PROCEDE D’IDENTIFICATION

Abstract

The universal identification application performs an optical scan of the identity holder or an item in their possession and sends this scan, along with the identity holder's and algorithm's identifiers, to an official identification server. This server then decrypts the encrypted data, compares the result with the optical scan of the identity holder or an item in their possession, and validates or rejects the identity of the identity holder. The decryption algorithm is designed so that a brute-force decryption attempt results in a plurality of plausible solutions, and therefore the encrypted database cannot be used to reconstruct a decrypted database. The optical scan sent by the identity holder is known only to the official identification server. (See diagram: Fig. 1)

Description

Title of the invention: IDENTIFICATION METHOD technical field

[0001] The invention is a method for identifying natural and legal persons. Previous technique

[0002] Individual identification is most commonly carried out by analyzing identity documents, either face-to-face or via the Internet, using methods that are unreliable. There are also automated biometric analysis systems that are more efficient, but these are reserved for police or customs officials.

[0003] We also know of methods of authentication of documents open to all, which can be applied to the authentication of identity documents and therefore to remote identification. Technical problem

[0004] Identity theft is affecting more and more people and organizations, and has serious consequences for the privacy, security, reputation, trust and well-being of victims, as well as for the security and public finances of states.

[0005] Identity cards and passports continue to be transmitted via the Internet and can be resold on the dark web, which is all the more dangerous as powerful mafia organizations and rogue states can use these documents.

[0006] States, however, have all the identity details of their nationals and foreigners living on their territory, and could develop public identification services on the Internet, allowing, for example, to validate the similarity between a person's face and their official identity photo, and thus to carry out quality identifications for the benefit of all.

[0007] They have generally not opened such services until now because of the risks involved. Some were relatively easy to control, such as the identification of non-consenting persons, the misuse of processing by using biometric data for purposes other than those initially intended, or the sharing of this data with unauthorized third parties, but others did not seem to be controllable, such as the risk of error or technical failure, and especially the exposure of biometric data to unauthorized access or loss. Brief description of the drawings

[0008] The invention will be well understood, and other objects, advantages and features thereof will become more apparent from the reading of the description which follows, which is illustrated by figures 1 to 3.

[0009] [Fig. 1] is a diagram showing the different stages of commissioning the UNIVERSAL IDENTIFICATION APPLICATION described below.

[0010] [Fig.2] is a diagram showing the different stages of an identity check in face to face by the police, the gendarmerie or customs

[0011] [Fig.3] is a diagram showing the different stages of an Identification during of an online or face-to-face transaction. Description of the invention

[0012] The invention is an identification method implementing: - an encrypted database concerning natural or legal persons referred to as holders, - a database of algorithms for decrypting said encrypted data, - elements referred to as digital identity cards, comprising an identifier of one of said holders and an identifier of said algorithm for decrypting said encrypted data relating to said holder, - and a software program called a universal identification application controlling an optical acquisition device, characterized in that said universal identification application - performs an optical acquisition of said holder or an element in his possession, - sends this acquisition to a computer called the official identity server along with said identifiers of the holder and said decryption algorithm, so that said official identity server can decrypt said encrypted data of said holder, and compare the result with the optical acquisition of said holder or said element in his possession, and validate or not the identity of said holder. Detailed description of the invention

[0013] The present innovation, in its preferred version, is made possible by the encryption method described in patent applications FR2306169 of 16 / 06 / 2023, FR2306377 of 20 / 06 / 2023, FR2306616 of 25 / 06 / 2023, FR2306692 of 26 / 06 / 2023 and FR2307466 of 12 / 07 / 2023, because without this innovation, which is referred to below as the "brute-force resistant encryption method", it would be impossible to make identification servers available to the public on the Internet without taking the risk that a quantum computer might consult them to build biometric databases.

[0014] The method of the present invention has the particularity that, in its preferred version, a brute-force attack carried out by a quantum computer, which could test all possible algorithm identifiers, but which will all give different plausible results, i.e., photos that represent a person's face and conform to passport photo standards. No artificial intelligence will be able to determine which one is correct. The sentence that one The request made to the person to be identified is different for each attempt. Therefore, the person in question would have to be asked to record this video millions of times to have any chance of discovering the algorithm used, and it would then be necessary to determine the nature of this algorithm, which could be very complex.

[0015] I - The structure of the IDENTIFICATION SYSTEM

[0016] It is based on DIGITAL IDENTITY CARDS, an OFFICIAL IDENTITY SERVER, IDENTIFICATION REQUESTS, and a UNIVERSAL IDENTIFICATION APPLICATION.

[0017] LA - The DIGITAL IDENTITY CARD and the DIGITAL IDENTITY CERTIFICATE

[0018] The DIGITAL IDENTITY CARD is an alphanumeric string composed of two identifiers: that of the holder and that of the encryption algorithm.

[0019] The holder first name last name can for example have as an identity card the alphanumeric string FirstNameLastNameEK5sO2-SOkLtB4vBriSB6OR in which FirstNameLastNameEK5sO2 is the identifier of the holder, and SOkLtB4vBriSB6OR that of the algorithm.

[0020] The DIGITAL IDENTITY CARD may take the form of a barcode, a file stored in a smartphone, or internet links allowing the downloading or sending of such a file.

[0021] The administrative authorities may send it to the holder by electronic message, by email, by regular mail, or even deliver it by hand.

[0022] The DIGITAL IDENTITY CARD does not need to be secured, and it can be replicated without risk.

[0023] There is a variant of the DIGITAL IDENTITY CARD called the DIGITAL IDENTITY CERTIFICATE, which includes only the holder's identifier and a digital signature. This DIGITAL IDENTITY CERTIFICATE allows anyone who sees it to know the holder's identity (surname, first name, address) and to know their existence in the database of the OFFICIAL IDENTITY SERVER. Like the DIGITAL IDENTITY CARD, it can be in the form of a barcode, a file stored on a smartphone, or internet links allowing the downloading or sending of such a file. Signing a classified ad or a response to a classified ad with this link certifies to the reader that the sender exists and that their identity can be verified by the IDENTIFICATION SYSTEM before signing an agreement with them.

[0024] Legal entities and public services may also have a DIGITAL IDENTITY CARD and a DIGITAL IDENTITY CERTIFICATE. The equivalent of the identity details of legal entities are the details of the administrative registration of legal entities. Instead of the identity photograph of natural persons, biometric information is replaced by the description of a unique optical key (a non-clonable physical function, also called a PUF).

[0025] IB - The OFFICIAL IDENTITY SERVER

[0026] This server has a very simple function: upon receiving an IDENTIFICATION REQUEST as defined below, referring to a DIGITAL IDENTITY CARD and the designation of an identification method which is a video of the person's face, which may be supplemented by other elements such as voice analysis, a fingerprint, or an iris scan. In a preferred version, the facial video and / or voice recording are acquired after asking the holder to pronounce a phrase that is different each time.

[0027] LC - The IDENTIFICATION REQUEST

[0028] An IDENTIFICATION REQUEST is a message sent to the OFFICIAL IDENTITY SERVER. It advantageously includes six parameters: - The alphanumeric string of the DIGITAL IDENTITY CARD of the holder whose identity we want to verify, - The alphanumeric string of the DIGITAL IDENTITY CARD of the identification applicant, - a description of the identification methods to be implemented, - a list of the official identity documents requested (surname, first name, etc.), - an indication of how these documents will be processed, - and the identifier of the terminal responsible for acquiring the video of the holder, which may be that of the holder, that of the verifier or an automated system.

[0029] It can also be in the form of a barcode to be presented to an automaton or a verifier which, with the UNIVERSAL IDENTIFICATION APPLICATION, can send it to the OFFICIAL IDENTITY SERVER in order to verify an identity.

[0030] ILD - THE UNIVERSAL IDENTIFICATION APPLICATION

[0031] Anyone can download it and put it into service by transmitting the alphanumeric string of their DIGITAL IDENTITY CARD.

[0032] Following an IDENTIFICATION REQUEST received by the OFFICIAL IDENTITY SERVER designating the terminal responsible for acquiring the identification means, the application will ask the holder to identify themselves. It will manage the camera and, where applicable, other sensors useful for the operation.

[0033] The UNIVERSAL IDENTIFICATION APPLICATION will also allow its holder to issue an IDENTIFICATION REQUEST, provided that they know the alphanumeric string of the DIGITAL IDENTITY CARD of the person whose identity he wishes to verify.

[0034] While OFFICIAL IDENTITY SERVERS can each be specific to a state or organization, the UNIVERSAL IDENTIFICATION APPLICATION can be common to all countries.

[0035] II - Operation of the IDENTIFICATION SYSTEM

[0036] ILA - Basic operation

[0037] An API allows everyone to send IDENTIFICATION REQUESTS to the OFFICIAL IDENTITY SERVER to identify third parties who wish to be identified, in all use cases.

[0038] This API can be integrated into all government applications and their services, public and private organizations, banks and all other businesses, and even individuals. The UNIVERSAL IDENTIFICATION APPLICATION contains this API and allows anyone to issue an IDENTIFICATION REQUEST.

[0039] In response to an IDENTIFICATION REQUEST, the OFFICIAL IDENTITY SERVER sends a notification to the UNIVERSAL IDENTIFICATION APPLICATION of the designated terminal, for example, the holder's smartphone, requesting it to open. The notification presents the six parameters of the IDENTIFICATION REQUEST, as well as a random and therefore unpredictable phrase that the holder must recite while recording themselves on video. The holder may accept or decline to identify themselves and report any request that seems abusive.

[0040] If the holder agrees to be identified, they say the requested phrase while recording themselves on video. The OFFICIAL IDENTITY SERVER verifies that this video corresponds to the phrase to be spoken and to the person's face. It also verifies, if applicable, other requested means of identification. If successful, it sends the applicant an identification certificate, which may contain official identity details if requested (surname, first name, date of birth, address, etc.) but no biometric information, and in particular no photograph.

[0041] ILB - Issuance of multiple DIGITAL IDENTITY CARDS for the same holder

[0042] A holder may request to receive several DIGITAL IDENTITY CARDS, each with a different appearance; for example, FirstNameLastName lqEK5sO2-SOkLtB4vBriSB6OR may also appear as Dark-MattvcGx5WC9-Lc46e63xeFY2AE26. Both DIGITAL IDENTITY CARDS have exactly the same function and allow for identification in the same way, but may have different uses. One may, for example, be used exclusively for banking, another for a social networking site, and yet another for to respond to advertising offers.

[0043] The interest is to limit the possibilities of analyzing online behavior and collecting personal information which allows the creation of precise user profiles which can then be used to manipulate user behavior, for example by targeting specific advertisements or by changing the price of products according to the user profile.

[0044] ILC - Issuance of DIGITAL IDENTITY CARDS for pseudonyms

[0045] The holder may request that a DIGITAL IDENTITY CARD correspond only to a pseudonym and provide no details of their identity. They may even request to have several cards corresponding to different pseudonyms.

[0046] These pseudonyms allow him to identify himself on social sites under a pseudonym, and therefore to remain anonymous, but the justice system will be able to obtain his identity if it deems it useful to resolve a legal case.

[0047] ILD - The issuance of other dematerialized documents

[0048] ILD1 - Official Documents

[0049] To obtain an official certificate, a holder can visit the website of the relevant administration, log in, and submit a request. They will receive the requested certificate containing the alphanumeric string of their DIGITAL IDENTITY CARD, supplemented by the identifier of the relevant administration and additional information specific to that administration.

[0050] The identifiers of the administrations authorized to use the biometric identification system are set by the body managing the operation and in particular the OFFICIAL IDENTITY SERVER.

[0051] This certificate may also include, if the administration concerned so wishes, information in plain text such as details of the identity of the holder but not biometric information.

[0052] For example, to apply for his dematerialized driving licence, the holder will present his DIGITAL IDENTITY CARD, by sending the corresponding alphanumeric string to the website of the Ministry of the Interior, and will receive his driving licence in the form of a new alphanumeric string allowing a police officer or a car rental company to verify both the essential elements of his identity (name, surname and address for example) and the validity of his driving licence.

[0053] This new alphanumeric string can, like the original string, be represented in the form of a barcode, a file stored in a smartphone, or an internet link allowing the file to be downloaded.

[0054] The method is the same for obtaining a social security card, a hunting license, a disabled card, a parking permit, etc.

[0055] In all cases, only the OFFICIAL IDENTITY SERVER can perform the biometric verification, without the relevant administration having access to the biometric information. During the operation, it verifies that the IDENTIFICATION REQUEST is indeed issued by the relevant administration.

[0056] ILD2 - Other electronic documents

[0057] Any natural or legal person may issue a dematerialized electronic document using the same method, the difference being that the issuing body is in this case a private website. This could be that of a bank or insurance company, a leasing company, or any business or association, and even an individual.

[0058] These may include, for example, payment cards, loyalty cards, membership cards, employee cards, student cards, access control cards, loyalty cards, invitations, etc.

[0059] The only difference from a standard document is that, instead of a photograph, the issued document contains the alphanumeric string of the DIGITAL IDENTITY CARD, with identity verification performed by the OFFICIAL IDENTITY SERVER using the UNIVERSAL IDENTIFICATION APPLICATION. Upon receiving identity confirmation from the OFFICIAL IDENTITY SERVER, the issuing organization can proceed with its operations.

[0060] HL The security of the IDENTIFICATION SYSTEM

[0061] Regarding the limitation of the service to consenting persons, the data controller only responds to the identification request after being informed of the requester's identity, verifying that identity if necessary, and receiving an indication of the intended processing, specifying the reason and justification for the request. This request can only be sent to the data controller via the OFFICIAL IDENTITY SERVER using a dedicated application.

[0062] Misuse of processing by using biometric data for purposes other than those initially intended is not possible since biometric data is not provided, and the video is encrypted during its transfer from the holder to the OFFICIAL IDENTITY SERVER.

[0063] Sharing biometric data with unauthorized third parties is also impossible, since the recipient of the information does not know any biometric details of the holder and cannot even access their photograph

[0064] The risk of error or technical failure of the OFFICIAL IDENTITY SERVER remains, but it is no greater than that of all current or future competing systems.

[0065] The exposure of biometric data to unauthorized access or loss has become zero due to the innovation enabled by the so-called resistant encryption method by brute force.

[0066] Without this innovation, it would be impossible to make such servers available to the public on the Internet, without taking the risk that a quantum computer might consult it to build biometric databases.

[0067] The brute-force resistant encryption method has the particularity that a brute-force attack carried out by a quantum computer could test all possible algorithm identifiers, but all would give different plausible results, i.e., photos that represent a person's face and conform to passport photo standards. No artificial intelligence will be able to determine which one is correct.

[0068] A very important improvement is that the sentence that the person to be identified is asked to present is different for each attempt, and that it would therefore be necessary to ask the holder to make this video a very large number of successive times to have a chance of discovering what algorithm is used, and it would then remain necessary to discover the nature of this algorithm, which can be very complex.

[0069] Similarly, for DIGITAL IDENTITY CARDS issued to legal persons, the video that is requested to be acquired advantageously includes a list of viewpoints in which to place the camera which is unpredictable by the operator responsible for proving the identity of the legal person.

[0070] IV- Some application examples

[0071] IV-A Application Registration

[0072] The first step, illustrated by [Fig. 1], is the commissioning of the UNIVERSAL IDENTIFICATION APPLICATION.

[0073] When the holder has received his Digital Identity Card, he must send it to the OFFICIAL IDENTITY SERVER so that the latter can then send him identification requests.

[0074] This is done with the UNIVERSAL IDENTIFICATION APPLICATION upon its installation.

[0075] IV-B Face-to-face identity check by the police, the gendarmerie or customs

[0076] This method is illustrated by [Fig. 2]. The holder presents to the official considering his DIGITAL IDENTITY CARD on the screen of his Smartphone or on a printed sheet the barcode representing it, which directly queries the OFFICIAL IDENTITY SERVER.

[0077] The method is the same for other official dematerialized documents issued using the same method.

[0078] IV-C Identification during an online or face-to-face transaction

[0079] This method is illustrated in [Fig. 3]. It is identical for all types of transactions: Face-to-face identification of a person by an administration or a company such as a bank, or from one individual to another, online or face-to-face payment, online or face-to-face voting, electronic signature, placing an order, presenting a transport or show ticket or an invitation, participating in a conference call, access control, etc.

[0080] IV-C1 Face-to-face identification of a person by an administration or a company such as a bank, or of an individual by another individual

[0081] The customer presents their DIGITAL IDENTITY CARD to identify themselves and access a service or more generally to get in touch with a third party.

[0082] This presentation can be made face-to-face or online by sending the corresponding alphanumeric string in the most suitable form (sending the alphanumeric string via the Internet or via NFC link, displaying the barcode on the smartphone screen or presenting a document containing it, etc.).

[0083] IV-C2 Access control, presentation of a transport or show ticket, invitation to a public or private event, access card to an Intranet or premises

[0084] When presented for inspection, the holder shows their DIGITAL IDENTITY CARD either on their smartphone screen or printed on a medium. The person or automated system in charge of the inspection records the holder's video, and the OFFICIAL IDENTITY SERVER validates or rejects the holder's identity. The next step in the process is to verify that the holder is indeed among the authorized persons, and if so, to grant access to the holder.

[0085] IV-C3 Online or face-to-face payment

[0086] A payment card issued using this method allows the user to request their bank to make a payment to a third party. Unlike current practices, it is the payer's identity that is verified, and not knowledge of the PIN or cryptographic code in the case of online payments, which could be obtained by a third party.

[0087] The payment request can be made by an IDENTIFICATION REQUEST in which the identity of the identification requester is the beneficiary of the payment, and the indication of the intended processing specifies the references and the amount of the payment.

[0088] IV-C4 Online or face-to-face voting

[0089] The DIGITAL IDENTITY CARD presented to an assessor makes it possible to ensure the identity of the voter much better than the always too quick verification of an identity document and the attempt to analyze a resemblance between this person and the photo of the document.

[0090] Online voting can also be organised once the identity of the voter has been verified, exactly like for online payment except that additional precautions for secrecy may be required.

[0091] IV-C5 Electronic signature, placing an order, registering for a event or social media site

[0092] The method proposed here allows the operator to easily send an IDENTIFICATION REQUEST to the OFFICIAL IDENTITY SERVER, which triggers a rigorous biometric identification sequence that respects personal data. This ensures that it is indeed the signatory who provides their signature and not a collaborator or a fraudster who simply knows the logins and passwords.

[0093] IV-C6 Participation in a telephone or video conference

[0094] Many operators offer audio or video communication methods. The method proposed here allows them to easily send an IDENTIFICATION REQUEST to the OFFICIAL IDENTITY SERVER, which triggers a rigorous biometric identification sequence that respects personal data. This ensures the identity of all participants in an audio or video conversation.

[0095] IV-C7 Verification by the DIGITAL IDENTITY CERTIFICATE of the existence of a natural or legal person in the database of the OFFICIAL IDENTITY SERVER

[0096] This can be a preliminary step to entering into a relationship between two natural or legal persons.

[0097] A person presents their DIGITAL IDENTITY CERTIFICATE to the third party with whom they wish to enter into contact, to indicate to them that, in due course, they will allow them to verify their identity.

[0098] Like the DIGITAL IDENTITY CARD, this certificate can take the form of a barcode, a file stored in a smartphone, or internet links allowing the downloading or sending of such a file.

[0099] The most frequent application will probably be signing classified ads and responding to classified ads.

[0100] V-Miscellaneous Points

[0101] VA One can have several DIGITAL IDENTITY CARDS and several DIGITAL IDENTITY CERTIFICATES, all of which have a different appearance; FirstNameLastNameEK5sO2-SOkLtB4vBriSB6OR can also appear as Dark-MattvcGx5WC9-Lc46e63xeFY2AE26. Both have exactly the same function and allow identification in the same way, but can have different uses. One, for example, can be used exclusively for banking, another for a social networking site, and yet another to respond to advertising offers.

[0102] The aim is to limit the possibilities of analyzing online behavior and collecting personal information that allow the creation of precise user profiles that can then be used to manipulate user behavior, for example by targeting specific advertisements or by changing the price of products based on the user's profile.

[0103] VB One can have DIGITAL IDENTITY CARDS and DIGITAL IDENTITY CERTIFICATES for pseudonyms, by requiring that each DIGITAL IDENTITY CARD and DIGITAL IDENTITY CERTIFICATE correspond to only one pseudonym, and one can have several cards or certificates corresponding to different pseudonyms. Only the justice system will be able to request the identity of the holder, but no one else will be able to know who is hiding behind that pseudonym.

[0104] VC Private Digital Identification Systems can be created; any company or community having the right to register identity photos or other biometric characteristics of its customers, employees, members or partners can create an OFFICIAL IDENTITY SERVER and its own IDENTIFICATION APPLICATION, which can be integrated into its own applications.

[0105] The invention is also an identification system comprising: - an encrypted database concerning natural or legal persons referred to as holders, - a database of encrypted data containing algorithms for decrypting said encrypted data, - elements referred to as digital identity cards, comprising an identifier of one of said holders and an identifier of said algorithm for decrypting said encrypted data relating to said identifier, - and a so-called universal identification application controlling an optical acquisition device, characterized in that it implements the process of claim 1

[0106] VL CONCLUSION

[0107] By exploiting the power of the IDENTIFICATION SYSTEM which is the subject of the present invention, it becomes possible to generalize the digital identity of natural and legal persons and to offer a secure, universal and privacy-respecting solution.

[0108] This approach guarantees individuals control over their biometric information, significantly reduces the risks of identity theft or unauthorized use, and considerably reduces all risks incurred by third parties by fraudsters who have usurped the identity of a natural or legal person. Applications

[0109] The main applications are digital identity, of which the holder may only need to retain an identifier, in printed or electronic form, to identify themselves, as well as to guarantee the origin of any document or internet page.

Claims

Claims

1. Identification method implementing - an encrypted database concerning natural or legal persons known as holders, - a database of algorithms for decrypting said encrypted data, - elements called digital identity cards, comprising an identifier of one of said holders and an identifier of said algorithm for decrypting said encrypted data relating to said holder, - and software called a universal identification application controlling an optical acquisition means, characterized in that said universal identification application - carries out an optical acquisition of said holder or of an element in his possession, - sends this acquisition to a computer called an official identity server as well as the said identifiers of the holder and the said decryption algorithm, so that said official identity server can decrypt said encrypted data of said holder, and compare the result with the optical acquisition of said holder or said element in his possession, and validate or not the identity of said holder.

2. Identification system comprising: - an encrypted database concerning natural or legal persons known as holders, - an encrypted database concerning algorithms for decrypting said encrypted data, - elements called digital identity cards, comprising an identifier of one of said holders and an identifier of said algorithm for decrypting said encrypted data relating to said identifier, - and an application called universal identification application controlling an optical acquisition means, characterized in that it implements the method of claim 1

Images