SYSTEM PROVIDING AN IMPROVED SKIMMING RESISTANCE FOR AN ELECTRONIC IDENTITY DOCUMENT

• US 20130311788A1
• Filed: 12/15/2011
• Published: 11/21/2013
• Est. Priority Date: 12/31/2010
• Status: Active Grant

• Current Assignee: Thales DIS France SA
• Original Assignee: Stephane Mouille
• Inventors: Faher, Mourad, Mouille, Stphane, Rouchouze, Bruno
• Granted Patent: US 9,396,506 B2
• Time in Patent Office: Days
• US Class Current: 713/189
• CPC Class Codes: G06F 21/35 communicating wirelessly
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06K 19/08 using markings of different kinds or more than one marking of the same kind in the same record carrier, e.g. one marking being sensed by optical and the other by magnetic means
• CPC Class Codes: G06K 19/10 at least one kind of marking being used for authentication, e.g. of credit or identity cards verification of coded identity or credit cards in mechanisms actuated by them G07F7/12
• CPC Class Codes: G06Q 50/265 Personal security, identity or safety
• CPC Class Codes: G07C 9/22 in combination with an identity check of the pass holder
• CPC Class Codes: G07F 7/0826 Embedded security module
• CPC Class Codes: G07F 7/122 Online card verification
• CPC Class Codes: G09C 5/00 Ciphering apparatus or methods not provided for in the preceding groups, e.g. involving the concealment or deformation of graphic data such as designs, written or printed messages
• CPC Class Codes: H04L 2209/805 Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
• CPC Class Codes: H04L 9/0897 involving additional devices, e.g. trusted platform module [TPM], smartcard or USB
• CPC Class Codes: H04L 9/3231 Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861

Abstract

The invention relates to a secured identity document (1), comprising: —an externally readable chip (2) storing a cryptographic configuration of the chip for establishing a secure communication with a controlling terminal, storing a private key of a cryptography key pair and adapted to cipher data based on the stored private key; —a support (7) to which the chip is fastened, the support having a machine optically readable area (5), the data encoded in this area including: —said cryptographic configuration of the chip for establishing a secure communication with a controlling terminal in non ciphered form; —the cryptographic configuration of the chip ciphered based on said private key.

Claims

1. Secured A secured identity document (1), comprising:

an externally readable chip (2) storing a cryptographic configuration of the chip for establishing a secure communication with a controlling terminal, storing a private key of a cryptography key pair and adapted to cipher data based on the stored private key;

a support (7) to which the chip is fastened, the support having a machine optically readable area (5), the data encoded in this area including;

said cryptographic configuration of the chip for establishing a secure communication with a controlling terminal (81) in non ciphered form;

the cryptographic configuration of the chip ciphered based on said private key.

2. The secured identity document (1) according to claim 1, wherein the externally readable chip (2) includes a contactless communication interface (27).

3. The secured identity document (1) according to claim 2, wherein the chip (2) provides an access through the contactless communication interface to the stored cryptographic configuration without requesting the controlling terminal to authenticate.

4. The secured identity document (1) according to any one of the preceding claims, wherein the data encoded in the optically readable area include authentication capacities of the chip in non ciphered form and the authentication capacities of the chip ciphered based on said private key.

5. The secured identity document (1) according to any one of claims 1, 2, or 3, wherein the chip is adapted to:

receive a message;

receive a request to sign said message;

sign said message using said private key;

send the signed message.

6. The secured identity document (1) according to any one of claims 1, 2, or 3, wherein the support (7) displays identification data (4) of the owner.

7. A system (1, 8) for securely controlling the identity of an identity document bearer, comprising:

an identity document according to any one of the preceding claims;

a controlling terminal (81) comprising;

a device (82) adapted to scan the machine optically readable area and to decode the data contained in the scanned area;

a storage area storing the public key of said cryptography key pair;

a processing device adapted to decipher a first part of the decoded data based on the stored public key and to compare the deciphered first part with a second part of the decoded data;

a communication interface (83) configurable to establish a secure communication channel with the chip of the identity document, the security level of the secure communication being based on the decoded cryptography configuration.

9. The secured identity document (1) according to claim 4, wherein the chip is adapted to :

receive a message;

receive a request to sign said message;

sign said message using said private key;

send the signed message.

10. The secured identity document (1) according to claim 4, wherein the support (7) displays identification data (4) of the owner.

8. A method for establishing a secure communication channel between a secured identity document and a controlling terminal, comprising the steps of:

scanning a machine optically readable area (5) of a support (7) of the identity document (1) and decoding the data contained in the scanned area;

deciphering in the terminal a first part of the decoded data based on a public key available to the terminal, this public key belonging to a cryptography key pair, the first part of the decoded data being ciphered based on the private key of the cryptography key pair;

comparing the matching between the deciphered first part with a second part of the decoded data;

establishing a secure communication channel between the chip and the terminal based on a cryptography configuration recited in the decoded data if the deciphered first part matches the second part of the decoded data.