Method for generating public identity for authenticating an individual carrying an identification object
A method for generating a public identity for authenticating an individual carrying an identification object, the method including: entering an initial biometric datum of the individual; generating a first key from the biometric datum; generating a second key derived from a datum generated by a security component of the object; generating an initial encryption key combining the first key and the second key; communicating with a server a first identity of the individual in connection with the initial encryption key; generating by the server a public identity by encrypting the first identity using the initial encryption key, the public identity being stored by the server in connection with the initial encryption key. The public identity is not significant, but is secured by a strong connection between the object and biometry of the individual.
1. A method for generating a public identity for authenticating an individual carrying an identification object including at least one security component, the method comprising:
an initialization phase including:
capturing initial biometric data of the individual;
generating a first key by applying a hash function to the biometric data, wherein the first key is generated in the security component of the identification object;
generating a second key based on data generated by the security component of the object only, the second key being generated in the security component;
generating an initial encryption key combining the first key and the second key;
communicating, with a server, a first identity of the individual in association with the initial encryption key; and
generating, by the server, a public identity by encrypting the first identity using the initial encryption key, the public identity being stored on the server in association with the initial encryption key, wherein the server introduces a key derivation function for the initial encryption key before generating the public identity.
2. The method according to claim 1 , wherein the data generated by the security component of the object is an unpredictable numerical value Physical Unclonable Feature (PUF) produced by the security component of the object.
3. The method according to claim 1 , wherein the data generated by the security component of the object is a random number stored in the security component of the object after generation.
4. The method according to claim 1 , wherein the first key is obtained by applying a signature or encryption function to reference digital data derived from the biometric data.
5. The method according to claim 1 , wherein the first key is generated in a secure element of a third party and transmitted to the identification object.
6. The method according to claim 1 , wherein the initial encryption key is generated by the security component of the identification object, then transmitted to the server.
7. The method according to claim 1 , wherein the initial encryption key is generated by the server.
8. The method according to claim 1 , wherein the generating generates the first key by introducing a key derivation received from the server.
9. The method according to claim 1 , wherein the generating generates the second key by introducing a key derivation received from the server.
10. The method according to claim 1 , wherein a plurality of derived public identities is generated and stored on the server or on a plurality of servers in association with a respective derived initial encryption key.
11. The method according to claim 10 , wherein the public identity or identities are also transmitted and stored in the identification object.
12. The method according to claim 1 , further comprising:
a verification phase for verifying the identity of the individual carrying the identification object, the verification phase including the following steps:
capturing current biometric data of the individual,
generating current data by the security component of the object,
generating a current encryption key from the current biometric data and from the current data generated by the security component of the object,
comparing the current encryption key with the initial encryption key,
in response to the comparison being positive, validating the identity of the individual carrying the identification object, and
in response to the comparison being negative, refuting the identity of the individual carrying the identification object.
13. The method according to claim 12 , wherein the comparing is performed in the security component of the identification object.
14. The method according to claim 12 , wherein the comparing is performed at the server.
15. An electronic device comprising:
a security component configured to
capture initial biometric data of an individual,
generate of a first key by applying a hash function to the biometric data, wherein the first key is generated in the security component of the identification object,
generate a second key based on data generated by the security component only,
generate an initial encryption key combining the first key and the second key, and
communicate, with a server, a first identity of the individual in association with the initial encryption key, the server generating a public identity by encrypting the first identity using the initial encryption key, and storing the public identity in association with the initial encryption key;
wherein a key derivation function for the initial encryption key is introduced by the server before generation of the public identity.
16. The electronic device according to claim 15 , further comprising a device configured to capture biometric data.
17. The electronic device according to claim 15 , wherein the security component accesses a memory in which a plurality of public identities is stored.
18. A system for authenticating a holder of an identification object, the system comprising:
at least one authentication server; and
an electronic device including a security component configured to
capture initial biometric data of an individual,
generate of a first key by applying an encryption a hash function to the biometric data, wherein the first key is generated in the security component of the identification object,
generate a second key based on data generated by the security component only,
generate an initial encryption key combining the first key and the second key, and
communicate, with a server, a first identity of the individual in association with the initial encryption key,
wherein the authentication server is configured to generate a public identity by encrypting the first identity using the initial encryption key, and store the public identity in association with the initial encryption key; and
wherein a key derivation function for the initial encryption key is introduced by the authentication server before generation of the public identity.
19. The system according to claim 18 , further comprising a plurality of authentication servers each including at least one derived public identity.