METHOD OF AUTHENTICATING A USER HOLDING A BIOMETRIC CERTIFICATE

• US 20160117492A1
• Filed: 10/27/2015
• Published: 04/28/2016
• Est. Priority Date: 10/28/2014
• Status: Active Grant

• Current Assignee: IDEMIA Identity and Security France SAS (Advent International Corporation)
• Original Assignee: Morpho (Advent International Corporation)
• Inventors: Chabanne, Herve, Bringer, Julien, Cipiere, Olivier, Hugel, Rodolphe
• Granted Patent: US 9,984,220 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: G06F 21/45 Structures or tools for the administration of authentication
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: H04L 9/3231 Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861
• CPC Class Codes: H04L 9/3268 using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]

Abstract

The present invention concerns a method of generating a biometric certificate of a user performed by a data processing device of a certifying authority, comprising a step of generating (E4) a certificate for said user comprising data related to the identity of the user and truncated authentication data of said user generated using a method of generating a biometric authentication datum, comprising steps of:

• • acquiring (E1) first biometric data of said user;
  • generating (E2) a first a proof of knowledge of said first biometric data from the first acquired biometric data and from a pseudo-random function;
  • generating (E3) a first truncated authentication datum by applying a truncation function to said first generated proof of knowledge.

Claims

1. A method of generating a biometric certificate of a user performed by a data processing device of a certifying authority, characterized in that it comprises a step of generating a certificate for said user comprising data related to the identity of the user and truncated authentication data of said user generated by a method of generating a biometric authentication datum, said method of generating a biometric authentication datum comprising steps of:

acquiring first biometric data of said user;

generating a first proof of knowledge of said first biometric data from the first acquired biometric data and from a pseudo-random function;

generating a first truncated authentication datum by applying a truncation function to said first generated proof of knowledge.

2. The method of generating a biometric certificate of a user according to claim 1 wherein said method of generating a biometric authentication datum, for at least one error to be processed among a determined set of tolerable errors, further comprises:

a step of generating first derived biometric data by adding said error to the first acquired biometric data,

a step of generating first derived proofs of knowledge from the first generated derived biometric data and from said pseudo-random function, and

a step of generating first derived truncated authentication data by applying said truncation function to said first generated derived proofs of knowledge.

3. The method of generating a biometric certificate according to claim 1, wherein the data processing device of the certifying authority holds a secret encryption key, the certificate generating step for said user comprises an encryption step of the truncated authentication data of said user.

4. A method of authenticating a user holding a biometric certificate generated according to the certificate generating method of claim 1, said authentication method comprising steps of:

acquiring second biometric data of said user to be authenticated;

generating a second proof of knowledge of said second biometric data from the second acquired biometric data and from said pseudo-random function;

generating a second truncated authentication datum by applying said truncation function to said second generated proof of knowledge;

acquiring the first truncated authentication datum or a first derived truncated authentication datum stored in the certificate;

comparing the first truncated authentication datum or the first derived truncated authentication datum with said second truncated authentication datum.

5. The method of authenticating a user holding a biometric certificate according to claim 1, said method further comprising:

for at least one tolerable error to be tested among a determined set of tolerable errors, a step of generating second derived biometric data by adding said error to the second acquired biometric data;

for each error to be tested, a step of generating a second derived proof of knowledge from the second generated derived biometric data and from said pseudo-random function, and a step of generating second derived truncated authentication datum by applying said truncation function to said second generated derived proof of knowledge;

a step of acquiring a first truncated authentication datum or a first derived truncated authentication datum obtained from said certificate;

a step of comparing the acquired first truncated authentication datum or first derived truncated authentication datum with the second generated derived truncated authentication data.

6. The authentication method according to claim 4 to authenticate a user holding a biometric certificate generated in accordance with the certificate generating method, wherein the acquisition step of the first truncated authentication datum comprises a decryption step using the encryption key to decrypt the first acquired encrypted truncated authentication datum.

7. The method according to claim 1, wherein the step of generating a proof of knowledge of biometric data comprises a step of generating a hash of the biometric data performed by applying a hash function to the biometric data.

8. The method according claim 7, wherein the proof of knowledge is generated using said hash function and a secret hash key stored solely by the certifying authority.

9. The method according to claim 1, wherein the step of generating a proof of knowledge of biometric data comprises a step of calculating a modular exponentiation of a uniformly distributed value obtained from the biometric data and from said pseudo-random function.

10. The method according claim 9, wherein the step of generating a proof of knowledge of biometric data further comprises steps of:

acquiring a derivation parameter h verifying the formula;

h=ĝ

r where r is a random number, g a generator of a group of prime order p, and g and p being public data;

calculating the proof of knowledge using the formula;

ĥ

X or hash(ĥ

X) with X being a value obtained from said biometric data and from said pseudo-random function, and hash being a hashing function.

11. The method according to claim 1, wherein the truncation function applies truncation over n bits, n being a function of the probability of occurrence of the tolerable errors.

12. A computer programme product comprising programme code instructions to implement the steps of the method according to claim 1 when said programme is run on a computer.

13. A certification server characterized in that it comprises a data processing device configured to carry out a method of generating a biometric certificate of a user according to claim 1.