Secure dataset and procedure for issuing and reading such a dataset

Abstract

The invention is a secure data set containing an unintelligible digital file located on a server at a specific address, and a signed digital or alphanumeric data item containing that address, the data enabling the unintelligible file to be readable, an integrity control element for the unintelligible file, and optionally other information. The unintelligible file and the digital or alphanumeric data item together contain a data set that cannot be easily assembled by a fraudster. Thus, a short digital or alphanumeric data item, which can be represented by a small barcode, is sufficient to make large volumes of secure information, such as a high-definition image, an audio file, or a video, available to a recipient. Abstract figure: Fig. 1

Description

Title of the invention: Secure data set and procedure for transmitting and reading such a set Technical field

[0001] The invention is a means of securing a set of data to enable their transmission from a transmitter to a receiver. Prior art

[0002] We know of methods for verifying a file by an element controlling its integrity, a hash, a checksum or a digital signature for example.

[0003] Data verification devices are also known which consist of providing a file containing the data in question with such a control element.

[0004] Such devices are known in which all or part of a file or its access link is represented by a string of numeric or alphanumeric characters and it is known how to sign such strings to guarantee their origin and integrity. It is also known how to represent such strings by barcodes.

[0005] Finally, we know of a method of giving a person a digital identity by providing them with a signed file containing their photograph and all the details of their identity. Technical problem

[0006] Representing a medium such as a photo, sound recording or video by a string of numeric or alphanumeric characters is not easy to understand.

[0007] Barcodes that allow such character strings to be represented can easily contain complex data such as alphanumeric references, names, addresses. However, it is difficult to add data from such a medium to them because this data is very voluminous and would lead to barcodes with a very high density, therefore difficult to print and read or very large in size.

[0008] A digital identity composed of a file containing sensitive information such as identity elements, for example an identity photo, even provided with an element for controlling this information, has the disadvantage of making this file available to third parties, which is sensitive and could allow the creation of false identity documents.

[0009] The objective of the present invention is to enable the transmission of large or sensitive information elements to a receiver, while providing these information elements with a means of controlling their integrity and protecting them against fraud. Brief description of the drawings

[0010] The invention will be well understood, and other aims, advantages and characteristics thereof will appear more clearly on reading the description which follows, which is illustrated by [Fig. 1].

[0011] [Fig. 1] is a diagram showing a procedure for reading and verifying a digital file according to the invention. The receiver reads the signed barcode containing the address of a digital file on a data server and an integrity control element of this digital file. It verifies this barcode by its electronic signature by contacting, if necessary, a signature server, and then transmits the address of the digital file to the data server containing the digital file. It receives the digital file in return and verifies it by the integrity control element. Presentation of the invention

[0012] The invention is a data set comprising - on the one hand a first subset of data which is not totally intelligible, hereinafter called unintelligible file, - and on the other hand a second subset of data hereinafter called message-signifier provided with a means of controlling its integrity, characterized in that: - and said significant message contains data making it possible to make all or part of said unintelligible file more intelligible, it being specified that the term “means of integrity control” means any known means of verifying that data has not been altered, such as, for example, a hash, a checksum or an electronic signature or even a total or partial description of this data. Detailed description of the invention

[0013] The principle of the present invention is to separate a first set of data from a second of a different nature and / or transmitted by a different channel, so that they cannot simultaneously be intercepted by a spy and / or modified by a fraudster. The two files are necessary to obtain the secure data that the sender wanted to be transmitted to a receiver.

[0014] The data set may, for example, contain a face, a landscape, an object, a fingerprint, DNA, a hologram or other type of three-dimensional marking, an existing protected identity document, a printed photograph, or an animated film, text, or any multimedia element.

[0015] Each of the two subsets of data can for example be a digital multimedia file, a barcode, a text message, a sound, an email, a item stored in an NFC chip or other data storage medium.

[0016] The meaningful message can be used alone, and it already has a great value since it is protected by an integrity control means, which can advantageously be a digital signature. It can contain a first series of data that is not very confidential, but the advantage of the present invention is to be able to use it in combination with said unintelligible file to have more complete information which can be more voluminous and / or more sensitive.

[0017] The principle of the present invention is based on the fact that the unintelligible file cannot be used effectively without having the meaningful message. It is therefore advantageous that no part of the unintelligible file contains data allowing one to know what the meaningful message is that it allows to make it intelligible.

[0018] This does not mean that all the data in the unintelligible file are automatically made intelligible by the combination with the meaningful message, because different meaningful messages can be sent to make different parts of the unintelligible file intelligible.

[0019] More generally, the present invention makes it possible to construct a complex data system comprising several subsets of data, and to allow the understanding and use of all or part of one of the subsets only in combination with all or part of another subset of the system.

[0020] The message-signifier can be a barcode protected by a means of controlling its integrity such as a hash, a checksum or better a digital signature allowing its author to be identified and its non-repudiation to be verified. In a preferred version, it is a Visible Electronic Seal CEV compliant with the AFNOR XP Z42-105 standard, which allows it to be interoperable.

[0021] The means for checking the integrity of the unintelligible file can be incorporated in the unintelligible file as well as in the meaningful message. It is also possible to provide the data set with two integrity checking means, one in the unintelligible file and the other in the meaningful message. The preferred solution, however, is for it to be integrated in the meaningful message so as to be independent of the unintelligible file. Similarly, it may be advantageous to provide the unintelligible file with a means for checking the integrity of the meaningful message.

[0022] On the other hand, it is important that the data making it possible to make the unintelligible file more intelligible are not entirely contained in this unintelligible file, but that at least part of them are contained in the significant message.

[0023] A single photo file made unintelligible by encryption or deletion of part of the data makes it possible to create a large number of means of identity with meaningful messages such as different barcodes, each containing different data (driving license, identity card, social security card, certificate of majority, invitation to an event, transport ticket for example).

[0024] To take an example, the unintelligible file is a digital file located on a server accessible by a network at an address, and the signifier message includes this address or a means of obtaining it.

[0025] The unintelligible file can be located on a computer or a smartphone, but it can also be remote and protected against unauthorized access.

[0026] When a person with the meaningful message has received an unintelligible file that can be made intelligible by this meaningful message, they can store it on their Smartphone to have the complete and intelligible data set. This can therefore be a way of providing them with a digital identity, for example.

[0027] In a particular version, the message-signifier may only be readable by a particular application that stores it in a secure memory with limited access on a Smartphone or a computer, without providing the content to the user of this device. This message-signifier can then only be called by this application or another one that is complementary to it, on command of a third party authorized to combine the message-signifier and the unintelligible file.

[0028] The reference and / or address and / or of the unintelligible file is advantageously complicated to be unpredictable. Advantageously, no part of the unintelligible file contains data allowing one to know what the significant message is that it makes it possible to make intelligible.

[0029] To take an example, the message-signifier contains the identity information of a person, and the digital file is their high-resolution identity photo, or biometric data allowing them to be recognized. This information can only be obtained from the server that contains it by sending the latter their address or their reference. In an improved version, it is not the real address that is contained in the message-signifier, but a link allowing it to be obtained after having justified ad-hoc authorization.

[0030] Advantageously, an identity photo is not accompanied on the server by any information other than its address or reference, so that hacking this server does not allow information data to be reconstituted, for example identity databases or identity cards.

[0031] A degraded version of the digital file may be attached to the meaningful message. The meaningful message may, for example, be printed or displayed on a copy of this degraded version.

[0032] A web server or a web page or any document or product can be provided with a meaningful message used for example to verify information relating to this element which can be the identity of the natural or legal person who is responsible for it, and this message-meaning can be seen in the form of an html link or in the form of a barcode or in any other form.

[0033] An unintelligible file, once made intelligible, may be an image representation of all or part of the information contained in the meaningful message. For example, it may be a copy of a prescription, the details of which are indicated in whole or in part in the meaningful message.

[0034] To transmit such a secure data set, the transmitter deposits a copy of an unintelligible file on a data server accessible by a network at an address, and transmits an electronically signed significant message comprising an integrity control element of this unintelligible file and a means such as the address allowing access to it.

[0035] To read and certify the document, the receiver reads the signed message-signifier, verifies its integrity and authenticity by its consistency with its digital signature, verifies the non-repudiation of this digital signature, downloads the unintelligible file from the data server from the address and verifies the integrity and authenticity of the unintelligible file by the integrity control element.

[0036] In a variant, the receiver can also read the signed significant message, verify its integrity and authenticity by its consistency with the digital signature, verify the non-repudiation of the digital signature, send the integrity control element to the data server, so that the server verifies the integrity and authenticity of the unintelligible file and makes available a modified copy, for example degraded, of the unintelligible file made intelligible, so that the modified copy can be downloaded.

[0037] This modified copy may, for example, be in a lower resolution, or contain only part of the digital file, or may have received subtle color modifications to make it unique. This will make it possible to detect, with the appropriate tools, the use of a copy thus modified which could be abusive. The modifications may be different from one modified copy to another provided subsequently, so that each can be recognized.

[0038] The reading and certification method according to the invention may include a procedure for identifying the person implementing it, so that no information relating to the unintelligible file is transmitted without this identification procedure having led to authorizing such transmission. This has the advantage of avoiding the abusive downloading of the data contained in the data file and may, in the case of making a modified copy available, make it possible to identify the person who carried out its conservation and possible dissemination.

[0039] Here is an example of how a document issuing service works: secure.

[0040] Step 1: after having identified itself using an agreed identification method (for example by the combination of an identifier and a password or by strong identification), the sender sends to the operator's server a request comprising two sets of information: - information to be included in the message-signifier called code-information, - information forming the digital file(s) to be made unintelligible, and the parameters of the operation such as for example: - the need or not to verify the identity of the recipient(s) and, where applicable, the identity elements to be verified, - the complete or degraded form in which the digital file(s) must be provided to the sender if they request to download them, this form being able to vary depending on the recipient. In one variant, the operator's server receives information and deduces from it, according to an agreed rule, the information to be included in the message-signifier, that forming the unintelligible file, and the parameters of the operation.

[0041] Step 2: the operator's server - calculates from the digital file(s) the unintelligible files and an integrity control element of this or these unintelligible files, or of several control elements each corresponding to one or more unintelligible files, - stores unintelligible files on a digital file server (which may be the operator's server), - composes a signed meaningful message containing - the code information, - the address of the file server and the reference(s) of the unintelligible file(s) on that file server, - the integrity control element(s) of the unintelligible file(s), - and the digital signature of this set, - and transfers the signed message-signifier to the sender, in response to his request, as well as optionally a copy of the digital file(s). In a preferred variant for the application of the present invention to the identification of persons by biometrics, the operator's server divides the data set received from the transmitter into two parts, the first being integrated into the unintelligible file which is stored on the server and the second being integrated into the significant message.

[0042] Step 3: the sender communicates to one or more receivers the signed meaningful message, either alone or accompanied by a copy of the unintelligible file(s) which can be modified as indicated above.

[0043] Step 4: a receiver - reads the signed message-signifier, which communicates to him - the code information, - the address of the file server and the reference(s) of the intelligible file(s), - the integrity control element(s) of this or these unintelligible files, - the digital signature of this signed message-signifier, and where applicable the copy(ies) of the unintelligible file(s) which were communicated to him with the message-signifier, - verifies or has verified the integrity and authenticity of the data concerned by their consistency with said digital signature, - verifies or has verified the non-repudiation of the digital signature, - identifies itself to the operator's server using the agreed identification method if such identification is provided for by the parameters, - indicates to the operator's server the reference(s) read in the signed message-signifier, - and, depending on the operation parameters: - or receives the file(s) whose provision is planned and checks their compatibility with the integrity control element(s) of the file(s) concerned, - or sends the received control element(s) to the server, so that the server can check compatibility with the digital file(s) before transmitting them to it, optionally in modified form, - or sends to the server the copy of the unintelligible file(s) that it has received and the control element(s) received, so that the server can indicate whether this or these copies is (are) compatible with the corresponding unintelligible file(s). In the preferred variant for the application of the present invention to the identification of persons by biometrics, the receiver receives the unintelligible file(s) whose provision is planned and completes them with the part(s) of the original file(s) integrated in the significant message, verifies their compatibility with the integrity control element(s) of the unintelligible file(s) received or with this file completed by the part(s) of the original file(s) integrated in the significant message.

[0044] Here is an example of how an identification service works: - step 1: the person wishing to identify themselves connects to a computer system called an identification center - step 2: she communicates to him all or part of the meaningful message relating to his identity; - step 3: the identification center asks the person in question to acquire one of their determined biometric elements and to compare them with the description of the corresponding biometric element contained in the set formed by the significant message and the unintelligible file; - step 4: the person in question carries out this comparison locally, with a computer application resident on their computer or smartphone, and communicates the result of this comparison to the identification center; - step 5: the computer system sends the result to a designated person. If the person has been identified, they can continue their operations with this designated person.

[0045] In the case where this identification service has an access control function,

[0046] - step 1: the person wishing to benefit from access reads the access identifier requested, for example by scanning a barcode identifying this access, or by clicking on a link with the same function. - step 2: it communicates to an identification center this identifier and all or part of the significant message relating to its identity; - step 3: the identification center asks the person in question to acquire one of their determined biometric elements and to compare them with the description of the corresponding biometric element contained in the set formed by the significant message and the unintelligible file; - step 4: the person in question carries out this comparison locally, with a computer application resident on their computer or smartphone, and communicates the result of this comparison to the identification center; - Step 5: The computer system sends the result to the operator responsible for access. If the person has been identified and their identity has been granted access rights, they can access the corresponding premises or service.

[0047] Only the Smartphone or computer used to open access has the biometric information of the person concerned to carry out the comparison of his biometrics with his biometric information recorded in the set formed by the significant message and the unintelligible file. If this Smartphone or computer is that of the holder, this biometric information can be contained in its memory, and if it is that of a third party, it is obtained by combining the certificate (e.g. barcode) and the encrypted file downloaded from the identity server, but the secure application used by this Smartphone or computer erases this information as soon as the comparison is complete.

[0048] Various improvements can be envisaged:

[0049] An unintelligible file can be cut into separate pieces and placed at unrelated addresses so that no one can put them together without having the meaningful message. It can also be encrypted and can only be decrypted by the sender or the operator of the operator's server.

[0050] All or part of the content of the message-signifier can be encrypted by the operator's server, the only one to know this key, and it is when the message-signifier is sent to the server that the decryption takes place. In the case where access to the server is limited by authorizations that the receiver must have, no one other than the receiver can initiate this decryption. The message-signifier cannot be decrypted by the receiver but only by the operator of the operator's server or by the sender.

[0051] All or part of the unintelligible file stored on the server and which can be downloaded by the receiver is encrypted with a key which is included in the meaningful message. This encryption can be specific to each unintelligible file to be unique, which means that knowledge of an encryption rule relating to an unintelligible file cannot allow decrypting another unintelligible file.

[0052] The unintelligible file may have an expiration date or be associated with such a date, so that after the date in question, it can no longer be downloaded.

[0053] An unintelligible file can be invalidated by a slight modification, carried out by the operator or by the transmitter if he is authorized to cause it. It results in an incompatibility between the control element and the file which therefore becomes invalid. This modification can be designed to be imperceptible and not to prevent the design of a new message-signifier to put the unintelligible file back into service in its current state.

[0054] The operator can issue different barcodes containing different information, for example partial information. This allows, for example, a public administration to issue certificates of majority for consulting adult websites.

[0055] The operator can issue barcodes enabling a person to be identified by their identity photograph, the message-signifier containing only a pseudonym instead of the identity details of the holder. The latter will be able to sign messages with their pseudonym, appear as someone who does not want to give their real identity while showing that it does indeed exist and may be revealed by the operator under certain conditions, for example by a court decision.

[0056] The main advantages of the present invention are that, - by reading the message-signifier, the receiver can verify the integrity of the code-information and optionally of the unintelligible-file, - the signature of the message-signifier can be revoked, - unintelligible files are stored on a storage medium that may be more secure than that of the sender, - data sets can be rendered unusable by encryption, cutting into pieces as explained above, - unintelligible files are stored separately from code information which prevents a hacker from putting them together to form a complete piece of information, - reading and understanding of unintelligible files may be reserved for authorized persons only, in whole or in part depending on the authorizations they have and which they have communicated to the file server delivering the unintelligible files. Applications

[0057] The main applications are - digital identity, the holder of which may only keep a signed meaningful message, in printed or electronic form, to identify himself, - medical prescriptions, certificates and attestations of all kinds, contracts, purchase orders, invoices, etc. which can be easily authenticated by their recipients, - music or video on demand services, newspapers and magazines, video games, means of controlling connected objects, - and generally the securing of any type of large or sensitive data.

Claims

Claims

1. Data set comprising - on the one hand a first subset of data which is not totally intelligible, hereinafter called unintelligible-file, - and on the other hand a second subset of data hereinafter called significant-message provided with a means of checking its integrity, characterized in that: - and said significant-message contains data making it possible to make all or part of said unintelligible-file more intelligible, it being specified that the term integrity checking means is understood above to mean any known means making it possible to verify that data has not been altered, such as for example a hash, a checksum or an electronic signature or even a total or partial description of this data

2. Data set according to claim 1 characterized in that said two data sets are each received by a different channel or at different times or are of a different nature.

3. Data set according to any one of the preceding claims, characterized in that said unintelligible file is protected by a means for controlling the integrity of all or part of said unintelligible file, and that this means is integrated into said significant message.

4. Data set according to any one of the preceding claims, characterized in that said or one of said integrity control means is a mechanism - for example an electronic signature - making it possible not only to verify the integrity of a data set but also to know the author and to guarantee non-repudiation.

5. Data set according to any one of the preceding claims, characterized in that said message-signifier is stored in a secure memory with limited access of a Smartphone or a computer, and can only be called by an application on command of a third party authorized to combine said message-signifier and said unintelligible file.

6. Data set according to any one of the preceding claims, characterized in that no part of said unintelligible file contains data making it possible to know what said significant message is that it makes it possible to make intelligible.

7. A data set according to any one of the preceding claims- characterized in that: - said unintelligible file is a digital file located on a server, - said meaningful message includes a means of downloading the file - for example a reference or the internet address of said unintelligible file on said server, - and said data making it possible to make said unintelligible file intelligible are a decryption key and / or information elements which are missing from said unintelligible file to be intelligible.

8. Data set according to any one of the preceding claims, characterized in that said unintelligible file comprises data from a multimedia file which has been encrypted or part of which has been deleted to make it unintelligible, and that there are several significant messages each comprising different information to be adapted to different use cases.

9. Method for transmitting a set of data according to any one of claims 1 to 8 comprising the following steps: - Step 1: creation of an unintelligible file by encryption or deletion of part of the data of a file - Step 2: creation of a significant message containing data making it possible to make said unintelligible file intelligible - Step 3: incorporation into said significant message of a means of controlling its integrity.

10. Method for reading a data set according to any one of claims 1 to 8 comprising the following steps: - Step 1: reading said significant message, - Step 2: verifying the integrity of said significant message by its consistency with said integrity control means with which it is equipped, - Step 3: reading said unintelligible file, - Step 4: modifying said unintelligible file by decrypting or adding the information elements which it lacks to be intelligible, with data contained in said significant message.

Images