Methods for generating, providing and managing certified identity profiles, and electronic identity wallets

Abstract

Methods for Generating, Providing, and Managing Certified Identity Profiles, and Electronic Identity Wallets. The invention relates to methods for generating, providing, and managing certified identity profiles, and an electronic identity wallet. One object of the invention is a method for generating certified identity profiles associated with a user account in an electronic identity wallet. The generation method comprises: selecting identity data for a certified identity profile from a set of identity data received from at least one certified identity provider associated with the user account, and then integrating the selected identity data into the recipient certified identity profile. This will reduce the risk of service delivery errors and service delivery failures.Another advantage is the reduction in the transmission time of identity data via the electronic wallet, and the processing time required by the service provider when requesting identity data. See Figure 1 for the summary.

Description

Title of the invention: Methods for generating, providing and managing certified identity profiles, and electronic identity wallet Technical field

[0001] The invention lies in the field of digital identity management. It relates to methods for generating, providing and managing certified identity profiles, and an electronic identity wallet. State of the art

[0002] Many service providers, online or locally, require the provision of user identity elements in order to deliver their service. Traditionally, in a non-digital world, this provision of identity elements is carried out using physical documents issued by official authorities (identity card, driving license, etc.) and various supporting documents issued by recognized third-party certifiers (energy bill, telecom bill, medical certificate, etc.)

[0003] The development of services accessible via the Internet requires the implementation of dedicated tools allowing the digitization of the elements present on the aforementioned media, possibly in a structured manner, and authorizing their sharing with the service provider after consent from the user. With this in mind, in the field of identity management, a solution that centralizes the user's identity elements and authorizes, under the user's control, access by the service to all or part of the user's identity elements is proposed in particular by using an OIDC protocol (for "OpenID Connect" in English).Therefore, today, if a service provider requires certified identity data, in particular for the creation and / or modification of a user account for one or more services provided by this service provider, the solution is to put the service provider in contact with a certified identity provider with which the user has previously registered.

[0004] However, the service provider then has knowledge of the user's certified identity provider and access to all the identity data concerning the user at this identity provider. Furthermore, a single identity provider may not have all the identity data required by the service provider.

[0005] In addition, the identity provider has knowledge of each consumption by the user of one of the services to which it provides identity elements of the user including the time of consumption of the service and what are the identity elements that the user shares with it. Thus, the identity provider is able to generate a user's service consumption profile from the user's service activity history.

[0006] It is, in particular, to respond to these problems that the electronic identity wallet was envisaged. Thus, it is an identity management system allowing the privacy of users to be preserved. The electronic wallet is a self-sovereign identity solution (SSI) ("Sel-Sovereign Identity") in English, dissociating the identity provider from the issuer of the identity elements towards a service provider, in particular by using a SIOP protocol ("Self Issued OpenID Provider" in English).

[0007] Indeed, such an electronic identity wallet retrieves / collects identity data, and possibly the certificates of the identity elements (also called "ID-token" in English), from one or more separate identity providers on which it is registered. The electronic wallet then preserves the user's privacy because it plays the role of mediator between service providers requiring certified identity data and the identity providers with which the user is registered. The service provider therefore has no knowledge of the user's identity providers.

[0008] Furthermore, the use of the electronic wallet does not require a connection with the identity provider when transmitting certified identity data to the service provider. The transmission of the identity data is then carried out in a so-called asynchronous manner since the communication of the identity data to the service provider is carried out without the identity provider being involved in a synchronous manner.

[0009] Furthermore, to respond to the request for identity data, the user of the electronic wallet selects, from among the collected identity data recorded in the electronic wallet, one or more identity data and authorizes their transmission by the electronic wallet to the service provider in response to the request. Thus, the service provider does not have access to the other identity data available in the electronic wallet. The user then controls the sharing of his identity data with a service provider.

[0010] The use nevertheless has drawbacks, such as in particular:

[0011] Extensions of registration times with a service provider, or even service provision times due to the time required by the user to select for each required identity data from the set of identity data collected, knowing that this may require for each identity data, the prior selection of the source identity provider.

[0012] Furthermore, when for the same type of identity data, several data of identities have been collected from different identity providers, the risk is that the user does not select the same identity data to respond to the same service provider (in particular when a request for identity confirmation by the service provider) or a second service provider dialoguing with a first service provider. This can cause errors in service provision (because the service provider considers that it is dealing with two distinct users), in particular failure to take into account the history, loyalty, profile of the user, or even a request to create a new account, etc.; or even a failure in service provision. Statement of the invention

[0013] One of the aims of the present invention is to remedy drawbacks / shortcomings of the state of the art / to provide improvements over the state of the art.

[0014] An object of the invention is a method for generating certified identity profiles associated with a user account of an electronic identity wallet, the generation method comprising: - select, for a certified identity profile, identity data from a set of identity data received from at least one certified identity provider associated with the user account, then - integrate selected identity data into the recipient certified identity profile.

[0015] This will thus reduce the risks of service provision errors and service provision failures. Indeed, for the same service provider, the electronic identity wallet will be able to transmit the same certified identity profile containing the same identity data with each request from the latter without risk of error. Another advantage is to reduce the time taken to transmit identity data by the e-wallet, thus reducing the time taken for ongoing processing by the service provider when requesting identity data: registering a new user, providing a service, etc.

[0016] Advantageously, the selection of at least one identity data is carried out as a function of identity data required by at least one service provider.

[0017] Advantageously, the selection of at least one identity data item is carried out as a function of a selection command received from a user interface.

[0018] Advantageously, the generation method comprises: recording the generated profile of certified identities.

[0019] Advantageously, when the certified identity profile is intended for a type of service provider, the selection is made based on the type of service provider associated with the certified identity profile.

[0020] Advantageously, the integration of the selected identity data into the certified identity profile is triggered as soon as the electronic identity wallet provides the selected identity data to a service provider, the certified identity profile being associated with the service provider.

[0021] An object of the invention is also a method of providing certified identity data to a service provider, the method of providing comprising - retrieve from the identity data of a certified identity profile identity data required by a service provider, and - transmit the identity data retrieved from the certified identity profile to the requesting service provider.

[0022] Advantageously, the supply method comprises receive a transmission agreement prior to the transmission of identity data.

[0023] Advantageously, the recovery of identity data intended for a service provider is carried out in an identity profile previously used to provide certified identity data to the same service provider.

[0024] An object of the invention is also a method for managing certified identity profiles associated with a user account of an electronic identity wallet, the management method comprising generate a profile of certified identities according to the generation method of the invention.

[0025] Advantageously, the management method comprises modify a certified identity profile by modifying at least one identity data item in the certified identity profile.

[0026] Advantageously, the modification is one of the following: - adding selected identity data, to the certified identity profile, from a set of identity data received from at least one certified identity provider associated with the user account; - delete identity data from the certified identity profile.

[0027] Advantageously, the management method comprises provide identity data to a service provider according to the provision method of the invention.

[0028] Advantageously, according to an implementation of the invention, the different steps of the method according to the invention are implemented by software or computer program, this software comprising software instructions intended to be executed by a data processor of a device forming part of an electronic identity wallet and being designed to control the execution of the different steps of this process.

[0029] The invention therefore also relates to a program comprising program code instructions for executing the steps of the method for generating certified identity profiles according to the invention and / or the method for providing certified identity data according to the invention and / or the method for managing certified identity profiles according to the invention when said program is executed by a processor.

[0030] This program may use any programming language and be in the form of source code, object code, or intermediate code between source code and object code, such as in a partially compiled form or in any other desirable form.

[0031] Another object of the invention is an electronic identity wallet capable of providing certified identity data comprising a generator of certified identity profiles associated with a user account of the electronic identity wallet, the generator of certified identity profiles being capable of: - select, for a certified identity profile, identity data from a set of identity data received from at least one certified identity provider associated with the user account, then - integrate selected identity data into the recipient certified identity profile. Brief description of the drawings

[0032] The characteristics and advantages of the invention will appear more clearly on reading the description, given by way of example, and the figures relating thereto which represent:

[0033] [Fig.l], a simplified diagram of the method for generating a certified identity profile according to the invention,

[0034] [Fig.2], a simplified diagram of the method for providing certified identity data according to the invention,

[0035] [Fig.3], a simplified diagram of the method for managing certified identity profiles according to the invention,

[0036] [Fig.4], a simplified diagram of a communication architecture comprising a portfolio of certified identities according to the invention,

[0037] [Fig.5], a simplified diagram of the user interface allowing access to an electronic wallet of certified identity data according to the invention,

[0038] [Fig.6a], a simplified diagram of the user interface during a first step of generating a profile according to the invention in a first embodiment,

[0039] [Fig.6b], a simplified diagram of the user interface during a second step of generating a profile according to the invention in a first embodiment, of identities idcsu(k) among a set of identity data ((»)] received

[0040] [Fig.7a], a simplified diagram of the user interface during a first step of generation of a profile according to the invention in a second embodiment,

[0041] [Fig.7b], a simplified diagram of the user interface during a second step of generation of a profile according to the invention in a second embodiment,

[0042] [Fig.8], a simplified diagram of the user interface showing an example profile generated according to the invention. Description of the embodiments

[0043] [Fig.l] illustrates a simplified diagram of the method for generating a certified identity profile according to the invention.

[0044] The method for generating certified identity profiles P_GN generates certified identity profiles p(: associated with a user account of an electronic identity wallet. The generation method P_GN comprising: - select SLCT, for a pG certified identity profile, idc data of at least one IDPj certified identity provider associated with the user account U, then - integrate P_INT of selected identity data idcsu(k) into the recipient certified identity profile pG.

[0045] In particular, the identity data is certified identity data. Certified identity data includes in particular a specific identity data item and an identity certificate, in particular an identity token also called an “ID-token” in English. Optionally, the certificate includes the specific identity data item. The specific identity data item is, for example, one of the following data items: a surname, a first name, a postal address, an email address, a telephone number, a date of birth, etc.

[0046] In particular, the selection of SLCT certified identity data of at least one identity data is carried out according to identity data required idcr(k) by at least one SPV service provider.

[0047] In particular, when the requesting service provider SPV has a requirement relating to the identity provider (in particular an identity provider quality requirement, a requirement on the identity provider itself), the selection of certified identity data SLCT of at least one identity data is carried out not only as a function of identity data required idcr(k) by at least one SPV service provider, but also as a function of parameters of the identity provider from which the selectable certified identity data originate. The parameters of the identity provider including in particular the quality of the certified identity data, the name of the identity provider, category (for example example: regalian, commercial, etc. Thus, the service provider can refuse identity data coming from certain identity providers and / or identity providers of quality lower than a threshold quality value and / or non-regalian identity providers...

[0048] In particular, the selection of SLCT certified identity data of at least one identity data is carried out according to a selection command slct_cmd received from a user interface UI.

[0049] In particular, the P_GN generation method comprises: - save P_ST the generated profile of certified identities.

[0050] In particular, when the certified identity profile p(: is intended for a type of service provider spty, the selection of certified identity data SLCT is carried out according to the type of service provider spty associated with the certified identity profile pG.

[0051] In particular, the integration P_INT of the selected identity data idcsu(k) into the certified identity profile pu is triggered int_trg as soon as the electronic identity wallet provides ID_TR the selected identity data idcsu(k) to an SPV service provider, the certified identity profile pu being associated with the SPV service provider.

[0052] In particular, the P_GN generation method comprises: - start the generation of a new P_BG profile associated with the user account U.

[0053] In particular, the start of the generation of a new P_GB profile is triggered bg_trg in particular: - either by a request for a new b_trg profile from the UI user interface; - either following a RQ_RC reception of a request for certified identity data idc_rq from an SPV service provider.

[0054] In the first case, starting the generation of a new P_BG profile requests b_rq from a UI user interface if the generation of a new profile is desired. In response to this b_rq request, the UI user interface triggers the start of the generation of a new P_BG profile.

[0055] In the second case, either the management method implemented by the portfolio of certified identities (not illustrated in [Fig.l]), or the P_GN generation method comprises: - receive RQ_RC the certified identity data request idc_rq, - then triggers bg_trg to start generating a new P_GB profile.

[0056] In particular, the P_GN generation method comprises: - determine SPTY_DT a type of spty service provider to which the certified identity profile being generated pu will be associated.

[0057] In the first case, the type of spty service providers is indicated by the UI. In particular, the SPTY_DT service provider type determination receives a spty_nsw provider type from the UI, for example in response to a spty_rq service provider type request issued by the SPTY_DT service provider type determination to the U.

[0058]

[0059]

[0060]

[0061] In the second case, the type of spty service providers is the type of the requesting SPV service provider. The determination of the type of service providers SPTY_DT determines in particular the certified identity data [ idcr(k)} generally required by the type of service provider spty determined: gpty^ {idcr(k)} By generally required is meant the certified identity data associated with the type of service provider recorded prior to the generation of the P_GN profile, and / or the history of the identity data associated with the service providers of the type determined requiring prior to the generation of the current P_GN profile, and / or the certified identity data associated with the type of service provider by learning, etc. In particular, the generation method P_GN generates the profile by iteration, that is to say that for a profile p(: comprising several identity data, the generation method selects SLCT then integrates P_INT one identity data after the other in the profile pG. For example, starting the P_BG profile sets the iteration counter to 1: k=l, then triggers the SLCT selection and the P_INT integration of a first data of selected identities idcsu(k=l) in the pu profile: p = f^p = 0 idcsU (k = 1) The P_GN generation method includes in particular an iteration k=k+l as long as the generation profile generation is not complete [N] allowing SLCT to be selected and integrated a kth data of selected identities idcsu(k) in the profile pu being ge generation: PlJ = f[piJ,idcsU(k)\

[0062] In particular, in the case where the generation of profile P_GN is carried out by selecting SLCT and integrating P_INT into the profile pU a selected certified identity data idcs(k) according to a command slct_cmd received from a user interface IU, then the generation method P_GN comprises, in particular, one or more of the following steps: - provide BIDC_DSP elements to be reproduced e_dsp ​​relating to the certified identity data based on the certified identity data associated with the user account U available bidc_e in the certified identity portfolio, possibly on request bidc_rq of the provision BIDC_DSP of elements to be reproduced relating to the BIDC_DSP certified identity data; - receive CMD_RC a selection command slct_cmd of a reproduced element e indicating to the selection of certified identity data SLCT the selected reproduced element es according to which the selection determines the corresponding certified identity data ides.

[0063] In particular, the certified identity data idc originating from one or more certified identity sources IDP, IDP1.. .IDPj (not shown) have been previously recorded, for example in a certified identity database BIDC.

[0064] In particular, in the case where the generation of profile P_GN is carried out according to the type of service provider determined spty, then the P_GN generation method comprises, in particular, one or more of the following steps: - read SPTY_RD the certified identity data required by the selected service provider type spty. Reading SPTY_RD indicates to the SLCT certified identity data selection a kth required certified identity data idcr(k).

[0065] In particular, in the case where the generation of profile P_GN is carried out following a request for provision of certified identity data idc_rq from an SPV service provider, then the P_GN generation method comprises, in particular, one or more of the following steps: - read IDCR_RD the certified identity data required by the SPV service provider. Reading IDCR_RD indicates to the SLCT certified identity data selection the required certified identity data idcr(k); - provide ID_TR the selected certified identity data idcs(k) to the requesting service provider SPV.

[0066] In particular, the SLCT selection requires the selected certified identity data idcsu_rq in particular from the BIDC certified identity database which then provides the selected certified identity data idcsu(k) corresponding in particular to one of the certified identity data provided by one of the certified identity providers IDPj: idcsu(k)=idCju(n)= idcll)Pj'ïn). The BIDC certified identity database comprising certified identity data idc, in particular all of the certified identity data provided by one or more certified identity providers IDP, IDPjrij: {idCju(n)}jn.

[0067] In particular, the generation method P_GN comprises a verification of the generation stage of the profile STP? after the integration P_INT of a data item of certified identities selected in the profile pu being generated.

[0068] In particular, in the case of a profile generated according to a specific type of service provider spty, the STP verification determines in particular whether all the data associated {idcr(k)} with this specific type of service provider spty have been provided: spty({idcr(k)}).

[0069] In particular, in the case of a profile generated in the process of providing identity data to a service provider, the STP verification determines in particular whether all the data required idcr(k) by the SPV service provider has been provided.

[0070] In particular, in the case of a profile generated by slct_cmd selection by a UI user interface, the STP verification? requests nxt_rq from the UI user interface whether a new certified identity data must be added to the profile p(: being generated, and receives, in response, a nxt_nsw command indicating whether the profile is finished or whether a new certified identity data must be added.

[0071] In particular, if the STP verification determines that a new certified identity data item must be added, in particular when not all the required data have been provided [N], then the verification triggers a new iteration of the generation of profile k=k+l allowing SLCT to be selected and a kth selected identity data item idcsu(k) to be integrated into the profile pu being generated: Pu = f(P^ idcsU(k))-

[0072] In particular, if the STP? verification determines that the profile is complete (no new certified identity data to be added or all required data provided, for example) [Y], then the generation of the profile p(: is complete and the STP? verification possibly triggers a P_ST recording of the generated profile p(:.

[0073] In particular, the generation method comprises the recording P_ST of the generated profile pG, in particular in a BPI profile database.

[0074] The method for providing certified identity data of a profile according to the invention allows a user to consent to delivering to a service provider certain certified identity data (from a set of certified identity data that he has previously obtained from identity providers). The certified identity data transmitted to a service provider can be saved as a certified identity profile during the generation of the P_GN profile.

[0075] For example, the SPV service provider sends a request to the electronic wallet implementing the P_GN generation method so that the latter shares and provides a certain number of certified identity data.

[0076] Optionally, the user has the possibility of choosing by means of a user interface UI the identity data to be transmitted to the SPV service provider from those present in different certified identity data domains.

[0077] In particular, the certified identity data transmitted in response to the SPV service provider's request may be saved P_ST as a certified identity profile.

[0078] Thus, the saved profile can be reused later, in particular for respond again to a request for certified identity data from the same SPV service provider or from another service provider collaborating with this first service provider.

[0079] [Fig.2] illustrates a simplified diagram of the method for providing certified identity data according to the invention.

[0080] The method for providing certified identity data P_PV provides certified identity data {ids(l)}i to a service provider SPV. The method for providing P_PV comprising - retrieve IDCR_LD from the identity data of a certified identity profile ps — {idc( ps, / <)} of the identity data required {idcq}i by an SPV service provider, and - transmit the identity data retrieved from the certified identity profile {ids(l)}i to the requesting service provider SPV.

[0081] In particular, the P_PV supply method comprises: - receive AUTH_RC an auth_nsw transmission agreement prior to transmitting ID_TR identity data.

[0082] In particular, the recovery of IDCR_LD identity data intended for an SPV service provider is carried out in an identity profile ps having previously been used to provide certified identity data P_PV to the same SPV service provider.

[0083] In particular, the P_PV supply method comprises: - receive RQ_RC a request for certified identity data idc_rq from the SPV service provider.

[0084] In particular, in the case where the provision of certified identities P_PV is carried out by selecting P_SLCT a profile ps(: according to a command slct_cmd received from a user interface IU, then the method of provisioning P_PV comprises, in particular, one or more of the following steps: - provide BPI_DSP elements to be reproduced e_dsp ​​relating to one or more certified identity profiles associated with the user account U available bpi_e in the certified identity portfolio, possibly on request bpi_rq of the provision BPI_DSP of elements to be reproduced relating to the certified identity profiles BPI_DSP; - receive CMD_RC a selection command slct_cmd of a reproduced element e indicating to the SLCT selection the reproduced element selected es according to which a profile selection P_SLCT determines the corresponding profile psu.

[0085] In particular, in the case where the provision of certified identities P_PV is carried out by selecting P_SLCT a psu profile according to the type of service provider spty of the requesting provider, the P_PV provisioning method comprises: - determine SPTY_DT the spty service provider type corresponding to the requesting SPV service provider.

[0086] In particular, the SPTY_DT service provider type determination receives spty_nsw information data from the SPV service provider, such as the service provider type associated with the requesting SPV service provider or one or more information relating to the requesting SPV service provider making it possible to determine the service provider type.

[0087] In particular, the P_PV supply method comprises: - select P_SLCT a certified identity profile ps(: whose certified identity data idc(psu) will be provided to the SPV service provider by providing P_PV identity data.

[0088] In particular, when the P_SLCT profile selection selects several profiles likely to respond to the request (case not illustrated), the P_SLCT profile selection comprises one or more of the following steps: - provide BPI_DSP with elements to be reproduced e_dsp ​​relating to the pre-selected certified identity profiles likely to respond to the bpi_e request in the certified identity portfolio; - receive CMD_RC a selection command slct_cmd of a reproduced element e indicating to the SLCT selection the selected reproduced element es according to which the profile selection P_SLCT determines the corresponding profile psu; - load, retrieve, and / or receive P_LD the identity data of the selected profile {idc(psU)} in particular in a BPI profile database, possibly in response to an identity data request idc_rq(ps).

[0089] Thus, preselecting the profiles according to the request makes it possible to reduce the profiles that can be selected by the user and therefore errors, or even failures in providing the service.

[0090] In particular, the profile selection P_SLCT loads, retrieves, and / or receives, a selected profile psG, in particular in a profile database BPI, possibly in response to a profile request p_rq, the profile request including in particular either the selected element es: p_rq(es) in the case of a selection command slct_cmd, or a type of service provider: p_rq(spty) in the case of a determination of the type SPTY_DT of the requesting service provider SPV: p_rq(spty).

[0091] In particular, the IDCR_LD recovery of identity data in a certified identity profile includes: - load, retrieve, and / or receive P_LD the identity data of a selected profile {idc(psu)} in particular in a BPI profile database, possibly in response to an identity data request idc_rq(ps).

[0092] In particular, the P_PV supply method comprises determining a profile of P_DT certified identities comprising one or more of the following steps: - provide BPI_DSP elements to be reproduced e_dsp ​​relating to one or more certified identity profiles associated with the user account U available bpi_e in the certified identity portfolio; - receive CMD_RC a selection command slct_cmd of a reproduced element e indicating to the SLCT selection the reproduced element selected es according to which the profile selection P_SLCT determines the corresponding profile ps(: ; - determine SPTY_DT the type of spty service providers corresponding to the requesting SPV service provider;

[0093] - select a profile of certified psG identities including identity data certified idc(psu) will be provided to the SPV service provider by providing P_PV identity data; - load, retrieve, and / or receive P_LD the identity data of a selected profile {idc(psu)} in particular in a BPI profile database, possibly in response to an identity data request idc_rq(ps).

[0094] In particular, the IDCR_LD recovery of identity data in a certified identity profile includes: - select ID / P_SCLT one or more certified identity data f nç AI from the set of certified identity data of a psG certified identity profile: {idcs(psu,k)]k.

[0095] In particular, the selection ID / P_SCLT of certified identity data in the selected profile is a function of the identity data required {idcri]i by the requesting service provider SPV.

[0096] In particular, the P_PV supply method comprises one or more of the following steps: - provide P_DSP elements to reproduce ps_dsp relative to the selected profile; - receive CMD_LSCR a selection command slct_cmd of certified identity data from among the set of certified identity data of a certified identity profile psG: {idcs(psu,k)]k, in particular from among the elements reproduced ps_dsp following the provision P_DSP of elements to be reproduced relating to the selected profile ps_dsp.

[0097] In particular, the P_PV provision method comprises a verification of a user authorization to provide certified identity data TR_AUTH?.

[0098] In the case where the result of the verification is negative [N] that is to say that the user does not allow: - the provision of certified identity data to the requesting service provider (no agreement possibly previously recorded, for example during the sub-contracting process). user's description to the requesting service provider or a non-agreement auth_nsw received AUTH_RC from the user during the implementation of the P_PV provisioning method, for example in response to an authorization request auth_rq), and / or - the provision of one or more of the identity data retrieved in the selected profile (in particular, when the retrieval of the certified identity data IDCR_LD in a profile is carried out automatically, for example in a profile selected according to the type of requesting provider) (for example, non-agreement auth_nsw received AUTH_RC from the user during the implementation of the P_PV provisioning method, for example in response to an authorization request auth_rq), then the P_PV provisioning method is stopped STP without provision of certified identity data from a profile.Eventually, the STP stop of the provision of certified identity data originating from a P_PV profile triggers a provision of certified identity data without using the profiles, or even by constituting a new profile as proposed by the P_GN generation method in particular as illustrated by [Fig.l], when it is the use of certified identity data which is not authorized.

[0099] In the case where the result of the verification is positive [Y] i.e. the user gives his agreement for the provision of certified identity data to the requesting service provider (agreement possibly previously recorded, for example when the user subscribed to the requesting service provider or an auth_nsw agreement received AUTH_RC from the user during the implementation of the P_PV provision method for example in response to an authorization request auth_rq), then the P_PV provision method transmits ID_TR the certified identity data coming from the selected profile {idcs(l)]i.

[0100] [Fig.3] illustrates a simplified diagram of the method for managing certified identity profiles according to the invention.

[0101] The management method P_MNGT manages certified identity profiles p(: associated with a user account U of an electronic identity wallet. The management method P_MNGT comprises - generate P_GN a profile of certified identities according to the invention (in particular as illustrated by [Fig.l]).

[0102] In particular, the management method P_MNGT comprises - modify P_MDF a psumi certified identity profile by modifying at least one identity data item of the idc(psumi) certified identity profile.

[0103] In particular, the modification P_MDF is one of the following: - add P+ a selected identity data idc+, to the psumi certified identity profile, from a set of identity data received from at least one certified identity provider associated with the IDP user account, IDPi.. .IDPj (not shown); - delete P an identity data from the idc certified identity profile (psumi).

[0104] In particular, the management method P_MNGT comprises: - providing identity data {idcs(l)}i to an SPV service provider according to the invention (in particular as illustrated by [Fig.2]).

[0105] In particular, the P_MNGT management method comprises: - select P_SLCT a certified identity profile ps(: whose certified identity data idc(psu) will be managed by the P_MNGT profile management.

[0106] In particular, the P_MDF modification includes: - select P_SLCT a psumi certified identity profile of which at least one idc(psumi) certified identity data will be modified by the P_MDF modification.

[0107] In particular, in the case where the management of P_MNGT profiles, in particular the modification P_MDF, is carried out by selecting P_SLCT a profile psG, respectively psumi, according to a command slct_cmd received from a user interface IU, then the method of managing P_MNGT, respectively the modification P_MDF, comprises, in particular one or more of the following steps: - provide BPI_DSP (not shown) elements to be reproduced e_dsp ​​relating to one or more certified identity profiles associated with the user account U available bpi_e in the certified identity portfolio, possibly on request bpi_rq of the provision BPI_DSP of elements to be reproduced relating to the certified identity profiles BPI_DSP; - receive CMD_RC (not shown) a selection command slct_cmd of a reproduced element e indicating to the SLCT selection the selected reproduced element es(ps u) according to which a profile selection P_SLCT determines the corresponding profile psu.

[0108] In particular, the profile selection P_SLCT loads, retrieves, and / or receives, a selected profile psumi, in particular in a BPI profile base, possibly in response to a profile request p_rq, the profile request including in particular the selected element es: p_rq(es).

[0109] In particular, the management method P_MNGT, respectively the modification P_MDF, comprises: - load, retrieve, and / or receive P_LD the identity data of a selected profile {idc(psumi)} in particular in a BPI profile database, possibly in response to an identity data request idc_rq(psumi).

[0110] In particular, the modification P_MDF includes: - determine the type of modification to be implemented ACT?, the determination ACT? triggering a modification P+, P- determined according to the type of modification determined act=ad+, act=supr-.

[0111] In particular, the determination ACT? of the modification type act receives the modification type act, act=ad+, act=supr- from a user interface UI possibly in response to a modification type request act_rq in particular from the determination ACT?.

[0112] In particular, when the ACT? determination determines a modification of the type adding certified identity data in the profile: [+], then the determination triggers

[0113] - add P+ a selected identity data idc+, to the profile of certified identities psumi, among a set of identity data received from at least one certified identity provider associated with the user account IDP, IDPi.. .IDPj (not shown);

[0114] In particular, when the ACT? determination determines a modification of the deletion type of a certified identity data in the profile: [-], then the determination triggers

[0115] - delete P an identity data from the idc certified identity profile (psumi).

[0116] In particular, the addition P+ of certified identity data idc+ in a profile se selected psu includes - select ID+_SLCT, for the selected certified identity profile psu , an additional identity data idcs+ among a set of data of identities {idc^n)} received from at least one IDPj certified identity provider associated with the user account U, then - integrate P_INT the selected additional identity data idc+=idcsu(k) into the recipient certified identity profile psu.

[0117] In particular, when the profile modification P_GN is performed by selecting ID+_SLCT and integrating P_INT into the selected profile psu an additional certified identity data selected idc+ based on a selection es(icd+) received from a user interface UI: - the selection of an additional identity data ID+_SLCT, also called additional selection, receives from a user interface a selected reproduced element associated with an additional selected certified identity data idc+.

[0118] In particular, the additional selection ID+_SLCT requests the selected additional certified identity data idc+_rq in particular from the BIDC certified identity database which then provides the selected additional certified identity data icd+ =idcsu(K+l) corresponding in particular to one of the certified identity data provided by one of the certified identity providers IDPj: icd+=idcsu(K+l)=idCju(n)= idc1DPju(n). The BIDC certified identity database comprising certified identity data idc, in particular all of the certified identity data provided by a or more certified identity providers IDP, IDPj ri j : {idCju(n)}jn.

[0119] In particular, the P+ addition comprises, in particular, one or more of the following steps: - provide BIDC_DSP (not shown) elements to be reproduced e_dsp ​​relating to the certified identity data based on the certified identity data associated with the user account U available bidc_e in the certified identity portfolio, possibly on request bidc_rq of the provision BIDC_DSP of elements to be reproduced relating to the certified identity data BIDC_DSP; - receive CMD_RC (not shown) a selection command slct_cmd of a reproduced element e indicating to the selection of certified identity data SLCT the selected reproduced element es according to which the selection determines the corresponding additional certified identity data idc+: es(idc+).

[0120] In particular, the integration P_INT integrates an additional selected identity data idc+ = idcsu(K+l) to the psmiu profile being modified: ns'U = f( nsu idc i ct f°urnit 'c modified profile ps'miu to a substitution P_RPL replacing the psmiu profile to which the additional idc+ identity data was added with the modified ps'miu profile, notably in the BPI profile database.

[0121] In particular, the removal or deletion P- of a certified identity data idc in a selected profile psmiu comprises - select ID _SLCT in the selected certified identity profile psmiu a identity data to be removed idc from the set of identity data J p^ received in particular from the BPI profile database, then - remove P_RMV the selected identity data to be removed idc- from the original certified identity profile psmiu.

[0122] In particular, when the profile modification P_GN is performed by selecting ID _SLCT and removing P_INT from the selected profile psmiu a certified identity data to be removed selected idc according to a selection es(icd(psmiu)) received from a user interface UI: - the selection of an identity data to be removed ID _SLCT, also called removal selection, receives from a user interface a selected reproduced element associated with a certified identity data selected to be removed idc.

[0123] In particular, the withdrawal P- comprises, in particular, one or more of the following steps - provide BIDC_DSP (not shown) elements to be reproduced e_dsp ​​relating to the certified identity data of the selected certified identity profile psmiu based on the certified identity data associated with the selected profile psmiu available bidc_e in the certified identity portfolio, possibly on request bidc_rq of the provision BIDC_DSP of elements to be reproduced relating to the data certified identities of the selected profile; - receive CMD_RC (not shown) a selection command slct_cmd of a reproduced element e indicating to the selection of certified identity data SLCT the selected reproduced element es according to which the selection determines the corresponding certified identity data to be removed idc: cslidc).

[0124] In particular, the P_RMV removal deletes a data item from selected identities to be removed idc+ = from the psmiu profile being modified: _ / ■ / y \ j and provides the modified ps'miu profile has a P_RPL substitution replacing the psmiu profile from which the identity data to be removed idc was removed by the modified ps'miu profile, notably in the BPI profile database.

[0125] In particular, the P_MDF modification includes: - substitute P_RPL the psmiu profile from which the modification was implemented by the modified ps'miu profile resulting from the modification, in particular in the BPI profile base.

[0126] The provision of certified identity data P_PV provides certified identity data {ids(l)}i to a service provider SPV. The P_PV provision method comprising - retrieve (not shown) in the identity data of a PSm2 certified identity profile identity data required idc_rq by an SPV service provider, and - transmit (not shown) the identity data retrieved from the certified identity profile {ids(l)}i to the requesting service provider SPV.

[0127] Optionally, the provision of P_PV certified data includes - load, retrieve, and / or receive (not shown) the identity data of a selected profile 1 j 1 in particular in a BPI profile database, possibly in response to a request for identity data j •

[0128] In a particular embodiment of at least one of the methods previously described, one or more of these methods is implemented in the form of a program comprising program code instructions for executing the steps of the method for generating certified identity profiles and / or the method for providing certified identity data and / or the method for managing certified identity profiles when said program is executed by a processor.

[0129] [Fig.4] illustrates a simplified diagram of a communication architecture comprising a portfolio of certified identities according to the invention.

[0130] The electronic wallet of certified identities 1 is capable of providing certified identity data comprising a generator 13 of certified identity profiles associated with a user account U of the electronic wallet of identities 1, the ge- generator 13 of certified identity profiles capable of: - select SLCT, for a pG certified identity profile, idcsu(k) identity data from a set of received identity data of at least one IDPj certified identity provider associated with the user account U, then - integrate P_INT of selected identity data idcsu(k) into the recipient certified identity profile pu.

[0131] In particular, a communication architecture comprising the electronic wallet of certified identities 1 comprises one or more of the following devices: - one or more 2i...2j identity providers; - at least one service provider 3; - a 7.17 user interface; - at least one communication network 4 allowing the electronic wallet of certified identities 1 to receive certified identity data from an identity provider 2i...2j and / or to transmit certified identity data to a service provider 3.

[0132] In particular, the electronic wallet of certified identities 1 comprises: - a certified identity profile manager 16 capable of managing certified identity profiles p(: associated with a user account U of the electronic identity wallet 1.

[0133] In particular, the electronic wallet of certified identities 1, or even the certified identity profile manager 16 (case not illustrated), comprises - the certified identity profile generator 13.

[0134] In particular, the electronic wallet of certified identities 1, or even the certified identity profile manager 16 (case not illustrated), comprises: - a provider 15 of identity data {idcs(l)}i to an SPV service provider.

[0135] In particular, the profile generator 13 comprises: - a certified identity data selector 134 capable of selecting, at destination of a profile of certified identities pG, identity data idcsu(k) among a set of identity data {^7 ()}” received from at least one supplier 2j certified identity associated with the user account U, - an integrator 135 capable of integrating selected identity data idcsu(k) provided by the selector 134 into the recipient certified identity profile pu.

[0136] In particular, the certified identity data selector 134 is capable of performing the selection based on required identity data idcr(k) by at least an SPV service provider.

[0137] In particular, the certified identity data selector 134 is able to perform the selection based on a selection command slct_cmd received from a user interface UI.

[0138] In particular, the profile generator 13 comprises: - a profile recorder 137 capable of recording, storing, memorizing the generated profile of certified identities, in particular provided by the integrator 135.

[0139] In particular, when the certified identity profile p(: is intended for a type of service provider spty, the certified identity data selector 134 is able to carry out the selection according to the type of service provider spty associated with the certified identity profile pG.

[0140] In particular, the integrator 135 of the selected identity data idcsu(k) in the certified identity profile p(: is triggered int_trg as soon as the electronic identity wallet 1, in particular the provider 15, provides the selected identity data idcsu(k) to an SPV service provider, the certified identity profile pu being associated with the SPV service provider.

[0141] In particular, the profile generator 13 comprises: - a starter 131 capable of starting the generation of a new profile associated with the user account U.

[0142] In particular, the starter 131 is triggered bg_trg for a new profile in particular: - either by a request for a new b_trg profile from the user interface 7, 17; - either by a request receiver 130 following receipt of a request for certified identity data idc_rq from an SPV service provider.

[0143] In the first case, the starter 131 requests b_rq from a user interface 7, 17 whether the generation of a new profile is desired. In response to this request b_rq, the user interface 7, 17 triggers the starter 131 for a new profile.

[0144] In the second case, either the profile generator 13, or the profile manager 16 (case not illustrated), or the certified identity portfolio 1 comprises: - a certified identity data request receiver 130 capable of receiving RQ_RC the certified identity data request idc_rq, - the starter 13 capable of being triggered bg_trg by the receiver 130 so that the starter 13 starts the generation of a new profile.

[0145] In particular, the profile generator 13 comprises: - a service provider type analyzer (not shown) capable of determining the type of service providers spty with which the certified identity profile being generated pu will be associated.

[0146] In the first case, the type of spty service providers is indicated by

[0147]

[0148]

[0149]

[0150]

[0151] the user interface 7, 17. In particular, the service provider type analyzer receives a provider type spty_nsw from the user interface 7, 17, for example in response to a service provider type spty_rq query issued by the user interface 7, 17. In the second case, the type of spty service providers is the type of the requesting service provider 3. The service provider type analyzer is particularly capable of determining the certified identity data [idcr( k}} generally required by the type of k <K spty service provider determined: spty[ {idcr(k)} j generally required is understood to mean the certified identity data associated with the type of service provider recorded prior to profile generation, and / or the history of identity data associated with service providers of the type determined requiring prior to the current profile generation, and / or the certified identity data associated with the type of service provider by learning, etc. In particular, the profile generator 13 is capable of generating the profile by iteration, that is to say that for a profile p(: comprising several identity data, the generation method is capable of selecting then integrating one identity data after the other in the profile pG. For example, the starter 131 is able to set the iteration counter to 1: k=l, then triggers the selector 134 and the integrator 135 for a first data of selected identities idcsu(k=l) in the profile p(: : p = f^p — 0 idcsU(k = l) ) • The profile generator 13 is notably capable of implementing an iteration k=k+l as long as the generation of the profile is not finished, making it possible to select and integrate a kth data item of selected identities ides u(k) into the profile pu being generated: pJ = f(puJdcsU(k))- In particular, in the case where the profile generator 13 is capable of generating a profile by selecting and integrating into the profile p(: a selected certified identity data item idcs(k) as a function of a slct_cmd command received from a user interface 7, 17, then the profile generator 13 comprises, in particular, one or more of the following devices: - a provider of elements to be reproduced 1332 capable of providing elements to be reproduced e_dsp ​​relating to the certified identity data based on the certified identity data associated with the user account U available bidc_e in the certified identity portfolio, possibly upon request bidc_rq for the provision of elements to be reproduced relating to the certified identity data; - a selection command receiver 1332 capable of receiving a selection command slct_cmd selection of a reproduced element e indicating to the certified identity data selector 134 the selected reproduced element es according to which the selection determines the corresponding certified identity data ides.

[0152] The supplier of elements to be reproduced and the command receiver being either a single device 1332, or separate devices.

[0153] In particular, the certified identity data idc originating from one or more certified identity sources 2, 2i.. .2j have been previously recorded, for example in a certified identity database 12.

[0154] In particular, the electronic identity data wallet 1 comprises the certified identity base 12.

[0155] In particular, in the case where the profile generator 13 is capable of performing the generation according to the type of service provider determined spty, then the profile generator 13 comprises, in particular: - a required certified data reader 1331 capable of reading the certified identity data required by the selected service provider type spty. The reader indicates to the certified identity data selector 134 a kth required certified identity data idcr(k).

[0156] In particular, in the case where the profile generator 13 is capable of performing the generation following a request to provide certified identity data idc_rq from a service provider 3, then the profile generator 13 comprises, in particular, one or more of the following devices: - a required certified identity data reader 1331 capable of reading the certified identity data required by the service provider 3. The required certified identity data reader 1331 indicates to the certified identity data selector 134 the required certified identity data idcr(k); - a certified identity data transmitter (not shown) capable of providing the certified identity data selected idcs(k) by the selector 134 to the requesting service provider 3.

[0157] In particular, the selector 134 is able to request the selected certified identity data idcsu_rq in particular from the certified identity database 12 which then provides the selected certified identity data idcsu(k) corresponding in particular to one of the certified identity data provided by one of the certified identity providers 2j: idcsu(k)=idcju(n)=idc1DPju(n). The certified identity database 12 comprises certified identity data idc, in particular all of the certified identity data provided by one or more certified identity providers 2, 2j,j=i...j: {idcju(n)]jn.

[0158] In particular, the profile generator 13 comprises a verifier 136 of the profile generation stage capable of being implemented after the integrator 135 of a data item of certified identities selected in the profile pu being generated.

[0159] In particular, in the case of a profile generated according to a determined type of service provider spty, the verifier 136 is able to determine in particular whether all the data associated {idcr(k)} with this determined type of service provider spty have been provided: spty({idcr(k)}).

[0160] In particular, in the case of a profile generated during the provision of identity data to a service provider, the verifier 136 is able to determine in particular whether all the data required idcr(k) by the service provider 3 have been provided.

[0161] In particular, in the case of a profile generated by selection slct_cmd by a user interface 7, 17, the verifier 136 is able to request nxt_rq from the user interface 7, 17 whether a new certified identity data item must be added to the profile p(: being generated, and to receive, in response, a command nxt_nsw indicating whether the profile is finished or whether a new certified identity data item must be added.

[0162] In particular, if the verifier 136 determines that a new certified identity data item must be added, in particular when not all the required data have been provided, then the verifier 136 is able to trigger a new iteration of the generation of profile k=k+l allowing to select SLCT and to integrate a kth selected identity data item idcsu(k) into the profile pu being generated ' Pu^f[pifidcsU^ \

[0163] In particular, if the verifier 136 determines that the profile is complete (no new certified identity data to be added or all required data provided, for example) [Y], then the generation of the profile p(: is complete and the verifier 136 is able to possibly trigger a recorder 137 able to record the generated profile Pu-

[0164] In particular, the profile generator 13 comprises the recorder 137 capable of recording the generated profile pG, in particular in a profile base 14.

[0165] In particular, the electronic identity data wallet 1 comprises the certified identity profile base 14.

[0166] In particular, the certified identity profile manager 16 comprises - a modifier (not shown) of the psumi certified identity profile capable of modifying at least one identity data item of the idc(psumi) certified identity profile.

[0167] In particular, the modifier comprises at least one device among the following: - an integrator capable of adding P+ a selected identity data idc+ in the certified identity profile psumi, among a set of identity data received from at least one certified identity provider associated with the user account 2, 2i...2j; - a subtractor capable of deleting identity data from the idc certified identity profile (psumi).

[0168] In particular, the profile manager 16 comprises: - a profile selector (not shown) capable of selecting a profile of certified identities psG whose certified identity data idc(psu) will be managed by the profile manager 16.

[0169] In particular, the certified identity profile manager 16, respectively the profile modifier, comprises: - a loader / receiver of certified identity data of a profile (not illustrated) capable of loading, retrieving, and / or receiving the identity data of a selected profile {idc(psumi)} in particular in a profile base 14, possibly in response to a request for identity data idc_rq(psumi).

[0170] In particular, the profile manager 16, or even the profile modifier, includes: - a profile recorder capable of substituting the psmiu profile from which the modification was implemented by the modified ps'miu profile resulting from the modification, in particular in the profile base 12.

[0171] The certified identity data provider 15 is able to provide certified identity data {ids(l)}i to a service provider 3. The data provider of certified identities 15 includes - a certified identity data loader (not shown) capable of retrieving identity data from the identity data of a certified identity profile required idc_rq by a service provider 3, and - a certified identity data transmitter (not shown) capable of providing the identity data retrieved from the certified identity profile {ids(l)}i to the provider of services requiring 3.

[0172] Optionally, the certified identity data provider 15 comprises - a certified identity data loader (not shown) capable of loading, retrieving, and / or receive the identity data of a selected profile in particular in a profile base 14, possibly in response to a request for identity data rû( psu V ~ m2 /

[0173] [Fig.5] illustrates a simplified diagram of the user interface allowing access to an electronic wallet of certified identity data according to the invention.

[0174] A communication device 9, for example a smartphone, a tablet, a computer, comprises a screen constituting a user interface 917. The user can interact with one or more elements reproduced by the screen 9 in particular by means of an interaction peripheral, such as a mouse, a stylus, etc. or directly when the screen 9 is tactile by means of a finger of the user U. In the case of an interaction by means of an interaction peripheral (mouse, joystick, a touchpad, etc.), the interaction position is indicated on the screen by a 917s cursor.

[0175] The electronic wallet of certified identity data provides in particular interaction elements to be reproduced 917b 917G, 917M, 917PV allowing the user to request processing of the electronic wallet of data illustrated by figures 1 to 3, or even to trigger one of the devices of the electronic wallet of certified identity data as illustrated by [Fig.4].

[0176] In particular, the interaction element 917 is capable of controlling the loading of certified identity data (not illustrated) from a certified identity provider, in particular into a certified identity database 12 prior to any generation or management of profiles according to the invention.

[0177] In particular, the interaction element 917G is capable of controlling the profile generator 13, in particular as illustrated by [Fig.4], and / or the generation of profiles P_GN, in particular as illustrated by [Fig.1].

[0178] In particular, the interaction element 917M is capable of controlling the profile manager 16, in particular as illustrated by [Fig.4], and / or the profile management P_MNGT, in particular as illustrated by [Fig.2].

[0179] In particular, the interaction element 917PV is capable of controlling the provider of certified identity data of a profile 15, in particular as illustrated by [Fig.4], and / or the provision of certified identity data of a profile P_PV, in particular as illustrated by [Fig.3].

[0180] [Fig.5] illustrates the case where user U commands the generation of a new profile.

[0181] [Fig.6a] illustrates a simplified diagram of the user interface during a first step of generating a profile according to the invention in a first embodiment, in particular following a command as illustrated by [Fig.5].

[0182] In this first embodiment, the user interface 917 proposes in the first step of generating a profile to the user to select the certified identity provider of a first certified identity data of the profile being generated from among the set of certified identity providers IDP1, IDP2, IDP3, IDP4 whose certified identity data have been loaded into the certified identity database 12 of the electronic wallet 1.

[0183] In our example, the user selects the second certified identity provider IDP2 for this first certified identity data of the profile being generated.

[0184] Thus, for another certified identity data of the profile being generated, for example the fourth data, the user will be able to select another certified identity provider IDPj, j 2, for example the fourth IDP4.

[0185] [Fig.6b] illustrates a simplified diagram of the user interface during a second step of generating a profile according to the invention in a first embodiment.

[0186] In this second step, the user having selected a certified identity provider, in this case the second certified identity provider IDP2, the user interface 917 reproduces all of the certified identity data provided IDP_slct by this second certified identity provider IDP2 in order to allow the user to select one of these certified identity data.

[0187] In this case, screen 917 displays the following certified identity data: the name nm, the first name fnm, the civility cv and the sex sx, an email em, a telephone number pn, a postal address adr, the date of birth bd...

[0188] In our example, the user selects the certified identity data corresponding to the name nm provided by the second certified identity provider IDP2 for this first certified identity data of the profile being generated.

[0189] In particular, the screen 917 proposes an UPDATE selection element making it possible to trigger an update in the certified identity database 12 of the certified identity data of the second certified identity provider IDP2 by checking whether the certified identity data available from the second certified identity provider IDP2 has been modified and if this is the case by replacing the corresponding certified identity data in the certified identity database 12 with the modified certified identity data retrieved from the second certified identity provider IDP2.

[0190] [Fig.7a] illustrates a simplified diagram of the user interface during a first step of generating a profile according to the invention in a second embodiment, in particular following a command as illustrated by [Fig.5].

[0191] In this second embodiment, the user interface 917 proposes in the first step of generating a profile to the user to select an identity data domain from among several domains DMN1.. .DMNm, in particular the domains corresponding to the different names nm, to the different addresses adr, ... to the different telephone numbers pnb, etc.

[0192] In our example, the user selects the first certified identity domain DMN1 for this first certified identity data of the profile being generated.

[0193] Thus, for another certified identity data of the profile being generated, for example the fifth data, the user will be able to select another domain of certified identities DMNm, * 1, for example the second DMN2.

[0194] Note that the domains can be subdivided into sub-domains, thus facilitating user navigation through a large number of certified identity data.

[0195] [Fig.7b] illustrates a simplified diagram of the user interface during a second step of generating a profile according to the invention in a second embodiment lization.

[0196] In this second step, the user having selected a domain of certified identities, in this case the first domain of certified identities DMN1, the user interface 917 reproduces all of the certified identity data DMNl_lst associated with this first domain of certified identities DMN1 in the certified identity database 12 in order to allow the user to select one of these certified identity data.

[0197] In this case, the screen 917 displays the following certified identity data: a name provided by the first provider nm_idpl, a name provided by the second provider nm_idp2, a name provided by the third provider nm_idp3, a name provided by the fourth provider nm_idp4...

[0198] In our example, the user selects the certified identity data corresponding to the name provided by the second certified identity provider nm_idp2 for this first certified identity data of the profile being generated.

[0199] [Fig.8] illustrates a simplified diagram of the user interface showing an example of a profile generated according to the invention.

[0200] The screen 917 reproduces all the certified identity data of the pu profile. In this case, the pu profile includes: - a name nm provided by the second certified identity provider idp2;

[0201] - a civility cv provided by the second certified identity provider idp2;

[0202] - a first name fnm provided by the second certified identity provider idp2;

[0203] - a date of birth bd provided by the fourth certified identity provider idp4 ;

[0204] - an nm address provided by the first certified identity provider idpl;

[0205] - an email em provided by the second certified identity provider idp2; etc.

[0206] Thus, if screen 917 is displayed during a P_MNGT profile management process, the user can select a certified identity data to remove from the profile.

[0207] Thus, if the screen 917 is displayed during a method of providing certified identity data of a P_PV profile, the user can select from the certified identity data of the profile one or more of the certified identity data to be transmitted to a requesting service provider.

[0208] The invention therefore proposes in particular a method and a system for managing identity profiles that preserve the privacy of users. The system is notably composed of a mobile application (computer program capable of executing the steps of the method for managing certified identity profiles) allowing a user to obtain their certified identity data from at least one certified identity provider with which they are registered. This application makes it possible to provide their identity data asynchronously with their certified identity providers. certified to the service providers it accesses.

[0209] Thus, the invention allows the user to control the sharing of their certified identity data. Furthermore, the communication of the certified identity data to a service provider is carried out without the certified identity provider(s) being involved.

[0210] The object of the invention is therefore the constitution of one or more profiles integrating certified identity data to satisfy access to certain services provided by one or more service providers.

[0211] The invention also relates to a medium. The information medium may be any entity or device capable of storing the program. For example, the medium may comprise a storage means, such as a ROM, for example a CD ROM or a microelectronic circuit ROM or even a magnetic recording means, for example a floppy disk or a hard disk.

[0212] On the other hand, the information medium may be a transmissible medium such as an electrical or optical signal which may be conveyed via an electrical or optical cable, by radio or by other means. The program according to the invention may in particular be downloaded from a network, in particular of the Internet type.

[0213] Alternatively, the information carrier may be an integrated circuit in which the program is incorporated, the circuit being adapted to execute or to be used in the execution of the method in question.

[0214] In another implementation, the invention is implemented by means of software and / or hardware components. In this regard, the term module can correspond to either a software component or a hardware component. A software component corresponds to one or more computer programs, one or more sub-programs of a program, or more generally to any element of a program or software capable of implementing a function or a set of functions according to the description above. A hardware component corresponds to any element of a hardware assembly capable of implementing a function or a set of functions.

Claims

Claims

1. Method for generating certified identity profiles (pG) associated with a user account of an electronic identity wallet, the generation method (P_GN) comprising: - selecting (SLCT), for a certified identity profile (pu), identity data (idcsu(k)) from a set of identity data ( |”) received from at least one certified identity provider (IDPj) associated with the user account (U), then - integrating selected identity data (idcsu(k)) into the recipient certified identity profile (pu).

2. Generation method according to the preceding claim in which the selection (SLCT) of at least one identity data is carried out according to required identity data (idcr(k)) by at least one service provider (SPV).

3. Generation method according to one of the preceding claims in which the selection (SLCT) of at least one identity data is carried out according to a selection command (slct_cmd) received from a user interface (UI).

4. Generation method according to one of the preceding claims, the generation method (P_GN) comprising: - recording (P_ST) the generated profile of certified identities.

5. Generation method according to one of the preceding claims, in which, when the certified identity profile (pG) is intended for a type of service provider, the selection (SLCT) is carried out according to the type of service provider (spty) associated with the certified identity profile (pu).

6. Generation method according to one of the preceding claims, in which the integration (P_INT) of the selected identity data (idcsu (k)) into the certified identity profile (pG) is triggered (int_trg) as soon as the electronic identity wallet provides (ID_TR) the selected identity data (idcsu (k)) to a service provider (SPV), the certified identity profile (pu) being associated with the service provider (SPV).

7. Method for providing certified identity data to a service provider, the method of providing (P_PV) comprising - retrieving (IDCR_LD) in the identity data of a profile certified identities (ps = {ide( ps, k)} ) of the identity data s Je required ({ider,} j by a service provider (SPV), and - transmit (ID_TR) the identity data retrieved from the certified identity profile ({ids(l)}0 to the requesting service provider (SPV).

8. Provision method according to the preceding claim, the provision method comprising - receiving (AUTH_RC) a transmission agreement (auth_nsw) prior to the transmission of the identity data (ID_TR).

9. Method of providing according to the preceding claim, in which the recovery of identity data (IDCR_LD) intended for a service provider (SPV) is carried out in an identity profile (ps) having previously served for the provision of certified identity data (P_PV) to the same service provider (SPV).

10. Method for managing certified identity profiles (pu) associated with a user account (U) of an electronic identity wallet, the management method (P_MNGT) comprising - generating (P_GN) a certified identity profile according to one of claims 1 to 6.

11. Management method according to the preceding claim, the management method (P_MNGT) comprising - modifying (P_MDF) a certified identity profile (psum[) by modifying at least one identity data item of the certified identity profile (idc(psuml)).

12. Management method according to the preceding claim, in which the modification (P_MDF) is one of the following: - adding (P+) a selected identity data item (idc+), intended for the certified identity profile (psumi), from a set of identity data items received from at least one certified identity provider associated with the user account (IDP, IDPi...IDPj); - deleting (P-) an identity data item from the certified identity profile (idc.(psumi)).

13. Management method according to one of claims 10 to 12, the management method (P_MNGT) comprising - providing identity data ({idcs(l)}i) to a service provider (SPV) according to claim 7

14. A program comprising program code instructions for performing the steps of the method for generating certified identity profiles according to any one of claims 1 to 6 and / or the method for providing certified identity data according to claim 7 and / or the method for managing certified identity profiles according to any one of claims 10 to 13 when said program is executed by a processor.

15. Electronic identity wallet (1) capable of providing certified identity data comprising a generator (13) of certified identity profiles associated with a user account (U) of the electronic identity wallet (1), the generator (13) of certified identity profiles being capable of: - selecting (134), for a certified identity profile (pu), identity data (idcsu(k)) from a set of identity data ([|") received from at least one certified identity provider (2b...,2j) associated with the user account (U), then - integrating (135) selected identity data (idcsu(k)) into the recipient certified identity profile (pu).

Images