Patent Application
20220335112
This invention relates to methods and apparatus for conveying verified information about an individual.
Converting the COVID CDC Vaccination Card into a standardized digital credential is turning out to be harder than expected. The conversation has become prominent in the news and risks being politicized to the detriment of public health efforts around the world.
The core problem is a combination of privacy and equity. Paper vaccination credentials tend to be only loosely linked to a verified identity like a driver's license. Many vaccination or test sites do not ask for proof of identity and proponents of digital credentials apparently like to talk about how easy it is to buy fake cards.
The privacy and equity problem is aggravated by the range of contexts where the credentials are to be verified. These range from totally voluntary to essential: from restaurant, to travel, to school, to employment.
Behind the scenes, there are a handful of groups with different agendas promoting their digital solutions to the privacy and equity problems. Their common denominator is a QR code that can be voluntarily presented on paper, like the current CDC card, or on a smartphone. It's assumed that the presentation will have name and DOB and some have a photo as well.
Introducing a biometric into the digital credential to prevent fraud is potentially a privacy issue if the biometric is centralized, as in a drivers license authority or Aadhaar in India.
In one general aspect, the invention features a credential for conveying verified information about an individual. The credential includes a biometric for the individual that is both sufficiently human-recognizable as to enable a human to match the individual with the biometric, and reliably machine-readable to enable the biometric to be reliably acquired by a computer sensor. The credential also includes a machine-readable verification code to verify against the biometric.
In preferred embodiments, the credential can be a paper credential that includes an image of the individual and a signed hash value derived from the image. The credential can include an image of the individual and a signed hash value derived from the image. The can be quantized using a quantization function. The credential can further include a certificate indicating that the individual has been subject to a medical procedure. The credential can further include a certificate indicating that the individual has been vaccinated against a particular pathogen. The credential can further include a certificate indicating that the individual has been tested for a particular medical condition.
In another general aspect, the invention features a credential verification method for verifying information about an individual that includes receiving visual access to a biometric for the individual associated with a credential to enable a human to match the individual with the biometric, acquiring the biometric associated with the credential, acquiring a verification code associated with the credential, and verifying that the acquired biometric matches the acquired verification code.
In preferred embodiments, the method can further include verifying signed information about the individual associated with the credential. The method can further include verifying signed information indicating that the individual associated with the credential has been subject to a medical procedure. The step of verifying can be performed anonymously. The verifying can be performed independent of any matching of information about the individual with information stored outside of the credential.
In a further general aspect, the invention features a credential verification method for verifying information about an individual, including incorporating into the credential a biometric for the individual that is both sufficiently human-recognizable as to enable a human to match the individual with the biometric, and reliably machine-readable to enable the biometric to be reliably acquired by a computer sensor. The method also includes incorporating into the credential a machine-readable verification code to verify against the biometric.
In preferred embodiments, the method can further include quantizing an image of the individual to produce the biometric. The method can further include receiving the quantized image of the individual and the verification code from the individual. The method can further include incorporating further information about the individual into the credential. The method can further include revoking the credential. The credential can be devoid of information that identifies who the individual is. The method can further include receiving visual access to the biometric for the individual associated with the credential to enable a human to match the individual with the biometric, acquiring the biometric associated with the credential, acquiring the verification code associated with the credential, and verifying that the acquired biometric matches the acquired verification code. The incorporating of the verification code and the verifying that the acquired biometric matches the acquired verification code can be performed according to an open-source procedure.
In another general aspect, the invention features a system for creating a credential for conveying verified information about an individual that includes a biometric interface for obtaining a biometric for the individual that is both sufficiently human-recognizable as to enable a human to match the individual with the biometric, and reliably machine-readable to enable the biometric to be reliably acquired by a computer sensor. The system also includes an app responsive to the biometric interface that is operative to derive a machine-readable verification code to verify against the biometric. In preferred embodiments the system can be implemented with a smartphone with the biometric interface including a digital camera.
In a further general aspect, the invention features a system for verifying a credential for conveying verified information about an individual that includes at least one acquisition interface operative to acquire a biometric associated with the credential, and a verification code associated with the credential. The system also includes an app responsive the interface and operative to verify that the acquired biometric matches the acquired verification code. In preferred embodiments the system can be implemented with a smartphone with the acquisition interface including a digital camera.
In one embodiment a quantized face that is still human-verifiable is added to a digital credential presentation. A hash of the quantized face, but not the face itself, would be signed and verifiable as part of the digital credential represented by the QR code.
Systems according to the invention can increase the security of digital credentials, such as vaccination credentials, without compromising the privacy of the human subject of the credential. In one general aspect, a method of enhancing a signed digital document is described by the addition of a human recognizable face image that is also reproducibly converted to a digital code, with this code being part of the signed digital document. Presentation of the enhanced document to a human inspector allows them to visually verify that the image matches the presenter and, using common digital means such as a smartphone, to verify that the signed digital document refers to the same image. The method to re-convert a human-recognizable likeness to an exact digital code in a readily reproducible manner can result in a signed digital document that is much smaller than if the digitized image itself had to be included in the document.
Referring to
In this embodiment, GIMP was used to reduce the resolution of the image to 32×32 pixels without interpolation and then indexed to 16 colors. The idea is that any camera that can read a QR code can also reliably recover the 16 colors with zero errors so the hash can be matched with the hash in the QR code credential. The choice of a 512 Byte template is just an example.
The verifier uses a mobile app that combines four functions:
A smartphone app is used at the issuer to produce the QR code. That app also needs a face photo, as above, to quantize and hash and add to the credential before signing.
It's important to recognize that, once the digital credential is handed or sent to the patient, the issuer does not need to store either the original or the quantized image.
Privacy sensitive patients that don't trust the issuer with any biometric have the option of taking their own selfie and using a quantizer app so they can deliver the hash back to the issuer to sign and then verify. A failed verification results in immediate revocation of the credential. Variations on this semi-self-issue option are possible if revocation is not available.
According to another important privacy feature, other credentials issued to the same patient could use a new face photo each time with different lighting and perspective so the hash of the quantized face would be different (<512 Bytes of entropy in the example, but still significant). This avoids issuers or verifiers colluding to correlate across credentials on the basis of the hash.
Referring to
Table 1. presents a summary of concerns with digital credentials.
Referring to
Referring to
A complementary issuance operation is easily derived from the verification method. A modified version of the Digital Processor with Camera 600 can be used to issue a Digital Credential with Quantized Face 720 at the point of vaccination or other credential inception event.
With vaccination credentials as an example, it helps to separate the vocabulary credential components from the identity credential components.
The identity aspects relate to equity and involve access to technology such as smartphones, employment discrimination based on the ability to present and inspect credentials at the worksite, and participation by the undocumented who might endanger themselves and the community if they're reluctant to receive vaccines and tests.
There is some relationship between the vocabulary and identity dimensions, if only because the overall size of the credential is limited by printing and technology cost constraints.
One thing that stands out, for example, is the statement that the patient/subject will be identified by Name and DOB. Would we ever identify someone by Name and License Number or would we ever include a code for Level of Assurance of the identity? Do we allow people to self-identify in order to improve access by the undocumented? Are we setting a precedent for documentation of rapid testing, including home self-testing?
Public health is another concern. Every digital credential issued is an opportunity to collect valuable information on prevalence, side-effects, and demographic disparities. Every digital credential could also be associated with voluntary self-reporting. Getting digital privacy right will have more impact on society than anything having to do with the digital vocabulary conversation.
This recent paper covers privacy-related modifications to a facial image.
References: Verifiable Credentials
The present invention has now been described in connection with a number of specific embodiments thereof. However, numerous modifications which are contemplated as falling within the scope of the present invention should now be apparent to those skilled in the art. Therefore, it is intended that the scope of the present invention be limited only by the scope of the claims appended hereto. In addition, the order of presentation of the claims should not be construed to limit the scope of any particular term in the claims.
This application claims the benefit of U.S. Provisional Application No. 63/176,130, filed Apr. 16, 2021, which is herein incorporated by reference.
| Number | Date | Country | |
|---|---|---|---|
| 63176130 | Apr 2021 | US |
