Secure dataset and procedure for issuing and reading such a dataset

Abstract

The invention is a secure data set containing an electronically signed digital file located on a server and an electronically signed digital or alphanumeric data item including this address and an integrity control element for the digital file in question, and optionally other information. The advantage is that each of these two elements, the file on the one hand and the digital or alphanumeric data item on the other, contains complementary data that cannot be easily gathered by a fraudster, and that a short digital or alphanumeric data item, which can be represented by a small barcode, is sufficient to make large volumes of secure information available to a reader, such as a high-definition image, an audio file, or a video, for example. Abstract figure: Fig. 1

Description

Title of the invention: Secure data set and procedure for transmitting and reading such a set Technical field

[0001] The invention is a means of securing a set of data, some of which are large, such as a photograph, a sound file, a video, an HTML page or a set of HTML pages or three-dimensional plans, for example. Prior art

[0002] We know of methods for verifying a file by an element controlling its integrity, such as a hash or a checksum for example.

[0003] Devices for verifying identity data are also known which consist of providing a file containing the data in question with such a control element.

[0004] Such devices are known in which all or part of a file or its access link is represented by a string of numeric or alphanumeric characters and it is known how to sign such strings to guarantee their origin and integrity. It is also known how to represent such strings by barcodes.

[0005] Finally, we know of a method of giving a person a digital identity by providing them with a signed file containing their photograph and all the details of their identity. Technical problem

[0006] The representation of a medium such as a photo, a sound recording or a video by a string of numeric or alphanumeric characters is not intelligible, and barcodes can contain complex data such as alphanumeric references, names, addresses, but it is difficult to add the data of such a medium to them because this data is very voluminous and would lead to barcodes with a very high density, therefore difficult to print and read or very large in size.

[0007] A digital identity composed of a file containing identity information including a medium such as an identity photo and an element for controlling this information, has the disadvantage of making this file available to third parties, which is sensitive and could allow the creation of false identity documents.

[0008] The objective of the present invention is to enable the transmission of large or sensitive information elements to a reader, while providing these information elements with a means of controlling their integrity and protecting them against fraud. Brief description of the drawings

[0009] The invention will be well understood, and other objects, advantages and characteristics thereof will appear more clearly on reading the description which follows, which is illustrated by [Fig.l].

[0010] [Fig.l] is a diagram showing a procedure for reading and verifying a digital file according to the invention. The reader reads the signed barcode containing the address of a digital file on a data server and an integrity control element of this digital file. It verifies this barcode by its electronic signature by contacting, if necessary, a signature server, and then transmits the address of the digital file to the data server containing the digital file. It receives the digital file in return and verifies it by the integrity control element. Presentation of the invention

[0011] The invention is a secure data set comprising - on the one hand a digital file located on a server accessible at an address, - and on the other hand a digital or alphanumeric data hereinafter called a significant message comprising a means of obtaining said address, - said significant message being electronically signed, characterized in that said significant message also contains additional information making it possible to make said digital file intelligible and / or an element of integrity control of said digital file. Detailed description of the invention

[0012] The principle of the present invention is to separate a digital file located on a server accessible by a network at an address, from the electronically signed message-signifier comprising this address or a means of obtaining it, and to provide this message-signifier with an element for controlling the integrity of said digital file. This server can be located on a computer or a Smartphone of the sender of the secure data set, but it is advantageously remote and protected against unauthorized consultations.

[0013] This control element is for example a hash or a checksum.

[0014] The address is advantageously complicated to be unpredictable.

[0015] To take an example, the message-signifier contains the identity information of a person, and the digital file is his high-resolution identity photo, or biometric data allowing him to be recognized. This information can only be obtained from the server by sending to the server that contains it their address or their reference. In an improved version, it is not the real address that is contained in the message-signifier, but a link allowing it to be obtained after having justified a compliant authorization

[0016] A degraded version of the digital file may be attached to the meaningful message. The meaningful message may, for example, be printed or displayed on a copy of this version.

[0017] Advantageously, the photo is not accompanied on the server by any information other than its address or reference, so that hacking this server does not allow information data to be reconstituted, for example identity databases or identity cards.

[0018] A web server or a web page or any document or product can be provided with a meaningful message serving for example to verify the identity of their owner, and this meaningful message can be seen in the form of an html link or in the form of a barcode or in any other form.

[0019] A digital file may be an image representation of all or part of the information contained in the message-signifier. For example, it may be a copy of a prescription whose details are indicated in the message-signifier.

[0020] To issue such a secure data set, the issuer deposits a copy of a digital file on a data server accessible via a network at an address, and issues an electronically signed message-signifier comprising an integrity control element for this digital file and a means such as the address for accessing it.

[0021] To read and certify the document, the reader reads the signed message-signifier, verifies its integrity and authenticity by its consistency with the digital signature, verifies the non-repudiation of the digital signature, downloads the digital file from the address from the data server and verifies the integrity and authenticity of the digital file by the integrity control element.

[0022] In a variant, the reader can also read the signed message-signifier, verify its integrity and authenticity by its consistency with the digital signature, verify the non-repudiation of the digital signature, send the integrity control element to the data server, so that the server verifies the integrity and authenticity of the digital file and makes available a modified copy, for example degraded, of the digital file, and download the modified copy from the server.

[0023] This modified copy may, for example, be in a lower resolution, or contain only part of the digital file, or may have received subtle color modifications to make it unique. This ensures that the reader will not be able to reconstruct a file identical to the one hosted on the data server.

[0024] The reading and certification method according to the invention may include a procedure for identifying the person implementing it, so that no information relating to the digital file is transmitted without this identification procedure having led to authorizing such transmission. This has the advantage of avoiding the abusive downloading of data contained in the data file.

[0025] In a preferred variant for the application of the present invention to the identification of persons by biometrics, the digital file stored by the server and made available to the reader is partial so as to be unintelligible, and it can only be read by combination with elements of the complete digital file which are included in the message-signifier. This guarantees that a hacker having access to the file server or listening to a conversation between this server and a reader will not be able to reestablish an intelligible copy of the digital file. The identity control element can relate both to the unintelligible partial file and to the complete file obtained by combining the transmitted file with elements of the complete digital file which are included in the message-signifier.

[0026] Here is an example of how a secure document issuing service works.

[0027] Step 1: after having identified itself using an agreed identification method (for example by the combination of an identifier and a password or by strong identification), the sender sends to the operator's server a request comprising two sets of information: - information to be included in the message-signifier called code-information, - information forming the digital file(s), and the parameters of the operation such as for example: - the need or not to verify the identity of the reader(s) and, if applicable, the identity elements to be verified, - the complete or degraded form in which the digital file(s) must be provided to the sender if they request to download them, this form being able to vary depending on the reader. In one variant, the operator's server receives information and deduces from it, according to an agreed rule, the information to be included in the message-signifier, that forming the digital file, and the parameters of the operation.

[0028] Step 2: the operator's server - calculates from the digital file(s) an integrity control element of the digital file(s), or of several control elements each corresponding to one or more digital files, - stores the digital file(s) on a digital file server (which may be the operator's server), - composes a signed meaningful message containing - the code information, - the address of the file server and the reference(s) of the digital file(s) on this file server, - the integrity control element(s) of the digital file(s), - and the digital signature of this set, - and transfers the signed message-signifier to the sender, in response to his request, as well as optionally a copy of the digital file(s). In a preferred variant for the application of the present invention to the identification of persons by biometrics, the operator's server divides the information forming the digital file received from the transmitter into two parts, the first being integrated into the digital file which is stored on the server and the second being integrated into the message-signifier. This has the effect that the digital file is unintelligible and can only become so for the recipient having the message-signifier and being able to therefore combine it with the missing part which is included in the message-signifier.

[0029] Step 3: the sender communicates to one or more readers the signed message-signifier, either alone or accompanied by a copy of the digital file(s) which can be modified (to a lower resolution for example).

[0030] Step 4: a reader - reads the signed message-signifier, which communicates to him - the code information, - the address of the file server and the reference(s) of the digital file(s), - the integrity control element(s) of this or these digital file(s), - and the digital signature of this signed message-signifier, and where applicable the copy(ies) of the digital file(s) which were communicated to him with the message-signifier, - verifies or has verified the integrity and authenticity by its consistency with said digital signature, - verifies or has verified the non-repudiation of the digital signature, - identifies itself to the operator's server using the agreed identification method if such identification is provided for by the parameters, - indicates to the operator's server the reference(s) read in the signed message-signifier, - and, depending on the operation parameters: - either receives the file(s) whose delivery is planned and checks their compatibility with the integrity control element(s) of the file(s), - or sends the received control element(s) to the server, so that the server can check their compatibility with the digital file(s) before transmitting them to it, optionally in modified form, - or sends to the server the copy of the digital file(s) that it has received and the control element(s) received, so that the server can indicate whether this or these copy(ies) is (are) indeed representative of the corresponding digital file(s). In the preferred variant for the application of the present invention to the identification of persons by biometrics, the reader receives the unintelligible file(s) whose provision is planned and completes them with the part(s) of the original file(s) integrated in the message-signifier, checks their compatibility with the integrity control element(s) of the unintelligible file(s) received or with this file completed by the part(s) of the original file(s) integrated in the message-signifier.

[0031] Various improvements can be envisaged:

[0032] A digital file can be cut into separate pieces and placed at unrelated addresses so that no one can put them together without the meaningful message. It can also be encrypted and can only be decrypted by the sender or the operator of the operator's server.

[0033] All or part of the content of the message-signifier can be encrypted by the operator's server, the only one to know this key, and it is when the message-signifier is sent to the server that the decryption takes place. In the case where access to the server is limited by authorizations that the reader must have, no one other than the reader can launch this decryption. The message-signifier cannot be decrypted by the reader but only by the operator of the operator's server or by the sender.

[0034] All or part of the digital file stored on the server and which can be downloaded by the reader is encrypted with a key which is included in the message-signifier. This encryption can be specific to each digital file to be unique, which means that knowledge of an encryption rule relating to a digital file cannot allow another digital file to be decrypted.

[0035] The digital file may have an expiry date or be associated with such a date, so that after the date in question, it can no longer be downloaded.

[0036] A digital file may be invalidated by a slight modification, carried out by the operator or by the transmitter if he is authorized to cause it. It results in an incompatibility between the control element and the file which therefore becomes invalid. This modification can be designed to be imperceptible and not to prevent the design of a new message-signifier to put the digital file back into service as is.

[0037] The operator can issue different barcodes containing different information, for example partial information. This allows, for example, a public administration to issue certificates of majority for consulting adult websites.

[0038] The operator can issue barcodes enabling a person to be identified by their identity photograph, the message-signifier containing only a pseudonym instead of the identity details of the holder. The latter will be able to sign messages with their pseudonym, appear as someone who does not want to give their real identity while showing that it does indeed exist and may be revealed by the operator under certain conditions, for example by a court decision.

[0039] The main advantages of the present invention are that, - by reading the message-signifier, the reader can verify the integrity of the code-information and digital files, - the signature of the message-signifier can be revoked, - digital files are stored on a storage medium that may be more secure than that of the sender, - digital files can be rendered unusable by encryption, cutting into pieces as explained above, - digital files are stored separately from code information, which prevents a hacker from gathering them to form complete information, - reading of digital files can be restricted to authorized persons only. Applications

[0040] The main applications are - digital identity, the holder of which may only keep a signed meaningful message, in printed or electronic form, to identify himself, - medical prescriptions, certificates and attestations of all kinds, contracts, purchase orders, invoices, etc. which can be easily authenticated by their readers, - music or video on demand services, newspapers and magazines, video games, means of controlling connected objects, - and generally the securing of any type of large or sensitive data.

Claims

Claims

1. Secure data set comprising - on the one hand a digital file located on a server accessible at an address, - and on the other hand a digital or alphanumeric data item hereinafter referred to as a signifying message comprising a means of obtaining said address, - said signifying message being electronically signed, characterized in that said signifying message also contains additional information making it possible to make said digital file intelligible and / or an integrity control element of said digital file.

2. Secure data set according to claim 1 characterized in that the digital file is partial to be unintelligible, and can only be read by combination with elements included in the message-signifier.

3. Method for issuing secure documents according to claim 1 or claim 2 comprising the following steps: - Step 1 carried out by the sender: sending to a server called the operator's server a request comprising two sets of information: - information called code information to be encoded in the signifier message, - information forming said digital file, - Step 2 carried out by said operator's server: - calculation, from said digital file, of an integrity control element of said digital file, - storage of said digital file on a digital file server, - composition of a signifier message containing - said code information, - the address of said file server and the reference of said digital file on said file server, - said integrity control element of said digital file, - and said digital signature of this set,- transfer of said signed message-signifier to said sender, in response to his request, as well as optionally a copy of the digital file.,

4. Method for issuing secure documents according to claim 3 further comprising a step 3 carried out by said issuer consisting of communicating to a reader said signed message-signifier, either alone or accompanied by a copy of said digital file which can optionally be degraded.

5. Method for reading and certifying a secure data set according to claim 1 or claim 2 consisting of - reading said signed message-signifier, - verifying or having verified its integrity and authenticity by its consistency with said digital signature, - verifying or having verified the non-repudiation of said digital signature, - downloading said digital file from said address, - and verifying the integrity and authenticity of said digital file by said integrity control element.

6. Method for reading and certifying a secure data set according to claim 1 or claim 2 consisting of - reading said signed message-signifier, - verifying or having verified its integrity and authenticity by its consistency with said digital signature, - verifying or having verified the non-repudiation of said digital signature, - sending said integrity control element to said server, so that said server verifies the integrity and authenticity of said digital file, and makes said digital file or a modified copy of this digital file available to said reader, - downloading said file or said modified copy of this file from said server.

7. Method for reading and certifying a secure data set according to claim 1 or claim 2 consisting of - reading said signed message-signifier, - verifying or having verified its integrity and authenticity by its consistency with said digital signature, - verifying or having verified the non-repudiation of said digital signature, - sending to said server a copy of said digital file and said control element previously received by said sender, so that the server indicates to said reader whether said copy is indeed representative of said digital file.

8. Reading and certification method according to any one of claims 5 to 7, characterized in that it comprises a procedure for identifying the reader implementing it, and that no information relating to said digital file is transmitted without this identification procedure having led to authorizing such transmission.

9. Secure data set issued according to claim 3 or claim 4 characterized in that all or part of said message-signifier is encrypted and cannot be decrypted by said reader.

10. Secure data set issued according to claim 3 or claim 4 characterized in that the digital file is cut into separate pieces located at addresses which have no link between them.

Images