Electronic Identity Document Private Key Generation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current systems for encrypted data transmission between electronic identity documents and terminals lack secure key management and authentication, making them vulnerable to unauthorized access and data breaches.
Innovation Solution
The implementation of Remote Data Encryption (RDE) method, which allows an electronic identity document to agree on key extraction parameters with a terminal for secure data transmission, using Chip Authentication and Diffie-Hellman key exchange protocols to derive a private key for encryption and decryption, ensuring only the document holder can decrypt encrypted data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If Remote Document Authentication (RDA) is implemented using only knowledge authentication factor (userid/password), then ease of operation is improved, but security is worsened due to vulnerability to unauthorized access
Solution Approach 1:
The patent segments the authentication system into two distinct factors: knowledge authentication (userid/password) and possession authentication (electronic identity document). This segmentation allows each factor to serve a specific security function while maintaining operational ease through the familiar password interface combined with the secure document-based second factor.
Solution Approach 2:
The patent creates a composite authentication mechanism by combining two different authentication factors (knowledge and possession) into a unified RDA system. This composite approach leverages the ease of password-based authentication while adding the security of document-based verification, resolving the contradiction between operational ease and security.
2Device complexity
If encrypted data transmission is implemented without secure key management, then device complexity is reduced, but security is worsened due to vulnerability to data breaches
Solution Approach 1:
The patent introduces an intermediary key management system that mediates between the electronic identity document and the terminal. This intermediary layer handles the complex cryptographic operations and key derivation processes, shielding the end users from complexity while ensuring secure encrypted data transmission through properly managed cryptographic keys.
Solution Approach 2:
The electronic identity document performs self-service cryptographic operations by autonomously generating and managing its own private keys and deriving encryption keys for data protection. This self-service capability ensures security through cryptographic best practices while minimizing the complexity burden on external systems.
3Reliability
If two-factor authentication with key extraction parameters is implemented, then security is improved, but device complexity is worsened due to additional authentication steps
Solution Approach 1:
The patent performs preliminary action by pre-configuring the electronic identity document with cryptographic keys and authentication parameters during document issuance. This preliminary setup enables the document to autonomously participate in two-factor authentication without requiring complex real-time configuration, thereby improving security while managing device complexity through advance preparation.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The invention relates to a method of generating a private key for encrypted data transmission between an electronic identity document, in particular a passport, ID card or driver's license and a terminal, comprising the steps of: a. a reader of the terminal reading predetermined data from the electronic identity document, said predetermined data including at least a first public key; b. a processing unit of the terminal validating the authenticity of the data read; c. the processing unit generating an ephemeral public key and sending this key to the electronic identity document; d. both the processing unit and the electronic identity document generating session keys for secure messaging on the basis of the first public key and the ephemeral public key; e. the terminal obtaining at least part of a file from the electronic identity document as a protected response; and f. generating the private key on the basis of the protected response.