques described above, the effect of reliable masking of the image data can be achieved. In particular, sensitive data can be masked securely and appropriately for the identification document. By determining the mask depending on the pose of the identification document in the image data, particularly reliable masking of the sensitive data can be achieved. In particular, the masking can be robust to different poses of the identification document. Depending on the different type of identification document, sensitive data to be masked can be located in different positions on the identification document, e.g., in the top left of an identity card, but in the bottom right of a passport. This can be taken into account by determining the mask depending on the tax data.

[0013] In particular, the additional image data can be captured first and only then the image data can be captured.

[0014] Recognizing the identification document in the additional image data can mean: determining that the identification document is depicted in the additional image data and optionally determining a pose of the identification document in the additional image data. In other words, it can first be checked whether the additional image data depict the identification document at all and then, optionally, it can be checked with which pose the additional image data depicts the identification document. The pose of the identification document can mean a position and an orientation of the identification document in the image data and / or in relation to the camera, for example, it can be determined by the spatial position, i.e. the distance to the camera and an orientation in space.

[0015] The pose of the identification document in the image data can be determined, e.g., using image recognition techniques. In a simple embodiment, the basis for determining the pose can be the image data itself or, alternatively or additionally, previously acquired additional image data, for example, as a reference or initial value or as a representative value. For example, based on the pose of the identification document in the additional image data, the pose of the identification document in the image data can be anticipated. The method can therefore further comprise: recognizing a pose of the identification document in the additional image data and determining the pose of the identification document in the image data based on the recognized pose in the additional image data.

[0016] In this way, for example, it may be possible to determine the mask before the image data is captured. This can make masking particularly efficient and less computationally intensive. Furthermore, it would be possible to anticipate and disregard certain pixel values ​​during the image data capture process. Sensitive data can therefore be obscured at an early stage of data capture and processing. This could ensure particularly high security against unauthorized reading of the information to be masked. Certain deviations in the pose of the identification document between the additional image data and the image data can be tolerated; for example, the mask could be determined with a corresponding tolerance range. Movements and shifts between the additional image data and the image data could be compensated for in this way, e.g.unless there is too long a time period between the capture of the additional image data and the image data.

[0017] It would also be possible for the mask to be determined directly from the image data, i.e., after it has been captured. The pose of the identification document can thus be determined directly from the image data. This has the effect of particularly precise masking.

[0018] The control data can be obtained, for example, from user input. It would be possible, for example, for the user to initially specify the type of identification document, e.g., via a corresponding user interface on the user terminal. The control data can be obtained alternatively or additionally from image recognition of the additional image data. The control data can be obtained alternatively or additionally from image recognition of the image data. Suitable image recognition techniques can be used for this purpose. This ensures that the control data specifies the correct type of identification document. This allows for precise masking of sensitive data. Incorrect masking can be avoided.

[0019] For example, a geometric reference shape of the mask can be specified. Alternatively or additionally, the geometric reference shape can be received from the central server. The method can further comprise: determining the mask by transforming the geometric reference shape according to the pose of the identification document in the image data.

[0020] The reference shape can, for example, be different for different types of identification documents. In other words, the reference shape can be specific to a type of identification document. For example, the geometric reference shape of the mask can comprise a shape of the mask for a specific reference pose of the respective identification document. The transformation can then correspond to a geometric transformation of the reference pose into the pose of the identification document in the image data.

[0021] For example, the method may further include sending the control data to the central server. For example, it may be possible to determine the appropriate geometric reference shape based on the sent control data. The control data may not contain any identity-related information, so the control data can be sent before the image data is masked.

[0022] In general, the additional image data and the image data can be selected flexibly, for example with regard to format, type, resolution, etc. For example, the additional image data can be a still image or a single image. For example, the image data can be a still image or a single image. For example, the additional image data can be a film. For example, the image data can be a film. For example, the additional image data and the image data can be part of a film, e.g. of the same film. Changing the pixel values ​​during masking can happen in real time of the film. This can ensure the effect of reliable identification of the user, while at the same time reliably masking sensitive data.For example, if the pose of the identification document changes over the course of the film, it would be possible to determine the pose in real time, and masking it with a current pose of the identification document would reliably mask the sensitive data. The changing pose of the imaged identification document can simultaneously ensure that it is not a forgery or deception, making identification more reliable.

[0023] The image data and / or the additional image data can each comprise a sequence of individual images. The individual images can depict the identification document in different poses. The pixel values ​​can be changed individually for each individual image in the image data. For example, a current pose could be determined for each individual image, e.g. based on the corresponding individual image and / or a previous individual image and / or the additional image data. This ensures that even if the identification object moves as a function of time, the sensitive data is always masked in a valid and current manner. The parts of the image data with the changed pixel values ​​could, for example, be sent to the central server as part of a live chat.Live chat can enable particularly secure identification; by changing pixel values ​​in a time-resolved manner, the concealment of sensitive data can be ensured for the duration of the live chat. Particularly in such a case, the individual images can be captured at points in time that are only a few tens of milliseconds apart. In other words, the image data and / or the additional image data can comprise individual images if they are part of a film. However, it is also possible for there to be a longer time interval between the capture of the various individual images. It is possible for the capture of the individual images to be user-initiated.

[0024] The additional image data and the image data can, for example, have different resolutions. Resolution can refer to a density of pixels relative to the image area or a total number of pixels per image. For example, the additional image data can have a lower resolution than the image data, or vice versa. For example, a first resolution of the additional image data can be equal to or less than 4 megapixels, preferably 2 megapixels, particularly preferably 1 megapixel. A first resolution of the additional image data could be equal to or less than 350 pixels per inch (dpi), preferably 250 dpi, particularly preferably less than 75 dpi.

[0025] For example, the resolution of the additional image data may be so low that sensitive data cannot be recognized—even without appropriate masking of the additional image data. At the same time, the resolution of the additional image data may be sufficiently high that the identification document, optionally the pose of the identification document, can still be recognized in the additional image data. This may allow for reliable masking of sensitive data even at a time when masking is not yet possible or only possible to a limited extent, e.g., because an image recognition technology has not yet recognized the identification document. This allows the sensitive data to be particularly well protected against unauthorized access.

[0026] In addition, the identification document can be recognized quickly and with a particularly low computational effort in the additional image data, provided the data has a comparatively low resolution. Initiating the capture of the image data can therefore be particularly fast.

[0027] According to a further aspect, the invention relates to a user terminal that is configured to send masked image data to a central server. The masked image data depicts an identification document. The user terminal comprises a camera, a processor, and an interface. The camera is configured to capture image data. The image data depicts the identification document. The camera is further configured to capture additional image data, wherein the additional image data depicts the identification document, wherein the additional image data has a lower resolution than the image data, wherein a resolution of the additional image data is so low that sensitive data of the identification document cannot be recognized. The processor is configured to recognize the identification document in the additional image data and to obtain control data from image recognition of the additional image data.The processor is further configured to modify pixel values ​​in the image data within a mask for masking the identification document. The mask is determined based on a pose of the identification document in the image data. The mask is further configured based on control data that defines a type of identification document. The interface is configured to send at least portions of the image data with the modified pixel values ​​to a central server.

[0028] For such a user terminal, effects can be achieved that are comparable to the effects that can be achieved for a method for transmitting masked image data according to a further aspect.

[0029] The user terminal can be configured to execute a method for transmitting masked image data according to a further aspect. For example, the processor can be configured to determine the mask according to the described techniques. For this purpose, the first image data can also be captured by the camera and processed accordingly by the processor.

[0030] The features set forth above and the features described below can be used not only in the corresponding explicitly set forth combinations, but also in further combinations or in isolation without departing from the scope of the present invention. In particular, it is possible to combine the various features of the methods for identifying the user and for providing image data.

[0031] The above-described properties, features and advantages of this invention, as well as the manner in which they are achieved, will become clearer and more clearly understood in connection with the following description of the embodiments, which are explained in more detail in connection with the drawings. Fig. 1 illustrates an identification document containing sensitive data. Fig. 2 illustrates the identification document of the Fig. 1, where the sensitive data is masked. Fig. Figure 3 illustrates a user terminal connected to an identification server for identifying a user based on image data representing the identification document. Fig. 4 illustrates further image data in which the identification document is depicted. Fig. Figure 5 illustrates image data in which the identification document is depicted and in which sensitive data is masked. Fig. Figure 6 illustrates the masking of the image data depending on the pose of the identification document. Fig. 7 is a flowchart of a method for transmitting masked image data according to the invention. Fig. 8 illustrates a scenario in which the further image data and the image data each comprise a sequence of individual images as a film.

[0032] The present invention will now be explained in more detail using preferred embodiments with reference to the drawings. In the figures, identical reference numerals designate identical or similar elements. The figures are schematic representations of various embodiments of the invention. Elements depicted in the figures are not necessarily drawn to scale. Rather, the various elements depicted in the figures are depicted in such a way that their function and general purpose will be understood by those skilled in the art.

[0033] Connections and couplings between functional units and elements shown in the figures can also be implemented as indirect connections or couplings.

[0034] A connection or coupling can be implemented wired or wirelessly. Functional units can be implemented as hardware, software, or a combination of hardware and software.

[0035] The figures explain techniques in which masked image data is generated for the subsequent identification of a user. The reliable and secure identification of persons is required in various business processes - whether to open an account or depository, conclude a mobile phone contract, consume age-restricted content or generally to prevent fraud in business transactions. Such identification often requires the inspection of an identity document or an identification document, which is typically checked for authenticity and compared with the face of the person to be identified. Furthermore, a copy of the ID card is often made in this context. This is particularly true for processes where the inspection is not carried out in person, but via electronic processes such asIf you send a copy of your ID, take a photo / video of your ID, or show your ID in a live video connection, a copy of your ID will be automatically created, as it should be stored, at least temporarily, by the provider of the identification service.

[0036] This can be problematic for data protection reasons, as the identification document contains various personal data. Often, the identification document displays significantly more data than is required for the actual identification process. Furthermore, sensitive data is sometimes printed on the identification document that should be transmitted to third parties.

[0037] The following explains techniques that enable identification while preventing the disclosure of sensitive data. Fig. 1 shows a typical identification document 200, e.g., a driver's license. Of course, alternative identification documents 200 are possible, e.g., credit cards, student IDs, library cards, identity cards, passports, other official documents, etc. In general, the identification document 200 should have certain integrity or validity features 203 that can be used to verify its authenticity, e.g., watermarks, holograms, reliefs, check digits, etc. Authenticity can, for example, be particularly advantageously determined using image data that depict the identification document 200 in different poses, e.g., by tilting or rotating it, etc. Furthermore, the identification document 200 should have certain identification information 202 that can be used to identify the user or holder of the identification document 200. Typical examples would be name, address, age, passport photo, etc.

[0038] In addition, the identification document of the Fig. 1 also contains sensitive data 201. For data protection reasons, such sensitive data 201 should not be passed on to third parties, e.g., not even for identification purposes. The sensitive data 201 could, for example, be specified by the user or determined according to certain general guidelines. Examples would be: the verification code of a credit card, the Card Access Number (CAN) of a German identity card, the registration number of a student ID card, etc.

[0039] Typically, the position of the sensitive data 201 on the identification document 200 is known and depends on the type of identification document 200. This is in Fig. 2. There, it can be seen that certain areas of the identification document 200 have been blacked out. These areas, where the sensitive data 201 is located, are thus rendered unrecognizable (masked). Alternative masking techniques can be selected, for example, from the following group: blacking out, deleting, obscuring, pixelating, blurring, distorting, etc.

[0040] If corresponding image data are subsequently sent to a central location, e.g. to an identification server 50 (cf. Fig. 3) is sent, the corresponding areas are illegible and the sensitive data 201 is protected from unauthorized access. Techniques are described below that make it particularly efficient and secure to mask the image data to be sent, which is captured by a camera 65 of a user terminal 60 - especially when the identification involves sending image data as part of a film, for example in a live chat. The user terminal 60 can be, for example, a cell phone, a tablet, a PC with a webcam, a television with a camera, or the like. The connection between the user terminal 60 and the identification server 50 can be established, for example, via the Internet. For this purpose, the user terminal has a corresponding interface 69. The interface 69 can operate wirelessly and / or wired. Packetized data can be exchanged.The user terminal 60 can have a user interface 66 by means of which user input can be sensed and / or information can be output to the user. The user interface 66 can include: voice output, image output via a touchpad, a touchpad, buttons, sliders, keys, etc. For example, the user interface 66 can include a screen on which image data captured by the camera 65 is displayed in real time. Furthermore, the user terminal 60 includes a processor 67 that is configured to perform various techniques related to image capture and image processing. These can include, for example, image recognition and masking techniques, as explained below. The processor 67 can be configured to perform these techniques in real time.

[0041] In Fig. 4 shows further image data 301 captured by the camera 65, which depict the identification document 200 (in Fig. 4 only shown schematically). The further image data 301 have a specific resolution, which can be selected to be comparatively low, e.g., less than 4 megapixels, preferably less than 2 megapixels, particularly preferably less than 1 megapixel. For example, the resolution can be selected such that the identification document 200 can still be recognized in the further image data 301, but at the same time, in particular, the content of the sensitive data 201 is illegible. It may be unnecessary for the integrity information 203 and / or the identification information 202 to be recognized. In other words, the further image data 301 can have such a low resolution that text, etc., of the sensitive data 201 is not recognizable or can only be recognized to a limited extent. This ensures that the sensitive data 201 cannot be read out of the further image data 301 without authorization. Furthermore, the further image data 301 should not be sent to the identification server 50.This further ensures that these additional image data 301, in which no masking has yet taken place, are used without authorization to access the sensitive data 201.

[0042] The additional image data 301 can, for example, be captured as a film with a specific frame rate. This makes it particularly easy for the user to photograph the identification document 301. Using suitable image recognition techniques, such as edge detection, template matching, or landmark recognition, the identification document 200 can then be recognized in the additional image data 301. For this purpose, a corresponding image recognition can be performed in a predetermined area of ​​the additional image data 301 (in Fig. 4 illustrated by the indicated frame). Optionally, the pose, ie, the position and orientation of the identification document 200, can also be detected.

[0043] As soon as the identification document 200 is recognized in the further image data 301, the sensitive data 201 can be masked in image data 302. In the subsequently acquired image data 302 (see Fig. 5) it is then possible to mask the sensitive data 201. For this purpose, a mask is determined. The determination of the mask 502 is described in Fig. 6. A geometric reference shape 501 is predefined. The geometric reference shape 501 can, for example, be permanently stored in the user device, e.g., assigned to the respective type of identification document 200. However, it would also be possible, alternatively or additionally, for the reference shape 501 to be received by the identification server 50, e.g., before the additional image data 301 is captured.

[0044] The reference form 501 can be specifically assigned to a certain type of identification document 200. This can be the case because the position of the sensitive data 201 on an identity card, for example, typically differs from the position of the sensitive data 201 on a driver's license. Therefore, it may be necessary to determine the type of identification document 200. This can be done, for example, via a corresponding preselection by the user via the user interface 66. Alternatively or additionally, the type of identification document 200 can also be determined from the additional image data 301 and / or the image data 302, for example using image recognition techniques.

[0045] The reference form 501 is transformed (into Fig. 5 as a vertical arrow) to determine the mask 502. The transformation may include compression, distortion, rotation, scaling, etc. The transformation takes into account the pose of the identification document 200 in the image data 302. The mask is then adapted to the specific pose with which the identification document 200 is contained in the image data 302 (cf. Fig. 5).

[0046] In general, various techniques are possible for determining the pose of the identification document 200 in the image data 302. For example, the pose of the identification document 200 could be determined from the additional image data 301 using corresponding techniques mentioned above. This pose in the additional image data 301 could then be used to determine the pose in the image data 302. This makes it possible to determine the pose in the image data 302 particularly quickly. Alternatively or additionally, it would also be possible to apply certain image recognition techniques to the image data 302 to determine the pose directly from the image data 302.

[0047] Such aforementioned techniques make it possible, in particular, for the additional image data 301 and the image data 302 to be part of a film. The masking of the sensitive data 201 can occur in real time. It would also be possible for the image data 302 to be extracted from a running film as a higher-resolution photo or to be inserted. In particular, for example, the image data 302 could have a higher resolution than the additional image data 301; then, server-side identification based on the identification information 202 and the integrity features 203 can be carried out particularly reliably. Forgeries or deceptions can be reliably detected.

[0048] In Fig. 7 shows a flowchart of a method according to the invention. The method begins in step S1. First, in step S2, the additional image data 301 are captured, e.g., as a film. In step S2, the additional image data 301 could be output as a live image on a screen of the user interface 66. In step S3, it is checked whether the additional image data 301 depicts the identification document 200. Image recognition techniques, as are generally known to those skilled in the art, can be used for this purpose. As long as the identification document 200 is not depicted, steps S2 and S3 are repeated. Optionally, in step S3, a pose of the identification document 200 could also be determined in the additional image data 301. Steps S2 and S3 are optional.

[0049] Otherwise, the process continues with step S4—e.g., automatically or after user input. In step S4, the image data 302 is captured, e.g., with a comparatively higher resolution. Then, in step S5, the image data 302 is masked. For this purpose, the mask 502 is determined from the pose of the identification document 200 in the image data 302 and based on control data that indicates the type of the identification document 200. The mask 502 is then applied to the image data 302. The image data 302 masked in this way is sent to the identification server 50 (step S6). The method ends with step S7.

[0050] Out of Fig. 7 shows that the masked image data 302 is sent first to the identification server 50. The unmasked additional image data 301 is not sent. The additional image data 301 is used to initially recognize the identification document 200. The data protection of sensitive data can thus be ensured, e.g., even if the additional image data 301 and the image data 302 are a film.

[0051] For example, steps S4-S6 could be repeated in real time for a specific, predetermined period of time or until manually initiated termination. For example, in this context, a live video chat could be established between the user terminal 60 and the identification server 50. For example, the image data 302 can comprise a sequence of individual images as a film, which depict the identification document in different poses. The pixel values ​​can then be changed individually for all individual images. In other words, the mask for each of the individual images can be determined depending on the corresponding pose. In this way, a high degree of identification reliability can be ensured, while at the same time, by adapting the mask for the various individual images, the disclosure of the sensitive data 201 can be avoided.Such an embodiment, in which the further image data 301 and the image data 302 comprise a sequence of individual images as a film, is also shown in . Fig. 8. There, it can be seen that both the additional image data 301 and the image data 302 each comprise several consecutive individual images, which thus form a film. For example, the pose of the identification document 200 could be determined individually for each individual image of the image data 302, for example, from the preceding individual image or directly from the corresponding individual image. Fig. 8 it is also apparent that the additional image data 301 has a lower resolution or fewer pixels than the image data 302. In Fig. 8, the individual images of the image data 302 and the further image data 301 have a fixed temporal interval between them. However, a variable temporal interval would also be possible.

[0052] Of course, the features of the previously described embodiments and aspects of the invention can be combined with one another. In particular, the features can be used not only in the described combinations, but also in other combinations or on their own, without departing from the scope of the invention.

[0053] Thus, techniques were primarily described above in which the masking of the image data occurs after the image data has been captured. However, it would also be possible for the masking of the image data to already take place during capture, e.g. by not reading out the corresponding pixel values ​​of image points from the camera of the user terminal, i.e. by changing them compared to a measured value, or by only reading them out in a manipulated manner. This may require that the mask is already determined before the image data is captured. In such cases, in particular, it may be desirable to determine the mask based on the pose of the identification document in the additional image data. In such a case, it may also be desirable for only a comparatively short period of time, e.g.in the millisecond range, so that there is no or no significant change in the pose between the additional image data and the image data. In this case, the pose in the additional image data is in good agreement with the pose in the image data. Accordingly, if the image data comprises multiple individual images, it would of course be possible to use a previous individual image of the image data to determine the mask in the subsequent individual image of the image data.

[0054] Furthermore, the above primarily described techniques in which the pose of the identification document was determined at least partially from the additional image data. However, it is also possible for the pose to be determined directly from the image data itself. List of reference symbols 50 identification servers 60 user terminals 65 Camera 66 User interface 69 Interface 200 identification documents 201 Sensitive Data 202 Identification information 203 integrity characteristics 301 Additional image data 302 image data 501 Geometric Reference Shape 502 Mask S1- S7 step

Claims

[1] A method for sending masked image data depicting an identification document (200) to a central server (50), the method comprising: - capturing image data (302) with a camera (65) of a user terminal (60), wherein the image data (302) depict the identification document (200), - capturing further image data (301) with the camera (65) of the user terminal (60), wherein the further image data (301) depict the identification document (200), wherein the further image data (301) have a lower resolution than the image data (302), wherein a resolution of the further image data (301) is so low that sensitive data of the identification document (200) cannot be recognized, - recognizing the identification document (200) in the further image data (301), - Obtaining control data from an image recognition of the further image data (301), - changing pixel values ​​in the image data (302) in the area of ​​a mask (502) for masking the identification document (200), wherein the mask (502) is determined as a function of a pose of the identification document (200) in the image data (302) and as a function of the control data that define a type of the identification document (200), - Sending at least parts of the image data (302) with the changed pixel values ​​to the central server (50). [2] The method of claim 1, wherein the method further comprises: - detecting the pose of the identification document (200) in the further image data (301), - Determining the pose of the identification document (200) in the image data (302) based on the recognized pose in the further image data (301). [3] Method according to one of the preceding claims, wherein a resolution of the further image data (301) is equal to or less than 4 megapixels, preferably 2 megapixels, particularly preferably 1 megapixel. [4] Method according to one of the preceding claims, wherein a geometric reference shape (501) of the mask (502) is predetermined and / or received from the central server (50), the method further comprising: - Determining the mask (502) by transforming the geometric reference shape (501) according to the pose of the identification document (200) in the image data (302). [5] Method according to one of the preceding claims, wherein the image data (302) are part of a movie, wherein the changing of the pixel values ​​occurs in real time. [6] Method according to one of the preceding claims, wherein the image data (302) comprise a sequence of individual images which depict the identification document in different poses, wherein the changing of the pixel values ​​occurs individually for the individual images. [7] A user terminal (60) configured to send masked image data depicting an identification document (200) to a central server (50), the device detecting: - a camera (65) configured to capture image data (302), wherein the image data (302) depicts the identification document (200), wherein the camera (65) is further configured to capture further image data (301), wherein the further image data (301) depicts the identification document (200), wherein the further image data (301) has a lower resolution than the image data (302), wherein a resolution of the further image data (301) is so low that sensitive data of the identification document (200) cannot be recognized, - a processor (67) configured to recognize the identification document (200) in the further image data (301) and to obtain control data from an image recognition of the further image data (301), wherein the processor (67) is further configured to change pixel values ​​in the image data (302) in the region of a mask (502) for masking the identification document (200), wherein the mask (502) is determined as a function of a pose of the identification document (200) in the image data (302) and as a function of the control data that define a type of the identification document (200), - an interface (69) configured to send at least parts of the image data (302) with the changed pixel values ​​to a central server (50). [8] User terminal (60) according to claim 7, wherein the user terminal (60) is arranged to carry out a method according to any one of claims 2-6.

Images