Biometric encoding method and terminal

Abstract

Method (800, 900, 1000 11000) for encoding, implemented by an encoding terminal (102, 300), a biometric template (803, 903, 1003, 1103) for a test (GE-Bio), said method takes, as input data, a biometric characteristic (801, 901, 1001, 11001) for a test (CE-Bio), and provides, as output data, a biometric template (803, 903, 1003, 1103) for a test (GE-Bio), in which the biometric template (803, 903, 1003, 1103) for a test (GE-Bio) is generated from the biometric characteristic (801, 901, 1001, 1101) of test (CE-Bio) according to an encoding scheme (802, 902, 1002, 1102) representative of the distance (802a, 902a, 1002a, 11002a), d(CE-Bio, CR-Bio), according to a metric between the biometric characteristic (801, 901, 1001, 1101) of test (CE-Bio) and a biometric characteristic (802b, 902b, 1002b, 1102b) of reference (CR-Bio).

Description

Title of the invention: Biometric encoding method and terminal Technical field

[0001] The present invention relates to a biometric encoding method and terminal. It also relates to an identification method and system implementing the biometric encoding method and terminal. Technical background

[0002] It is common to use protocols for identifying and / or authenticating individuals based on the comparison of certain of their biometric characteristics in order to allow them to access remote services, authorize access to information stored in a collective or personal database, verify an identity or even authorize access to a restricted access area.

[0003] Whether during authentication or identification, the comparison of biometric characteristics is generally not implemented on raw data directly from their recording but on biometric data derived following the application of an algorithmic processing called encoding. According to section 3.21 of the ISO / IEC 19794-1:2011 Information technology — Biometric data interchange formats — Part 1: Framework standard, the derived biometric data constitute a “biometric template” or “biometric model” which is distinct from the raw data from which it originates and can be compared to other biometric templates.

[0004] Biometric authentication generally consists of comparing a biometric test template acquired for an individual to a single or a very limited number of reference biometric templates (1:1). This type of protocol allows a user who wishes to access the resources of an information system, such as an operating system, a network, an application, a service, a database or even an application, to prove his identity using a biometric characteristic. The operation of an authentication protocol generally requires a prior enrollment step by which a user identifies himself by sharing a certain amount of information relating to his identity with the entity that implements the protocol.

[0005] Carry out a remote banking transaction, access a password database stored on a multifunction mobile telephone, or verify, when crossing borders or during a check by law enforcement, the identity of an individual carrying an identity document comprising a secure electronic element on which biometric information is recorded are common examples of the application of an authentication protocol.

[0006] WO 9526013 Al [MINNESOTA MINING & MFG [US]] 28.09.1995 describes an authentication system by comparing a test biometric characteristic acquired from an individual with a reference biometric characteristic stored in the system. The system is further configured to detect a variable biometric characteristic to verify the liveness of the individual.

[0007] Unlike authentication, identification requires the comparison of a test biometric template with many other reference biometric templates previously acquired from several individuals (1:N) and generally stored in a database. This type of protocol makes it possible to identify a user from among a set of users. The database of reference biometric templates generally requires a prior step of recording biometric templates collected from identified individuals.

[0008] Determining, for example in the context of a police investigation, the identity of a person by comparing a fingerprint of their dermatoglyphs, an image of their iris or an image of their face with those in a database of known individuals is a common application of an identification protocol. Another example of application is access to an area restricted to a limited number of individuals.

[0009] US 4109237 A [HILL ROBERT B] 22.08.1978 describes a method of identifying an individual by comparing the pattern of the venous network of his iris with a set of previously recorded venous network patterns of a plurality of individuals.

[0010] It is now common for users, when they wish to carry out an operation with a remote resource, to authenticate and / or identify themselves using a mobile device, such as a multifunction telephone, a tablet or a laptop, in communication with this resource. However, biometric data, whether in raw form or as templates, are very sensitive personal data. It is necessary to ensure their confidentiality while protecting them from theft and / or identity theft.

[0011] EP 2 813 961 Al [KONVALINKA IRA [CA]] 17.12.2014 describes a biometric authentication method implementing a mobile device coupled to a remote server. The device comprises a biometric sensor and a memory on which is stored a personal reference biometric template specific to its user. At the request of the server, the user acquires a test biometric characteristic using the biometric sensor of the mobile device. Then, the device generates a test biometric template, compares it to the personal reference biometric template and transmits a success or failure signal to the remote server. During the operation, the biometric information is confined to the mobile device and is never communicated to the server. Their confidentiality is preserved. On the other hand, the remote server has no guarantee on the real identity of the user of the mobile device.

[0012] It is possible to strengthen the security of authentication or identification protocols, and in particular to reduce the risk of identity theft, by using a biometric authentication or identification terminal coupled to a mobile device. The terminal is configured to acquire biometric characteristics of an individual and to generate an additional biometric test template. The additional biometric test template can then be compared to a reference biometric template.

[0013] WO 2017 / 019972 Al [VISA INT SERVICE ASS [US]] 02.02.2017 describes a biometric authentication method implementing a mobile device coupled to an access terminal equipped with a biometric sensor. A personal reference biometric template specific to its user is recorded on the mobile device. The mobile device is configured to receive a test biometric template generated by the access terminal, compare said test biometric template with the personal reference biometric template, and send the result of the comparison to the access terminal.

[0014] WO 2017 / 075063 Al [VISA INT SERVICE ASS [US]] 04.07.2017 describes a method for authenticating individuals in proximity to a biometric access terminal using their mobile devices without the individuals having to acquire a biometric characteristic using their mobile device. The access terminal is configured to receive, from each nearby mobile device, a public encryption key generated by applying a first fuzzy extractor function to a personal reference biometric template recorded on each mobile device and specific to its user.Then, the access terminal generates a challenge biometric template from the biometric characteristics acquired from a user, and generates secret encryption keys by applying a second fuzzy extractor function on the challenge biometric template and each of the received public encryption keys; there are as many secret encryption keys as there are received public encryption keys. Then, it encrypts the challenge biometric template with each of the secret keys to generate as many biometric templates as there are secret encryption keys. These encrypted biometric templates are then sent to all the mobile devices in the vicinity. If a mobile device succeeds in decrypting one of the encrypted challenge biometric templates, it compares it to the personal reference biometric template specific to it, and in case . of matching, sends a success signal to the access terminal which authorizes the mobile device to access a resource.

[0015] WO 2019 / 078858 Al [VISA INT SERVICE ASS [US]] 25.04.2019 describes a biometric authentication method limiting the risk of a man-in-the-middle attack. A first biometric proof template of an individual is generated by a mobile device such as a multifunction telephone or a laptop from a first acquisition of biometric characteristics. This first biometric template is stored locally on the mobile device and an encrypted copy is sent to an authentication terminal allowing access to a resource such as a database, a computer network or a restricted access area.The terminal generates a second biometric template for testing the individual from a second acquisition of biometric characteristics, calculates an encrypted result from the encrypted first biometric template and the second biometric template by applying an encryption function, and then sends the encrypted result to the mobile device. The mobile device decrypts the encrypted result, compares the decrypted first biometric template with the locally stored first biometric template, and, if there is a match, compares the first biometric template with the second biometric template. If the first biometric template and the second biometric template match, the mobile device sends identification information such as a user name, a password, an identity number.

[0016] WO 2019 / 094071 Al [VISA INT SERVICE ASS [US]] 16.05.2019 describes a method for biometric identification of individuals in the vicinity of a biometric access terminal making it possible to reduce the number of comparisons of a test biometric template with the reference biometric templates in a database. The terminal has a database of reference biometric templates of users previously enrolled with their mobile devices. The reference biometric templates are recorded in an obfuscated manner in the database. When the access terminal detects the mobile device of an enrolled user in the vicinity, it acquires test biometric characteristics of the owner of the mobile device, generates a test biometric template and compares it to the reference biometric template associated with the mobile device recorded in the database. Summary of the invention

[0017] A major drawback of current authentication or identification methods is the possibility of false acceptance when a usurper can steal a user's mobile device and submit a biometric characteristic proof close to the reference biometric characteristic to access the services provided via the identification or authentication terminal.

[0018] There is therefore a need for a solution to reduce the risk of false acceptance during an identification and authentication process using an intermediate mobile device. In addition, such a solution would ideally make it possible to enforce the confidentiality and security of biometric information.

[0019] According to a first aspect of the invention, there is provided a method of encoding, implemented by an encoding terminal, a biometric test template, said method takes, as input data, a biometric test characteristic, and provides, as output data, a biometric test template, in which the biometric test template is generated from the biometric test characteristic according to an encoding scheme representative of the distance according to a metric between the biometric test characteristic and a reference biometric characteristic.

[0020] According to some embodiments, the encoding scheme comprises a pre-encoder configured to generate a reference internal biometric template generated from the reference biometric feature and a challenge intermediate biometric template generated from the challenge biometric feature, the distance according to a metric is a distance between the reference internal biometric template and the challenge intermediate biometric template.

[0021] According to some embodiments, the encoding scheme comprises a transition function or a distribution function centered on the distance according to a metric between a reference internal biometric template generated from the reference biometric characteristic and an intermediate challenge biometric template generated from the challenge biometric characteristic.

[0022] According to certain embodiments, the encoding scheme further comprises a noise generation function, preferably a noise generation function taking, as input variable, the test biometric characteristic.

[0023] According to certain embodiments, the noise generation function (F-Br) comprises a function generating a random number from the test biometric characteristic selected from a hash function, a weighted summation function or a reduction function.

[0024] According to certain embodiments, the encoding scheme is implemented in the form of a neural network previously trained according to a teacher-student protocol.

[0025] According to certain embodiments, the encoding scheme is specific to the biometric terminal.

[0026] According to certain embodiments, the reference biometric characteristic is specific to the user of the encoding terminal.

[0027] According to a second aspect of the invention, there is provided an encoding terminal for implementing an encoding method according to any one of the embodiments of the first aspect of the invention.

[0028] According to certain embodiments, the encoding terminal is a mobile electronic device, preferably a multifunction mobile telephone (“smartphone”)•

[0029] According to a third aspect of the invention, there is provided a biometric identification method comprising the following steps: (a) Transmitting, by a biometric identification terminal, a test biometric characteristic of an individual to an encoding terminal; b) Generating, by the encoding terminal, a biometric test template using an encoding method according to any embodiment of the first aspect of the invention; c) Receive, via the biometric identification terminal, the biometric test template; d) Compare, via the biometric identification terminal, the biometric test template (GE-Bio) with at least one reference biometric template from a reference biometric template database.

[0030] According to certain embodiments, the comparison step d) is executed according to an approximate search protocol, preferably an approximate search protocol based on a Hamming distance.

[0031] According to certain embodiments, the biometric identification method further comprises a step of generation, by the encoding terminal, of a proof of encoding of the biometric test template from the biometric test characteristic, preferably a proof of encoding with zero knowledge disclosure, and a step of verification, by the biometric identification terminal, of the proof of encoding.

[0032] According to certain embodiments, the comparison step (d) is executed according to a data concealment and / or function concealment method.

[0033] According to a fourth aspect of the invention, there is provided a biometric identification system for implementing an identification method according to any one of the embodiments of the third aspect of the invention. In particular, there is provided a biometric identification system comprising: - a biometric identification terminal comprising an acquisition device configured to acquire at least one biometric characteristic of a user; - a recording medium comprising a database of reference biometric templates; - an encoding terminal according to any one of the embodiments of the second aspect of the invention; the system being configured to perform the steps of a biometric identification method according to any one of the embodiments of the third aspect of the invention. Brief description of the drawings

[0034] [Fig.l] is a schematic representation of a biometric identification system comprising a biometric identification terminal and an encoding terminal.

[0035] [Fig.2] is a schematic representation of an identification terminal biometric.

[0036] [Fig.3] is a schematic representation of an encoding terminal.

[0037] [Fig.4] is a block diagram of an identification terminal biometric according to a first embodiment.

[0038] [Fig.5] is an operating diagram of an encoding terminal according to a first embodiment.

[0039] [Fig.6] is an operating diagram of an encoding terminal according to a second embodiment

[0040] [Fig.7] is a block diagram of an identification terminal biometric according to a first embodiment.

[0041] [Fig.8] is a flow diagram of an encoding method in accordance with the invention.

[0042] [Fig.9] is a flow diagram of an encoding method according to a first mode of realization.

[0043] [Fig. 10] is a flow diagram of an encoding method according to a second embodiment.

[0044] [Fig. 11] a flow diagram of an encoding method according to a third embodiment Detailed description of the embodiments

[0045] In the present disclosure, embodiments are described in the general context of one or more hardware or devices capable of executing preloaded instructions such as, for example, computer-executable instructions for executing program modules. The program modules may include one or more routines, programs, objects, variables, commands, scripts, functions, applications, components, data structures that may perform particular tasks or implement particular types of abstract data.

[0046] Some embodiments may also be implemented in distributed computing environments where tasks are executed by remote data processing devices that are connected by a communications network. In a distributed computing environment, the program modules may be located on local and / or remote computer storage media, including memory storage devices.

[0047] In the context of the invention, the term "biometric template" is understood to mean any type of biometric data derived from one or more raw biometric characteristics following their processing by an algorithm hereinafter referred to as encoding. The derived biometric data constituting the biometric template are generally distinct from the raw biometric data from which they are derived. Preferably, the biometric template complies with the definition of the standard ISO / IEC 19794-1:2011 Information technology - Biometric data interchange formats - Part 1: Framework.

[0048] With reference to [Fig.l], a biometric identification system 100 may comprise a biometric identification terminal 101 and an encoding terminal 102 associated with or specific to a user 103. The biometric identification terminal 101 and the encoding terminal 102 are preferably configured to exchange data via a secure remote connection.

[0049] When a user 101 wishes to identify himself to the biometric identification terminal 101 in order to access a resource or a restricted access area, he first submits an identification request to said biometric identification terminal 101. According to a first example, the request can be submitted using a human-machine interface, “HMI”, (not shown) with which the biometric identification terminal 101 is equipped. According to a second example, it can be submitted via the encoding terminal 103 via a remote connection, preferably secure.

[0050] Once the request has been submitted, the biometric identification terminal 101 acquires a test biometric characteristic of the user 103 using an appropriate acquisition device and then transmits it to the encoding terminal 102. The biometric characteristic is generally chosen from the dermatoglyphs of one or more fingers, the palmar dermatoglyphs, one or more irises, or a face, or their combination.

[0051] Upon receipt of the test biometric characteristic, the encoding terminal 102 generates a test biometric template according to an encoding scheme, then sends this test biometric template to the biometric identification terminal 101. As soon as the biometric identification terminal 101 receives the test biometric template, it compares it to one or more test biometric templates. reference stored in a database. If there is a match between the test biometric template and at least one reference biometric template, the user 103 is identified. He is then authorized to access the resource or access area. Otherwise, the user 103 is not identified and access is refused. The biometric identification terminal 101 and / or the encoding terminal can notify the user of the success or failure of the identification using a light signal, an audible signal, a message, or a combination thereof.

[0052] A biometric identification system 100 as described above can be used for the purposes of accessing one or more remote services, authorizing access to information stored in a collective or personal database, verifying the identity of one or more people, recovering connection identifiers, or even recovering one or more addresses of electronic money wallets such as a cryptocurrency.

[0053] An example 200 of a biometric identification terminal 101 is illustrated in [Fig. 2]. The biometric identification terminal 200 comprises a physical acquisition module 201, a physical data processing module 202 and a protective housing 203.

[0054] The physical acquisition module 201 is in the form of a camera suitable for acquiring the image of one or more irises or a face. The protective housing 203a comprises a transparent or semi-transparent window 203a to allow the acquisition of the image by the acquisition module 201. Alternatively or additionally, the physical acquisition module 201 may comprise a device for acquiring a dermatoglyph of one or more fingers or a palmar dermatoglyph. On the surface of the protective housing 203, an acquisition zone may be arranged, leaving the active surface of said acquisition device uncovered so that a user 103 can place one or more of his fingers and / or the palm of one of his hands there.

[0055] The physical acquisition module 201 transmits the acquired data to the physical data processing module 202 by means of a connector 204. The physical data processing module 202 comprises means for implementing biometric identification. It is responsible for automatically executing sequences of arithmetic or logical operations to carry out tasks or actions. This module, commonly called a computer, may comprise one or more central processing units (CPUs) 202a and / or one or more graphics processors (GPUs) 202b, a physical remote communication module 202c, one or more physical input / output modules 202d for exchanging data with external devices, a transient storage medium 202e such as a random access memory (RAM), a non-transient recording medium 202f, and data buses. communication (not shown) for transferring data between internal components data processing module 202.

[0056] The physical data processing module 202 allows the execution of one or more program modules comprising instructions which, when the program module(s) are executed, cause the data processing module 202 to implement biometric identification. The program module(s) may be written in any programming language, compiled or interpreted. They may be part of a software solution, i.e. a collection of executable instructions, codes, scripts or the like and / or databases.

[0057] Examples of biometric identification terminal 101 are described in the state of the art, in particular in WO 2023 / 028221 Al [TOOLS FOR HUMANITY CORP [US] 02.03.2023, WO 2023 / 028242 Al [TOOLS FOR HUMANITY CORP [US] 01.03.2023; US 2008 / 253622 Al [RETICA SYSTEM INC [US]] 16.10.2008; US 2006 / 088193 Al [RETICA SYSTEM INC [US]] 24.07.2006; FR 3069681 Al [SAFRAN IDENTITY & SECURITY [FR]] 01.02.2019.

[0058] In [Fig. 3] is shown an example 300 of an encoding terminal 102 for implementing biometric identification. The encoding terminal 102, 300 is a mobile electronic device, preferably a multifunction mobile telephone (“smartphone”). The encoding terminal 102, 300 comprises an upper protective housing 301, a lower protective housing, a physical data processing module 202 and a human-machine interface, “HMI”, 304 in the form of a touch screen.

[0059] The physical data processing module 303 comprises means for implementing biometric identification. It is responsible for automatically executing sequences of arithmetic or logical operations to carry out tasks or actions. This physical module 303, commonly called a computer, may comprise one or more central processing units (CPUs) 303a and / or one or more graphics processors (GPUs) 303b, a physical remote communication module 303c, one or more physical input / output modules 303d for exchanging data with external devices, a transient storage medium 303e such as a random access memory (RAM), a non-transient recording medium 303f, and communication buses (not shown) for transferring data between the internal components of the data processing module 303.It may also include a 303g secure element for storing cryptographic keys, executing encryption algorithms, and / or storing and / or encrypting any other algorithm and / or data whose security and confidentiality must be preserved.

[0060] The physical data processing module 303 allows the execution of one or more program modules comprising instructions which, when the or the program modules are executed, causing the data processing module 303 to implement biometric identification. The program module(s) may be written in any programming language, compiled or interpreted. They may be part of a software solution, i.e. a collection of executable instructions, codes, scripts or the like and / or databases.

[0061] In [Fig.4] and [Fig.5] are respectively represented the operating diagrams 400, 500 of a biometric identification terminal 101, 200 and of an encoding terminal 102, 300 for implementing biometric identification.

[0062] With reference to [Fig. 4], the biometric identification terminal 101, 200 may comprise a communication program module 401 (C-Mod), a program module 402 for acquiring a biometric test characteristic (CE-Bio), a data entry program module 403 (LMod), a data processing program module 404 (T-Mod), a database 405 (BDD), and a validation program module 406 (V-Mod).

[0063] The data input program module 403 (LMod), the data processing program module 404 (T-Mod), and the validation program module 406 (V-Mod) can be implemented by the physical data processing module 202 of the biometric identification terminal 101, 200 described in the context of [Fig. 2]. The communication program module 401 (C-Mod) and the program module 402 for acquiring a biometric test characteristic (CE-Bio) can be implemented by the physical communication module 202c and the physical acquisition module 201 of said terminal 102, 200. The database 405 (BDD) can be recorded on the non-transitory recording medium 202f of the data processing module 202.Alternatively, it may be stored in a non-transitory electronic storage medium of a remote server with which the biometric identification terminal 101, 200 has established secure remote communication via, for example, the communication program module 401 (C-Mod).

[0064] With reference to [Fig.5], the encoding terminal 102, 300 may comprise a communication program module 501 (C-Mod), a data entry program module 502 (LMod), an encoding module 503 (E-Mod) and a non-transient recording area 504.

[0065] The data input program module 502 (LMod) and the encoding program module 502 (E-Mod) can be implemented by the physical data processing module 303 of the encoding terminal 102, 300 described in the context of [Fig. 3]. The communication program module 501 (C-Mod) can be implemented by the physical communication module 303c. The non-transitory recording area 504 can be implemented on the medium 202f non-transient recording of the data processing module 202 and / or the secure element 303g.

[0066] The implementation of the biometric identification method briefly described in the context of [Fig.l] is now detailed with reference to [Fig.2] to 5.

[0067] The communication program module 301 of the biometric identification terminal 101, 200 is adapted to the exchange of data with remote electronic devices, such as the encoding terminal 102, 300, according to a secure remote connection. The secure connection is established by the communication program modules 401, 501 of each of the terminals 101, 200, 102, 300. When a request for biometric identification is submitted to the biometric identification terminal 101, 200, the encoding terminal 102, 300 and the identification terminal 101, 200 can transmit identifiers 401a, 501a (U-ID) to each other, the function of which is to enable unique identification of each of the terminals 101, 200, 102, 300 for all subsequent exchanges, and thus to verify the origin of the data exchanged. The identifiers 401a, 501a comprise any suitable type of data.Examples of identifiers may be a MAC address, a user identifier 103, an EMEI number, a random number generated by each of the terminals 101, 200, 102, 300, or a combination thereof. Preferably, the data exchanged between the encoding terminal 102, 300 and the biometric identification terminal 101, 200 are encrypted using, for example, an asymmetric encryption protocol.

[0068] Once communication has been established between the biometric identification terminal 101, 200 and the encoding terminal 102, 300, the biometric acquisition program module 402 of the biometric identification terminal 101, 200 acquires a test biometric characteristic 402a (CE-Bio) and then transmits it to the encoding terminal 102, 300 via its communication program module 401 (C-Mod). The encoding terminal 102, 300 receives the test biometric characteristic 402a (CE-Bio) via its communication program module 501 (C-Mod). The biometric characteristic 402a of the test (CE-Bio) is transmitted to the data entry program module 502, then to the encoding program module 503 (E-Mod).The encoding program module 503 (E-Mod) generates a biometric template 503a of proof (GE-Bio) by encoding the biometric characteristic 402a of proof (CE-Bio) according to an encoding scheme 504a (SE) recorded in the non-transitory recording area 504. The biometric template 503a of proof (GE-Bio) is then transmitted to the communication program module 501 (C-Mod) for sending to the biometric identification terminal 101, 200.

[0069] The communication program module 401 (C-Mod) of the biometric identification terminal 101, 200 receives the test biometric template 503a and transmits it to the processing program module 404 via the data entry program module 403 (LMod). The processing program module 404 (T-Mod) performs a comparison of the test biometric template 503a with one or more reference biometric templates 405a (GR-Bio) recorded in a database 405. Each reference biometric template 405a (GR-Bio) is associated with a user 103. The database 405 can be recorded in the non-transitory electronic recording medium 202f specific to the biometric identification terminal 101, 200. Alternatively, it may be stored in a non-transitory electronic storage medium of a remote server with which the biometric identification terminal 101, 200 has established secure remote communication.

[0070] The comparison of the test biometric template 503a (GR-Bio) with one or more reference biometric templates 405a (GR-Bio) is carried out according to any suitable method. For example, when the biometric templates are in the form of encoding vectors, the comparison may be a calculation of a correspondence score in the form of a scalar product, a vector product or a Euclidean distance between the vector representative of the test biometric template 503a (GE-Bio) and each of the vectors representative of the reference biometric templates 405a (GR-Bio).

[0071] According to certain embodiments, the comparison of the challenge biometric template 503a (GE-Bio) with one or more reference biometric templates 405a (GR-Bio) is performed according to an approximate search protocol, preferably a fuzzy search protocol based on a Hamming distance. The approximate search is advantageously fast for the comparison of complex data, such as biometric templates, and / or when the number of biometric templates to be compared is high. An example implementation of an approximate search based on a Hamming distance is described in the article Galbraith & Zoberning (2019), "Obfuscated fuzzy hamming distance and conjunctions from subset product problems.", Theory of Cryptography Conference.

[0072] According to certain preferred embodiments, the comparison of the test biometric template 503a (GE-Bio) with one or more reference biometric templates 405a (GR-Bio) is carried out according to a method of data concealment and / or function concealment ("obfuscation"). The data concealment and / or function concealment makes it possible to make the programs and algorithms unintelligible while preserving their functionality or operability. In other words, in the context of the invention, the manner in which the comparison of the biometric template 503a challenge (GE-Bio) with one or more reference 405a biometric templates (GR-Bio) is performed remains hidden from any third-party observer without prejudice to the result and performance of the comparison. Examples of implementing a data hiding and / or function hiding method are described in Galbraith & Zoberning (2019), "Obfuscated fuzzy hamming distance and conjunctions from subset product problems.", Theory of Cryptography Conference, and Barak et al. (2014) "Obfuscation for evasive functions." Theory of Cryptography Conference. Berlin, Heidelberg: Springer Berlin Heidelberg.

[0073] The validation program module 406 (V-Mod) determines whether the result(s) of the comparisons performed by the processing program module 405 (T-mod) meets at least one validation criterion, in which case the user 103 is identified. For example, when these results are match scores, the validation criterion may be a threshold value to which the values ​​of the scores are compared. If the value of at least one score is less than the threshold value, the user 103 is considered to be identified. On the other hand, if the values ​​of the scores are all greater than the threshold value, the user is not identified and all access is refused to him by the biometric identification terminal 101, 200.

[0074] The validation program module 406 (V-Mod) can generate an authentication variable 406a (Auth), for example a Boolean variable, depending on whether the identification is successful (Auth = TRUE) or not (Auth = False). The value of the authentication variable 406a can be transmitted to the communication program module 401 to inform the user 103 of the success or failure of the identification via the communication program module 501 (C-Mod) of the encoding terminal 102, 300.

[0075] With reference to [Fig.6], the encoding terminal 102, 300 may comprise a program module 601 for generating (P-Mod) a proof 601a of encoding (PE) of the biometric template 503a of test (GE-Bio) from the biometric characteristic 402a of test (CE-Bio) transmitted by the biometric identification terminal 101, 200. After generation, this proof 601a of encoding (PE) is transmitted to the biometric identification terminal 101, 200 at the same time as the biometric template 503a of test (GE-Bio). With reference to [Fig.7], the biometric identification terminal 101, 200 may comprise a program module 701 for verifying (PC-Mod) the received proof of encoding (PE).

[0076] The function of the encoding proof is to allow the biometric identification terminal 101, 200 to verify that the biometric test template was actually generated by the encoding terminal 102, 300 from the biometric test characteristic transmitted to it, and not from another data item. Preferably, the encoding proof is a zero-knowledge proof.

[0077] For example, when the encoding (SE) scheme 802, 902, 1002, 1102 is notably implemented in the form of a neural network in accordance with the embodiments described below, a zero-knowledge proof may be generated according to the method described in South et al. (2024) "Verifiable evaluations of machine learning models using zkSNARKs." ​​arXiv preprint arXiv:2402.02675.

[0078] According to the invention, with reference to [Fig.8], the encoding terminal 101, 300 comprises means for implementing a method 800 for encoding a biometric template 803 of a test, said method takes, as input data, a biometric characteristic 801 of a test (CE-Bio), and provides, as output data, a biometric template 803 of a test (GE-Bio), in which the biometric template 803 of a test (GE-Bio) is generated from the biometric characteristic 801 of a test (CE-Bio) according to an encoding scheme 802 (SE) representative of the distance 802a (d(CE-Bio, CR-Bio)) according to a metric between the biometric characteristic 801 of a test (CE-Bio) and a reference biometric characteristic 802b (CR-Bio).

[0079] Thanks to the encoding method 800 according to the invention, the biometric test template 803 (GE-Bio) generated by the encoding terminal 101, 300 is all the more distant from any reference biometric template (GR-Bio) to which it is likely to be compared subsequently, as the biometric test characteristic 801 (CE-Bio) from which it was generated is distant from the reference biometric characteristic 802b (CR-Bio). Thus, the risk of false acceptance is considerably reduced because the further the biometric characteristic 801 of the test (CE-Bio) is from the biometric characteristic 802b of the reference (CR-Bio) the more the biometric template 803 of the test (GE-Bio) is altered compared to a situation in which the biometric characteristic 801 of the test (CE-Bio) would be identical or close to the biometric characteristic 802b of the reference (CR-Bio).

[0080] As an illustrative example, in the context of a biometric identification method illustrated by [Fig.l] to 5, a user 103 presents himself in front of a biometric identification terminal 101, 200 to access a resource. In the event that the user 103 is an identity theft, he is equipped with an encoding terminal 102, 300 that he has stolen from a third party and attempts to pass himself off as this person. The reference biometric characteristic 802b (CR-Bio) used in the identification method 800 implemented by the stolen encoding terminal 102, 200 is that of the third party.

[0081] The biometric identification terminal 101, 200 acquires a biometric characteristic 402a of the challenge (CE-Bio) of the usurping user 103 and transmits it to the encoding terminal 102, 300. The encoding terminal 102 receives the biometric characteristic 402a, 801 of the challenge (CE-Bio) and generates a template therefrom biometric 503a, 803 test (GE-Bio) according to its encoding scheme 802 (SE), that is to say representative of a distance 802a (d(CE-Bio, CR-Bio)) according to a metric between the biometric characteristic 402a, 801 test (CE-Bio) of the usurper 103 and the biometric characteristic 802b reference (CR-Bio) of the third party to which the encoding terminal 102, 300 belongs. Since the biometric characteristic 402a, 801 of the challenger user 103 (CE-Bio) is different from that of the third-party owner, the encoding terminal 102, 300 generates a biometric template 503a, 803 of the challenger user 103 (GE-Bio) completely different from that which it would have generated if the user 103 had been the third-party.

[0082] Once the biometric test template 503a, 803 (GE-Bio) has been generated, the encoding terminal 102, 300 transmits it to the biometric identification terminal 101, 200. The latter compares it to the reference biometric templates 405a (GR-Bio) of a database 405, and fails to establish a correspondence with a reference biometric template 405a (GR-Bio) of the third party recorded in the database 405.

[0083] In other words, the encoding method 800 according to the invention makes it possible to camouflage any “authentic” biometric test template (GE-Bio) capable of being generated from a biometric test characteristic (CR-Bio) similar to the reference biometric characteristic (CR-Bio) as long as the biometric test characteristic (CE-Bio) does not correspond to said reference biometric characteristic (CR-Bio). In particular, this camouflage is obtained by generating a biometric test template (GE-Bio) that is all the more random as the biometric test characteristic (CE-Bio) is different from the reference biometric characteristic (CR-Bio).

[0084] The encoding method 800 according to the invention is implemented by one or more program modules, in particular by the encoding program module 503 of the encoding terminal 102, 300. The program module(s) are executed by the data processing module 303 of the encoding terminal 102, 300. All or part of these modules may be executed by a secure element 303g of the physical data processing module 303.

[0085] It should be emphasized here that the encoding scheme 802 (SE) is based on a distance 802a (d(CE-Bio, CR-Bio)) according to a metric between the test biometric characteristic 801 (CE-Bio) and a reference biometric characteristic 802b (CR-Bio). In other words, the distance according to a metric is a distance between the raw data of the test biometric characteristic 801 (CE-Bio) and the reference biometric characteristic 802b (CR-Bio). Optionally, the raw data may be subject to digital preprocessing, such as noise reduction, edge detection or cropping, without that the information they constitute is modified as in the case of a biometric template generation.

[0086] Equivalently, with reference to [Fig.9], the encoding scheme 902 (SE) may be based on a distance 902a d(GEI-Bio, GIR-Bio) between an internal reference biometric template 902c (GIR-Bio) generated from the reference biometric feature 902b (CR-Bio) and an intermediate test biometric template 902d (GEI-Bio) generated from the test biometric feature 901 (CE-Bio). In these embodiments, the encoding scheme 902 (SE) may comprise a pre-encoder 902e (P-Enc) configured to generate a reference internal biometric template 902c (GIR-Bio) generated from the reference biometric feature 902b (CR-Bio) and a challenge intermediate biometric template 902d (GEI-Bio) generated from the challenge biometric feature 901 (CE-Bio). The encoding terminal 102, 300 then generates a challenge biometric template 903 (GE-Bio) based on this distance 902a in accordance with the encoding scheme 902 (SE)..

[0087] The pre-encoder 902e (P-Enc) may be a generic encoder of the state of the art. For example, in the case of a biometric characteristic consisting of one or more images of a user 103, it may be a pre-encoder as described in Hasnat et al. (2017) "Deepvisage: Making face recognition simple yet with powerful generalization skills." Proceedings of the IEEE International Conference on Computer Vision Workshops. The reference internal biometric template 902c (GIR-Bio) generated from the reference biometric characteristic 902b (CR-Bio) and the test intermediate biometric template 902d (GEI-Bio) generated from the test biometric characteristic 901 (CE-Bio) are generally in the form of vectors.

[0088] The distance metric between the test biometric characteristic 901 (CE-Bio) and the reference biometric characteristic 902b (CR-Bio) and / or between an internal reference biometric template 902c (GIR-Bio) generated from the reference biometric characteristic 902b (CR-Bio) and an intermediate test biometric template 902d (GEI-Bio) generated from the test biometric characteristic 901 (CE-Bio) is of any suitable type. In particular, it may be a scalar product, a vector product, a Euclidean distance or even a Hamming distance.

[0089] According to certain embodiments, with reference to [Fig. 10], the encoding scheme 10002 (SE) comprises a transition function 1002f F-Trans or a distribution function F-Dist centered on the distance 1002a d(GEI-Bio, GIR-Bio) according to a metric between a reference internal biometric template 1002c (GIR-Bio) generated from the reference biometric feature 1002b (CR-Bio) and a intermediate biometric template 1002b test (GEI-Bio) generated from the biometric characteristic 1001 test (CE-Bio).

[0090] As an exemplary embodiment, an F-Trans transition function 1002f of the encoding scheme 1002 may be expressed using the following formula: GE = fTrms(GEIGEI.GIR) x GIR

[0091] Where GE is the test biometric template (GE-Bio), GEI is an intermediate test biometric template 1002b (GEI-Bio) generated from the test biometric feature 1001 (CE-Bio), GIR is an internal reference biometric template 1002c (GIR-Bio) generated from the reference biometric feature 1001 (CR-Bio), GEI.GIR is the scalar product between GEI and GIR and represents the distance 1002a d(GEI-Bio, GIR-Bio) between the intermediate test biometric template 1002b (GEI-Bio) and the internal reference biometric template 1002c (GIR-Bio). The function h is a decreasing function such that: h: [0,1] -* [0,1], x 1 if x = 1 limA(x) =0 x-*0

[0092] When the intermediate biometric template 1002d of test (GEI-Bio) generated from the biometric characteristic 1001 of test (CE-Bio) is close to the internal biometric template 1002c of reference (GIR-Bio) generated from the biometric characteristic 1002b of reference (CR-Bio), in other words when the biometric characteristic 1001 of test (CE-Bio) and the biometric characteristic 1002b of reference (CR-Bio) belong to the same user 103, their scalar product tends towards unity. The encoding scheme 1002 (SE) generates, via the transition function 1002f F-Trans, a biometric template 1003 of test (GE-Bio) similar, or even identical, to the biometric template 405a of reference (GR-Bio) expected by the terminal 101, 200 of biometric identification. On the other hand, if the intermediate biometric template 1002d of test (GEI-Bio) and internal biometric template 1002c of reference (GIR-Bio) do not correspond, the scalar product tends towards zero.The encoding scheme 1002 (SE) generates, via the transition function 1002f F-Trans, a biometric test template 1003 (GE-Bio) very different from the reference biometric template 405a (GR-Bio) expected by the biometric identification terminal 101, 200.

[0093] In order to increase the level of security, and therefore reduce the risk of false acceptance, it may be advantageous to increase the degree of dissimilarity of the reference biometric characteristic in the event of identity theft. According to certain advantageous embodiments, with reference to [Fig. 11], the encoding scheme 11002 (SE) further comprises a function 11002g for generating F-Br noise, preferably a noise generation function taking, as input variable, the biometric characteristic 11001 of the test (CE-Bio).

[0094] As an exemplary embodiment, a noise generation function 1102g F-Br taking, as input variable, the biometric characteristic 11001 of the test (CE-Bio) can be expressed using the following formula: A (GEI) - (1-f (GE!)) xg(CE) J Brv ' \ J Tram \ H °

[0095] Where CE is the challenge biometric feature 11001 (CE-Bio), GEI is a challenge intermediate biometric template 1102d (GEI-Bio) generated from the challenge biometric feature 1101 (CE-Bio), f-trans is a transition function, and g is a function generating a random number from the challenge biometric feature 1101 (CE-Bio). The function g may be a hash function, a weighted summation function, or a reduction function.

[0096] From the example of transition function f-Trans according to the previous example, the biometric template 11003 of test (GE-Bio) generated, by the terminal 102, 200 of encoding, according to the scheme 11002 of encoding (SE), can be expressed according to the following relation: GE = fTram (GEI) + fBr (GEI) = (GEI.GIR) x GIR + (I - ((GEI.GIR) x GIR)) xg (CE),

[0097] In the embodiments described above, the encoding scheme 802, 902, 1002, 1102 (SE) and / or the reference biometric characteristic 802b, 902b, 1002b, 1102b (CR-Bio) are stored, preferably in an encrypted form, in the non-transitory recording medium 302f of the physical data processing module 303 of the encoding terminal 102, 300. They can also be recorded in a secure element 303a of the physical data processing module 303 of the encoding terminal 102, 300. The encoding program module(s) 503 (E-mod) can be executed within this secure element 303a.

[0098] It is still possible to increase the level of security by avoiding any possibility for a usurper or a fraudster to reconstruct the encoding scheme 802, 902, 1002, 1102 (SE) and / or the reference biometric characteristic 802b, 902b, 1002b, 1102b (CR-Bio) by analyzing the results of brute force tests and a heuristic approach such as a trial-and-error method. For this, according to advantageous embodiments, the encoding scheme 802, 902, 1002, 1102 (SE) is implemented in the form of a neural network previously trained according to a teacher-student protocol.

[0099] Thus, a neural network can be pre-trained according to a teacher-student protocol to learn to reproduce the outputs of the transition, distribution and / or noise functions described in the previous embodiments. as well as the distance 802b, 902b, 1002b, 1102b between the test (CE-Bio) and reference (CR-Bio) biometric characteristics and / or the intermediate test (GEI-Bio) and reference (GIR-Bio) biometric templates. An example of a neural network trained according to a teacher-student protocol is described in the article Papernot et al. (2016) "Semi-supervised knowledge transfer for deep learning from private training data." arXiv preprint arXiv: 1610.05755. Such an approach also has the advantage of being able to use a neural network whose structure is less complex than that of a classic neural network, i.e., that of a neural network designed ab initio to implement the encoding scheme without training according to a teacher-student protocol. The execution of the 802, 902, 1002, 1102 encoding scheme (SE) is then faster and more accurate.

[0100] According to certain examples, the method for training such a neural network may further be based on a loss function whose parameters are adjusted so that the neural network provides a test biometric template (GE-Bio) that is all the more faithful to the reference biometric characteristic (CR-Bio) as the test biometric characteristic (CE-Bio) is close to it. In particular, it may be advantageous to use a fine tuning approach by which a neural network previously trained to provide a test biometric template (GE-Bio) from a test biometric characteristic (CE-Bio) is specialized on the reference biometric characteristic (CR-Bio).

[0101] According to certain examples, the neural network can further be trained on the basis of several reference biometric characteristics (CR-Bio) of the same nature in order to increase the sensitivity of the neural network. Several acquisitions of the same reference biometric characteristic (CR-Bio) of the user 103 can then be carried out, on the basis of which the neural network is trained via the encoding scheme (SE) that it must reproduce.

[0102] According to preferred embodiments, the encoding scheme 802, 902, 1002, 1102 (SE) is specific to the biometric encoding terminal 102, 300. The encoding scheme 802, 902, 1002, 1102 (SE) then differs from one encoding terminal 102, 300 to another, introducing an additional degree of diversity during the generation of the biometric test template (GE-Bio) when the biometric test characteristic (CE-Bio) deviates from the reference biometric characteristic 802b (CR-Bio). In other words, in a more figurative way, each encoding terminal 102, 300, via its own encoding scheme, “camouflages” or “conceals” the reference biometric characteristic (CR-Bio) all the more in its own way as the test biometric characteristic (CE-Bio) differs from it.

[0103] According to certain embodiments, the reference biometric characteristic (CR-Bio) is specific to the user 103 of the encoding terminal 102, 300. In particular, when the user 103 is the owner of the encoding terminal 102, 300, the reference biometric characteristic (CR-Bio) is exclusively that of said user 103. For example, the encoding terminal 102, 300 is a mobile electronic device, such as a multifunction telephone of which the user 103 is the sole owner. The reference biometric characteristic (CR-Bio) is then a reference biometric characteristic (CR-Bio) of the user 103. References Patent literature

[0104] US 4109237 A [HILL ROBERT B] 08 / 22 / 1978.

[0105] WO 9526013 Al [MINNESOTA MINING & MFG [US]] 09.28.1995.

[0106] US 2006 / 088193 Al [RETICA SYSTEM INC [US]] 07.24.2006.

[0107] US 2008 / 253622 Al [RETICA SYSTEM INC [US]] 16.10.2008.

[0108] EP 2 813 961 Al [KONVALINKA IRA [CA]] 17.12.2014.

[0109] WO 2017 / 019972 Al [VISA INT SERVICE ASS [US]] 02.02.2017.

[0110] WO 2017 / 075063 Al [VISA INT SERVICE ASS [US]] 04.07.2017.

[0111] FR 3069681 Al [SAFRAN IDENTITY & SECURITY [FR]] 01.02.2019.

[0112] WO 2019 / 078858 Al [VISA INT SERVICE ASS [US]] 25.04.2019.

[0113] WO 2019 / 094071 Al [VISA INT SERVICE ASS [US]] 16.05.2019.

[0114] WO 2023 / 028242 Al [TOOLS FOR HUMANITY CORP [US] 01.03.2023.

[0115] WO 2023 / 028221 Al [TOOLS FOR HUMANITY CORP [US] 02.03.2023. Littérature non-brevet

[0116] ISO / IEC 19794-1:2011 Information technology — Biométrie data interchange formats — Part 1 : Framework.

[0117] Barak et al. (2014) "Obfuscation for evasive functions." Theory of Cryptography Conférence. Berlin, Heidelberg: Springer Berlin Heidelberg.

[0118] Papernot et al. (2016) "Semi-supervised knowledge transfer for deep leaming from private training data." arXiv preprint arXiv: 1610.05755.

[0119] Hasnat et al. (2017) "Deepvisage: Making face récognition simple yet with powerful generalization skills." Proceedings of the IEEE International Conférence on Computer Vision Workshops.

[0120] Galbraith & Zobeming (2019), "Obfuscated fuzzy hamming distance and conjunctions from subset product problems.", Theory of Cryptography Conférence.

[0121] South et al. (2024) "Vérifiable évaluations of machine leaming models using zkSNARKs." arXiv preprint arXiv:2402.02675.

Claims

Claims

1. Method (800, 900, 1000 11000) for encoding, implemented by an encoding terminal (102, 300), a biometric template (803, 903, 1003, 1103) of a test (GE-Bio), said method takes, as input data, a biometric characteristic (801, 901, 1001, 11001) of a test (CE-Bio), and provides, as output data, a biometric template (803, 903, 1003, 1103) of a test (GE-Bio), in which the biometric template (803, 903, 1003, 1103) of a test (GE-Bio) is generated from the biometric characteristic (801, 901, 1001, 1101) of test (CE-Bio) according to an encoding scheme (802, 902, 1002, 1102) (SE) representative of the distance (802a, 902a, 1002a, 11002a), d(CE-Bio, CR-Bio), according to a metric between the biometric characteristic (801, 901, 1001, 1101) of test (CE-Bio) and a biometric characteristic (802b, 902b, 1002b, 1102b) of reference (CR-Bio).

2. An encoding method (900) according to claim 1, such that the encoding scheme (902) (SE) comprises a pre-encoder (902e) (P-Enc) configured to generate a reference internal biometric template (902c) (GIR-Bio) generated from the reference biometric feature (902b) (CR-Bio) and a test intermediate biometric template (902d) (GEI-Bio) generated from the test biometric feature (901) (CE-Bio), the distance according to a metric is a distance (902a), d(CE-Bio, CR-Bio) between the reference internal biometric template (902c) (GIR-Bio) and the test intermediate biometric template (902b) (GEI-Bio).

3. Encoding method (1000) according to one of claims 1 to 2, such that the encoding scheme (1002) comprises a transition function (1002f) (F-Trans) or a distribution function (F-Dist) centered on the distance (1002a) d(GEI-Bio, GIR-Bio) according to a metric between an internal biometric template (1002c) of reference (GIR-Bio) generated from the biometric characteristic (1002b) of reference (CR-Bio) and an intermediate biometric template (1002b) of test (GEI-Bio) generated from the biometric characteristic (1001) of test (CE-Bio).

4. An encoding method (11000) according to any one of claims 1 to 3, such that the encoding scheme (11002) (SE) further comprises a noise generation function (11002g) (F- Br), preferably a noise generation function taking, as input variable, the biometric characteristic (11001) of the test (CE-Bio).

5. Encoding method (11000) according to claim 4, such that the noise generation function (11002g) (F-Br) comprises a function generating a random number from the biometric characteristic 1101 of the test (CE-Bio) chosen from a hash function, a weighted summation function or a reduction function.

6. An encoding method (800, 900, 1000 11000) according to any one of claims 1 to 5, such that the encoding scheme (802, 902, 1002, 1102) (SE) is implemented in the form of a neural network previously trained according to a teacher-student protocol.

7. Encoding method (800, 900, 1000 11000) according to any one of claims 1 to 6, such that the encoding scheme (802, 902, 1002, 1102) (SE) is specific to the biometric terminal (102, 300).

8. Encoding method (800, 900, 1000 11000) according to any one of claims 1 to 6, such that the reference biometric characteristic (802b, 902b, 1002b, 1102b) (CR-Bio) is specific to the user (103) of the encoding terminal (102, 300).

9. Encoding terminal (103, 300) comprising means for implementing the encoding method (800, 900, 1000, 1100) according to any one of claims 1 to 8.

10. An encoding terminal (103, 300) according to claim 9, such that it is a mobile electronic device, preferably a multifunction mobile telephone.

11. A biometric identification method comprising the following steps: a) Transmitting, by a biometric identification terminal (101, 200), a test biometric characteristic (402a) (CR-Bio) of an individual (103) to an encoding terminal (102, 300); b) Generating, by the encoding terminal (102, 300), a test biometric template (503a) (GR-Bio) using an encoding method (800, 900, 1000 11000) according to any one of claims 1 to 8; c) Receiving, by the biometric identification terminal (101, 200), the test biometric template (503a) (GR-Bio); d) Comparing, by the biometric identification terminal (102, 300), the biometric test template (503a) (GE-Bio) with at least one reference biometric template (405a) (GR-Bio) from a reference biometric template database (405) (GR-Bio).

12. Identification method according to claim 11, such that the comparison step d) is carried out according to an approximate search protocol, preferably an approximate search protocol based on a Hamming distance.

13. Identification method according to any one of claims 11 to 12, such that it further comprises a step of generation, by the encoding terminal (102, 200), of a proof (601a) of encoding (PE) of the biometric test template (503a) (GE-Bio) from the biometric test characteristic (402a) (PE), preferably a proof of encoding with zero disclosure of knowledge, and a step of verification, by the biometric identification terminal (101, 200), of the proof (601a) of encoding (PE).

14. A method according to any one of claims 11 to 13, such that the comparison step (d) is performed according to a data hiding and / or function hiding method.

15. Biometric identification system (100) comprising: - a biometric identification terminal (101, 200) comprising an acquisition device (201) configured to acquire at least one test biometric characteristic (402a) (CR-Bio) of a user (103); - a recording medium (202f) comprising a database (BDD) of reference biometric templates (405a) (GR-Bio); - an encoding terminal (102, 300) according to any one of claims 9 to 10; the system being configured to execute the steps of an identification method according to any one of claims 11 to 14.

Images