Method for verifying the identity of a user of a communicating terminal and associated system

• US 10,050,791 B2
• Filed: 01/31/2013
• Issued: 08/14/2018
• Est. Priority Date: 02/27/2012
• Status: Active Grant

• Current Assignee: IDEMIA Identity and Security France SAS (Advent International Corporation)
• Original Assignee: Morpho (Advent International Corporation)
• Inventors: Berteau, Guillaume, Benteo, Bruno
• Primary Examiner(s): Parsons, Theodore C
• Application Number:
  US14/380,535
• Publication Number:
  US 20150038118A1
• Time in Patent Office: 2,021 Days
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/35 communicating wirelessly
• CPC Class Codes: H04L 2463/082 applying multi-factor authentication cryptographic mechanisms or cryptographic arrangements including means for verifying the identity or authority of a user of the system or for message authentication H04L9/32
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 9/3231 Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853
• CPC Class Codes: H04L 9/3271 using challenge-response
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 4/80 Services using short range communication, e.g. near-field communication [NFC], radio-frequency identification [RFID] or low energy communication

Abstract

A method for verifying identity of a user of a communicating terminal, including: a preliminary operation including: communicating a first piece of identity data of a user to at least one server, generating a second piece of identity data of the user from the server, the second piece of data defining a derived identity of the user, and storing the second piece of identity data in a secure memory of the terminal; an operation for identity verification, including: transmitting a token for encryption from the server to the terminal, using the second piece of data at the terminal at least to generate an encryption of the token, the encrypted token being transmitted to the server and verified by the server, and in a case of positive verification of the encrypted token by the server, the server validates the identity verification of the user of the terminal.

Claims

1. A method for verifying identity of a user of a communicating terminal, the method comprising:

performing a preliminary operation, and thereafter, performing a current operation,

wherein the preliminary operation comprises;

communicating, via a reader, a first piece of identity data of the user to at least one server;

generating at the server a second piece of identity data of the user, the second piece of identity data being derived, at least in part, from the first piece of identity data;

transmitting the second piece of data from the server to the reader, and then from the reader to the terminal; and

storing the second piece of identity data in a secure memory of the terminal; and

wherein the current operation for identity verification comprises;

transmitting a token for encryption, from the server to the terminal without transiting through the reader;

using the second piece of data at the terminal at least to generate an encryption of the token, the encrypted token being transmitted to the server and verified by the server without transiting through the reader; and

in a case of positive verification of the encrypted token by the server, validating, by the server, the identity verification of the user of the terminal,

and wherein said reader, said server and said terminal are distinct.

2. The method of claim 1, wherein the encryption uses a public key infrastructure, the second piece of identity data at least being used for generating an encryption key, and wherein the encryption key is used for encryption of the token.

3. The method of claim 1, wherein the second piece of identity data is a digital certificate certifying a key pair.

4. The method of claim 1, wherein, in the case of positive verification, the encrypted token is associated with a digital identification certificate for the user.

5. The method of claim 1, wherein the communication of the first piece of identity data of the user to the server is authorized after verification of biometric data of the user of the terminal.

6. The method of claim 1, wherein the current operation further comprises verification of user-specific data before initiating, on the terminal, the use of the second piece of data for encryption of the token.

7. The method of claim 1, wherein a plurality of preliminary operations are executed, with a plurality of communications of the first piece of identity data of the user to a plurality of servers, each server generating the respective second pieces of identity data of the user, each second piece of data defining a derived identity of the user, each derived identity being specific to a service for which access is dependent on encrypted token verification on a server dedicated to the service.

8. The method of claim 1, wherein the communication of the first piece of identity data to the server is carried out via the reader comprising a first module for short-range wireless or wired communication, and the terminal comprising a second module for short-range or wired communication, the second piece of data is transmitted from the server to the reader, then from the reader to the terminal by short-range wireless or wired communication, the short-range communication including near field communication (NFC), Wifi, or Bluetooth.

9. The method of claim 1, wherein the transmitting the token for encryption or the encrypted token, between the server and the terminal, is performed via a device requesting access to a service associated with the server, access to the service being dependent on verification of the identity of the user from the user terminal in the current operation.

10. The method of claim 9, wherein the transmitting the token for encryption or the encrypted token, between the terminal and the device, is performed by a short-range or wired communication, the terminal comprising a first module for short-range wireless or wired communication and the device comprising a second module for short-range wireless or wired communication, the short-range communication including near field communication (NFC), Wifi, or Bluetooth.

11. The method of claim 1, wherein the transmitting the token for encryption, from the server to the terminal, is performed using a mobile phone network, and the transmission of the encrypted token from the terminal to the server is performed via a device requesting access to a service associated with the server, access to the service being dependent on verification of the identity of the user from the user terminal in the current operation.

12. The method of claim 1, wherein the transmitting the token for encryption, from the server to the terminal, is performed via a device requesting access to a service associated with the server, and the transmission of the encrypted token from the terminal to the server is performed using a mobile network, access to the service being dependent on verification of the identity of the user from the user terminal in the current operation.

13. A system for verifying the identity of a user, the system comprising:

a terminal;

a reader; and

a server,

wherein the reader comprises a first communication module configured to communicate a first piece of identity data of the user to a second communication module of the server,

wherein the server is configured to generate a second piece of identity data of the user, the second piece of identity data being derived, at least in part, from the first piece of identity data, and is configured to transmit the second piece of data to the reader,

wherein the terminal comprises a third communication module configured to receive the second piece of data from the reader,

wherein the terminal comprises a secure memory that stores the second piece of identity data, and

wherein the second communication module is configured to transmit a token for encryption to the third communication module of the terminal without transiting through the reader, wherein the terminal is configured to use the second piece of data at least to generate an encryption of the token, wherein the third communication module is configured to transmit the encrypted token to the second communication module of the server without transiting through the reader, wherein the server is configured to verify the encrypted token and validate, in case of positive verification of the encrypted token, the identity verification of the user of the terminal;

wherein said reader, said server and said terminal are distinct.