WO2000049583A1

WO2000049583A1 - Method and device for the personalisation and verification of identification and security documents and an identification and security document which can be used therewith

Info

Publication number: WO2000049583A1
Application number: PCT/EP2000/001057
Authority: WO
Inventors: Claus Freytag
Original assignee: Bundesdruckerei Gmbh
Priority date: 1999-02-16
Filing date: 2000-02-10
Publication date: 2000-08-24
Also published as: DE19906388A1; PE20010014A1; CO5280177A1

Abstract

The invention relates to a method and device for personalising and verifying identification and security documents and to a security document (13) which can be used therewith. The identification or security document contains data (15) specific to the individual in alphanumeric and/or graphical form, which is either printed on the document and/or stored in the same. According to the invention, the data (15) specific to the individual and/or correlated data is also present in/on the document in a second form which can be machine-read. This data and the data specific to the individual can be read out of the document and checked for consistency, using an appropriate test control unit (10).

Description

Method and device for personalizing and verifying

Identity and security documents and a usable identity and security document

The subject of the invention is a method and a device for personalization and verification of identity and security documents as well as an identity and security document which can be used therewith.

Highly secure identity documents such as ID cards, passports, licenses, driver's licenses, motor vehicle licenses, membership cards, company and service ID cards, credit cards and the like consist of an unpersonalized one

Document body on and / or in which the personal data of the holder are introduced in a manner inseparable from the document body. Several methods are known for this, e.g. photographic processes, laser engraving, thermal transfer, dye sublimation, xerographic laser processes, ink-jet processes etc. are to be mentioned.

The document body itself can consist of different materials, combinations, constructions of materials, formats and additions. Examples of materials are: identity and security papers, plastics such as polycarbonate and polyvinyl chloride. Examples of formats are: IDO, ID1 [ICAO and ISO standards, e.g. ISO 7816]

Said identity documents are produced and personalized centrally in a value and security technology company for security reasons. During the personalization, the personal data of the owner are introduced into the document body using various methods.

There are basically two classes of personnel data: alphanumeric and graphic personnel data. Alphanumeric personal data basically consist of letters, numbers and special characters of the different character sets (fonts). An example of the scope of a character set in the European language area is shown in ISO 8859. It However, there are other character sets for z. B. Arabic or Asian fonts. The OCR briefs in the ICAO lines of identity documents represent a special form because they are machine-readable. This makes it possible to read and verify alphanumeric data of the identity document with the aid of a reader (scanner). Typical graphic data of an identity document are: portraits,

Signatures, fingerprints, barcodes, national emblems and logos. This graphic data is inserted into the identity document using modern photographic or digital printing and engraving processes. This ensures that the personal data is inextricably linked to the document.

Automatic methods are known for the alphanumeric personal data. B. at airports read the ICAO lines with the help of appropriate reading devices (scanners) and compare them with the entries in an electronic personal archive (database). However, this method requires the online connection between the scanner and a central database and has not previously been able to be applied to graphic data, since these are highly complex and therefore have a high data volume. The high level of complexity necessitates a high level of processor performance in the information processing systems involved to transfer and process the data volume. Because of the large data volume, a high one

Memory requirements and a broadband transmission capacity of the connected communication devices are required. Even using the most modern information processing systems would result in unacceptably long processing and response times in practical use.

Another disadvantage of the method described above is the need for the constant online availability of the central personal database. In practice, this means that complex, fail-safe and expensive information processing systems must always be available and ready for operation, and that, for example, a police officer in a patrol car or in a local guard does not have the necessary test options mentioned. National legal restrictions are also critical in this context, e.g. B. the personal data protection, which prohibit the machine-based identification of people, since there is a risk that the data can be evaluated and motion profiles can be created from it.

The object of the invention is a method and an apparatus for

To provide personalization and verification of security documents as well as a suitable security document which allows the authenticity, in particular of graphic personal data, to be verified automatically with relatively simple means. In practice, this means that an authorizing person such. B. a police or border control officer must be able to determine whether e.g. B. the portrait of a submitted identity document belongs to this.

This object is achieved by the characterizing features of the independent claims.

The solution according to the invention essentially comprises the following features and advantages:

- Verification is possible with relatively simple means,

- The verification takes place offline, i. H. without connecting to a central database,

- The verification leads to the result that the graphic data of the identity document submitted during the check are genuine, that is to say belong to this and

- the verification does not violate applicable legal provisions.

The visual comparison between the presentation of a person's face and the pictorial representation e.g. B. as a photographic photograph or in printed form is the classic method of recognition per se. For this reason, the process solution is described below using the portrait as an identification method. Of course, the explanations apply in an adapted form for other graphic personal data, such as B. fingerprints. In a further embodiment, acoustic comparison methods for identifying such as. B. the human voice applicable.

When personalizing identity documents, portraits are increasingly being produced with the help of digital printing processes in a central security and security printing company. This method has the advantage that the production is carried out on data processing systems in which the portrait is in a computer-supported format (pixel data) and can be used efficiently for further processing. The volume of a portrait for use in identity documents is about 70 to 100 kBytes with an acceptable reproduction quality. These numbers include depending on the geometric dimensions, the color, the color depth and the compression factor.

The solution is based on the idea of including this graphic data in the conventional printed and a second machine-readable form in the identity document. This enables the two types of portrait to be compared with one another during an identity check and to confirm the authenticity of the document if the comparison is successful.

In a preferred embodiment it is provided that the portrait data, i.e. to store the comparison data in an electronic memory chip. This chip is part of the identity document. As an embodiment, chip cards according to ISO 7816 or contactless (transponder) cards can be used. Barcodes, in particular 2D barcodes such as eg. B. the PDF 417 from Symbol.

When using semiconductor memories, the writable memory area of suitable chip cards with processor functionality is currently typically 16 kbytes for contact cards. The above-mentioned amount of data in a portrait is many times larger than the available storage space. It is not at the moment possible to store the pixel data of a portrait in an uncompressed form in a chip card. Apart from that, the time it takes to read such an amount of data would be unacceptably long.

The main disadvantage of uncompressed storage, however, is that the pure pixel data enable a simple counterfeiting attack, since an attacker could overwrite the chip of an identity document with counterfeit data. For this reason, the storage of the portrait data must meet the following conditions:

- the memory size i.e. the degree of compression of the data must be in an optimal ratio of quality and feasibility and - the saving of the graphic data must be carried out in a genuine format.

In order to meet the first condition, the graphic data is prepared accordingly. The graphic data available during the production of the security document correspond to a pixel representation of the portrait. With the help of this

Data stream, the personalization device is controlled to print the image on the document. In the case of an automatic inspection, the image must be taken by a verification device. Scanners or cameras with CCD technology (CCD: Charge Coupled Devices) can be used for this. However, the scanned image always delivers a different data stream than the one used for personalization. This is due to: the fact that the color values of the portrait can never be reconstructed exactly and that the original pixel resolution can never be met precisely enough due to the geometric tolerances. For this reason, a method is used which is based on a biometric method for generating the data set. The background is that the comparison of two portraits does not depend on the pure pixel data, but that certain physical characteristics are decisive. This also corresponds to the way a police officer compares the portrait on the card with the face of a citizen. Features such as B .:

- distance between eyes, nose, ears, mouth, - size relationships of the sensory organs,

- Characteristics of the head shape and individual parts, etc.

These biometric features are obtained from the portrait data and lead to a variable individual data set. The more precisely the biometric characteristics are evaluated, the more extensive the data set becomes.

Manufacturers of such systems specify a size of 1,000 to 2,000 bytes with which the portrait of a person can be clearly characterized. A data format or a quantity of data is thus available which optimally meets the requirements for storage on a card chip. In the following version, this reference data set, which describes the characteristic features of a portrait, is called a bio data set (Bio-ref).

In order to meet the second condition mentioned above, it is envisaged to use a method which, based on asymmetric crypto encryption, guarantees that the bio data record cannot be falsified. Asymmetric encryption methods are based on a key pair with a private and a public key. The encryption is carried out with the private key and the decryption with the public key. The manufacturer of the identity documents has the certified private key of the asymmetric cryptographic process such as B. RSA. An essential prerequisite is that this private key is never made known to unauthorized third parties, otherwise the entire system will be vulnerable. For this reason, the private key must never leave the crypto box of the production system of the security company. Even the generation of this key takes place within the crypto box. A key length of 1024 bits is currently considered unassailable.

The bio data set obtained from the pixel data in the production system is encrypted with the private key of the asymmetrical crypto process. The result is an encrypted bio data record that is based on the

Process inherence can only be generated by the crypto box of the security operation. This encrypted bio record is stored in the chip's memory of the identity document. The data record can be decrypted using the public key. This may be known, since the asymmetrical cryptographic methods are characterized in that, in contrast to the symmetrical methods, the familiarity of one key means that the other cannot be derived. The invention describes the use of an asymmetric cryptographic method such. B: RSA to encrypt and decrypt the biometric data set. These methods are generally known. A standard description of the methods can be found in "Applied Cryptography" by Bruce Schneier, ISBN 0-471-11709-9.

The invention also relates to a test device which in the field

Authenticity of an identity document, especially of graphical data.

For reasons of efficiency, a hash algorithm (e.g. RIPEMD160) can be used when generating the data record, which uses the bio data record of up to 2 kbytes in size, e.g. Forms a 160-bit hash value. This offers the advantage that very little storage space is required for the storage of the data on the security document and that the method of checking the identity document can be carried out more quickly in practice.

The invention is explained in more detail below using an exemplary embodiment and with reference to several drawing figures. Further features and advantages of the invention emerge from the drawings and the associated description.

FIG. 1 shows a simple stylistic representation of a portrait with some biometric features entered;

Figure 2 shows schematically the process flow and the data flow in the personalization and verification of a security document; FIG. 3 shows a possible structure of a verification device with an inserted security document.

FIG. 1 shows a portrait in which some physical (biometric)

Features are entered: A: ear spacing

B: Eye relief

C: mouth width

D: Eye-mouth distance

E: nose-eye distance

Of course there are a variety of other features that are needed to generate the

Bio data set can be used, e.g. Shape of the chin area,

Shape of the nose, scars, liver spots etc.

Various methods are known in biometrics (teaching of the measurement of living characteristics). B. Recognize, assign and measure facial features. The result is a characteristic data set. The quality of the data record depends on the type of procedure and the amount of data. These biometric methods are state of the art and their mode of operation will not be explained in more detail here.

A portrait in CMYK color representation with passport size and a digital resolution of 600 dpi requires approx. 3.5 million bytes in uncompressed representation. Common methods such as TIFF, JPEG, Wavelet or fractal compression allow the reduction of the above. Amount of data. However, they are always associated with a loss of quality in the original data, which no longer allows a clear recognition for a verification system.

The biometric methods solve the problem because they only consider the essential physical characteristics. Example: If the eye relief is to be determined within a range of 20 mm with an accuracy of 0.1 mm, the result can be specified in just one byte. Under Taking into account, for example, a thousand such biometric features, a portrait with an extremely low probability of error can be described in only one kbyte of storage space.

The biometric method is used in two places in the invention. During personalization, the bio-data record (Bio-ref) is generated using the biometric process, which is encrypted and stored in the chip memory of the ID document. In the test device (verification device), a second bio data set (bio scan) is generated from the scanned portrait using the same biometric method. A comparison of both bio-data sets gives the verification result.

The data flow in the personalization and in the verification of the identity document is shown in FIG. 2.

When personalizing the ID document, file 1 with the pixel portrait data of a person is initially available. These data are subjected to a suitable biometric method 2, which results in a bio dataset (Bio ref) which is greatly reduced in scope of data. This bio data record is encrypted using an asymmetrical encryption method 3 using a private key and stored in a memory chip 4 arranged on the ID document.

During verification, the ID document is inserted into a test device. The test device has an optical reading device by means of which the pictorial portrait is scanned on the ID document, so that a pixel portrait file 5 results which is stored in a memory of the test device. This pixel file is subjected to the same biometric method 6 as was already used in the personalization of the document, resulting in a biometric data record 7 (bio-scan), which is also stored in the memory of the test device. The test device has a contact and / or contactless one

Readout device with which the Bio-ref data from the memory chip of the ID Document can be read out, decrypted and saved in the test device's memory.

Both bio data sets, Bio-ref and Bio-scan, are now present in the test device and are now compared by means of a verification method 8 from a microcomputer in the test device. This comparison leads to a result 9, which is displayed to the user optically and / or acoustically. If the two bio-data sets agree to a large extent, the authenticity of the ID document is proven. If they do not match sufficiently, a forged document can be assumed.

FIG. 3 shows an embodiment of the test device 10 with a housing 11 approximately the size of a video cassette. The test device 10 has a positioning unit on a narrow side, with the aid of which the identity document 13 can be brought into a defined position. This can e.g. B. be an insertion slot 12 or a support surface. The correct positioning can be recognized automatically by a sensor system that initiates the start of the test. However, the start can also be triggered manually by pressing a button. Geometrically compared to the graphic to be checked (here: Portrait 15) there is a recording unit, e.g. B. a scanner 16 or a camera. The microchip 14, on which the bio reference data is stored, is electrically connected via a contacting unit 17. In a special embodiment, the connection is made contactlessly via an electromagnetic antenna system. The test device 10 has a microcomputer 18 to which the scanner 16 and the chip contacting unit 17 are connected. The microcomputer 18 executes the digital test functions and outputs the calculated test result via a display unit (not shown).

The functions run as follows. After positioning the identity document 13 and the start triggering, the portrait 15 is recorded via the scanner 16 and converted into digital signals. The portrait 15 is thus available as a pixel file in a form similar to that used to personalize the identity document in security operation. This pixel file will stored in the memory of the microcomputer 18. The processor generates a second bio data record (bio scan) from this pixel file using the same algorithm as for personalization, which is also stored in the memory of the microcomputer 18.

In a further step, the processor reads the encrypted bio data record (bio ref) from the chip 14 of the identity document 13 and stores it in the memory of the microcomputer 18 of the test device 10. Due to the initialization of the microcomputer 18, the public key of the cryptological system is available in this memory. With the help of this key, the first bio data set (bio ref) is decrypted from the chip 14. Both bio data sets (Bio-ref and Bio-scan) are thus available in comparable form in the test device 10 and the verification can be carried out.

As already described, the two bio data sets cannot be absolutely identical due to the recording tolerances of the scanned portrait 15. Similar methods of biometric verification deliver results with deviation rates in the subpromille range. Taking into account a threshold value from this range, these deviations are tolerated. It should be noted that the deviation rates are significantly lower than, for example, when visually comparing a portrait with a living person, e.g. B. by an inspection officer.

The processor provides the verification result via an output unit on the surface of the test device 10. In the simplest case, this can be a red / green light unit, but also the digital representation of the

Verification result z. B. in percent of agreement of the data or an acoustic "OK" signal.

By a suitable selection of the mechanical and electronic components, in particular the microcomputer 18, the testing process can be restricted to a few seconds. The structure of the test device 10 is designed so that it is suitable for mobile use. For these reasons, it has via a power supply from batteries or rechargeable batteries and / or via a connection to a mains adapter or the 12-volt supply network of a car.

Drawing legend

file

Biometric method

Encryption

Memory chip with Bio-ref data set

Pixel portrait data

Biometric method

Biometric data set (bio-scan)

comparison

Result

Tester

casing

Slot

I D card

Microchip

portrait

scanner

Contact unit

Microcomputer

Claims

claims

1. Identity or security document, which has personal data, which is applied in alphanumeric and / or graphic form on the document and / or incorporated therein, characterized in that the personal data (15) and / or data correlated with this in a second, machine-readable form is present on / in the document, and the data present in the second, machine-readable form are data generated by a biometric method.

2. Identity or security document according to claim 1, characterized in that the data available in the second, machine-readable form are in compressed form.

3. Identity or security document according to one of claims 1 or 2, characterized in that the data present in the second, machine-readable form are present in encrypted form.

4. Identity or security document according to one of claims 1 to 3, characterized in that it comprises a non-volatile electronic storage medium (14).

5. Identity and security document according to claim 4, characterized in that the data available in the second, machine-readable form are stored in the electronic storage medium (14).

6. Identity or security document according to claim 4 or 5, characterized in that the storage medium has connection contacts for reading in and / or reading out the data stored thereon.

7. Identity or security document according to one of claims 4 to 6, characterized in that the storage medium has means for wireless reading and / or reading the data stored thereon.

8. Identity or security document according to one of claims 1 to 7, characterized in that the data present in the second, machine-readable form are introduced onto / into the document in the form of a bar code.

9. Method of personalizing an identity or security document, in which personal data is in alphanumeric and / or graphic

Form applied to and / or introduced into the document, characterized in that the personal data and / or data correlated with this are applied to and / or introduced into the document in a second, machine-readable form, and that in the second, machine-readable form of existing data is generated from the personal data by means of a biometric process.

10. The method according to claim 9, characterized in that personal data are used in digitally processable form.

11. The method according to any one of claims 9 or 10, characterized in that the data present in the second, machine-readable form are encrypted by means of an asymmetrical encryption method.

12. The method according to any one of claims 9 to 11, characterized in that the data present in the second, machine-readable form are compressed.

13. The method according to any one of claims 9 to 12, characterized in that the data present in the second, machine-readable form in an on / in non-volatile electronic storage medium present in the document can be saved.

14. The method according to any one of claims 9 to 13, characterized in that the data available in the second, machine-readable form are stored as a barcode in / on the document.

15. Device for verifying an identity or security document, characterized by:

- A positioning means (12) for correctly positioning the identity and / or security document (13);

- a first scanning means (16) for capturing personal data (15) attached / attached to the identity or security document;

- a second scanning means (17) for acquiring comparison data present on the identity or security document; - Means (18) for storing, processing and processing the acquired data and for outputting and displaying result data.

- Means (18) for processing the personal data using a biometric method.

16. A method for verifying an identity or security document which has personal data which is applied to and / or incorporated into the document in alphanumeric and / or graphic form, characterized by the following steps: - scanning / reading out the personal data and Save this

Data in digital form;

- Reading out comparison data stored on the document;

- comparing the personal data with the comparison data;

- Output the result of the comparison. - Processing of personal data using a biometric

Procedure

- Storage of the resulting biometric data

17. The method according to claim 16, characterized in that the biometric data are compared with biometric comparison data present on / in the document.

18. The method according to any one of claims 16 or 17, characterized in that the personal data are read from the document by means of an optical image sensor.

19. The method according to any one of claims 16 to 18, characterized in that the data available in the second, machine-readable form are read from an electronic storage medium present on the document.

20. The method according to any one of claims 16 to 19, characterized in that the data present in the second, machine-readable form are present as a barcode on the document and are read out by means of an optical image sensor.