Method for generating at least one derived identity

• US 9,830,442 B2
• Filed: 04/23/2014
• Issued: 11/28/2017
• Est. Priority Date: 04/30/2013
• Status: Active Grant

• Current Assignee: IDEMIA Identity and Security France SAS (Advent International Corporation)
• Original Assignee: Morpho (Advent International Corporation)
• Inventors: Didier, Bernard, Chabanne, Herve, Bringer, Julien
• Primary Examiner(s): Zand, Kambiz
• Assistant Examiner(s): Kaplan, Benjamin
• Application Number:
  US14/888,015
• Publication Number:
  US 20160103986A1
• Time in Patent Office: 1,315 Days
• Field of Search: 726 7
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06Q 20/40145 Biometric identity checks
• CPC Class Codes: G07F 7/10 together with a coded signal , e.g. in the form of personal identification information, like personal identification number [PIN] or biometric data
• CPC Class Codes: H04L 9/085 Secret sharing or secret splitting, e.g. threshold schemes
• CPC Class Codes: H04L 9/3231 Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861

Abstract

The invention provides a method of generating at least one derived identity of an individual 1, the method comprising the following steps:

• • generating a first identifier id1 from biometric data of the individual;
  • defining a serial number ns associated with the individual;
  • generating first check data ctrl1 for verifying consistency between the first identifier id1 and the serial number ns; and
  • concatenating the serial number ns, the first identifier id1, and the first check data ctrl1 in such a manner as to form a first derived identity ident1 of the individual.

Claims

1. A method of generating at least one derived identity of an individual (1) to be used by a service supplier, the method comprising the following steps:

generating a first identifier (id1) from biometric data (5) of the individual using a user device;

defining a serial number (ns) associated with the individual by a service supplier device;

generating first check data (ctrl1) by the service supplier device for verifying consistency between the first identifier (id1) and the serial number (ns);

concatenating the serial number (ns), the first identifier (id1), and the first check data (ctrl1) by the service supplier device in such a manner as to form a first derived identity (ident1) of the individual; and

storing the first derived identity in the user device, wherein

when the individual gains access to a service of the service supplier using the first derived identity stored in the user device, it is not possible to identify the individual from data of the individual stored in the service supplier device.

2. A method according to claim 1, wherein the first identifier is generated from at least one derivation parameter.

3. A method according to claim 2, further including a step consisting in defining a digital key (cln) serving to recover the derivation parameter, the first derived identity being formed by concatenating the serial number (ns), the first identifier (id1), first check data (ctrl1), and the digital key (cln).

4. A method according to claim 1, wherein the first identifier (id1) is obtained from a trapdoor function.

5. A method according to claim 3, wherein the first identifier is the result of modular exponentiation of the type h1^db.r1mod M, where h1 is a first derivation parameter, r1 is a randomly defined second derivation parameter, M is a third derivation parameter or modulus, dB is a digital value representative of the user'"'"'s biometric data (5), and wherein the digital key (cln) enables the first, second, and third parameters to be recovered.

6. A method according claim 3, further including the following steps:

generating a second identifier (trunc(id1)) obtained by reducing the size of the first identifier (id1);

generating second check data (ctrl2) for verifying consistency between the second identifier, the serial number, and the digital key; and

concatenating the serial number, the second identifier, the digital key, and the second check data so as to constitute a second derived identity (ident2) of the individual.

7. A method according to claim 6, wherein the second derived identity (ident2) is for manually accessing personal data of the user stored by a service supplier.

8. A method according to claim 7, further including a step consisting in generating a static identity (idi) of the form h2^ident1mod M′

, where ident1 is the first derived identity, h2 is a fourth derivation parameter, and M′

is a modulus.

9. A method according to claim 1, further including the step of generating a third derived identity (ident3) or dynamic derived identity, the dynamic derived identity being formed by a first identification term of the form a=g2^r2 and by a second identification term of the form b=h2^{(r2+c).ident1}, with g2^s2=h2, ident1 being the first derived identity, h2 being the fourth derivation parameter, g2 and s2 being the fifth and sixth derivation parameters, r2 being a random seventh derivation parameter, and c being an eighth derivation parameter.

10. A method according to claim 9, further including a step during which it is verified that (a.g2^c)^s2.ident1=b.

11. A method according to claim 9, wherein the third derived identity is for remotely accessing the personal data of the user stored by the service supplier, and wherein the third derived identity (ident3) is recalculated on each user access to the user'"'"'s personal data.

12. A method according to claim 1, wherein the first identifier (id1) and/or the third derived identity (ident3) and/or the static identity (idi) is/are generated by an identification medium (2) held by the individual and containing biometric data of the individual.

13. A method according to claim 12, wherein the first identifier (id1) and/or the third derived identity (ident3) and/or the static identity (idi) is/are stored in the identification medium.

14. A method according to claim 12, further including a step during which the identity of the user is verified by acquiring biometric data of the user and comparing it with the biometric data stored in the identification medium.