DE102014207439B4 - Masking sensitive data during user identification - Google Patents

Abstract

A method for sending masked image data depicting an identification document (200) to a central server (50), the method comprising:
- capturing image data (302) with a camera (65) of a user terminal (60), wherein the image data (302) depict the identification document (200),
- capturing further image data (301) with the camera (65) of the user terminal (60), wherein the further image data (301) depict the identification document (200), wherein the further image data (301) have a lower resolution than the image data (302), wherein a resolution of the further image data (301) is so low that sensitive data of the identification document (200) cannot be recognized,
- recognizing the identification document (200) in the further image data (301),
- Obtaining control data from an image recognition of the further image data (301),
- changing pixel values in the image data (302) in the area of a mask (502) for masking the identification document (200), wherein the mask (502) is determined as a function of a pose of the identification document (200) in the image data (302) and as a function of the control data that define a type of the identification document (200),
- Sending at least parts of the image data (302) with the changed pixel values to the central server (50).

Description

There are known scenarios in which identifying a user is desirable. Identifying a user can mean verifying or providing the user's identity or verifying or providing one or more of the user's identity criteria. In various scenarios, such identity criteria can include the user's age, the user's place of residence, and/or the user's name.

Such scenarios can include, for example, identity-critical transactions, such as purchase contracts or bank transfers or access controls, where, due to legal regulations or personal interests, it must be ensured that the identity of the transaction partner is established and/or that the identity criteria meet certain requirements - such as being of legal age or living in a certain country, etc. This means that the user can be authenticated depending on the identification.

However, even in other scenarios that are not or not particularly identity-critical, it may be desirable to provide simple and fast techniques for identifying the user.

Typically, such scenarios may require a comparatively high degree of reliability and/or security against forgery and/or fraud in identification. For example, it may be desirable to make user identification secure against forgery of identification documents and/or deliberate deception.

Identification techniques are known in this regard that rely on a user appearing in person at an authorized location. There, an identification document containing the user's photograph can then be used for identification. Various types of identification documents are known, such as passports, identity cards, driver's licenses, and/or other official documents.

However, identification techniques are also known which are based on the user sending image data of an identification document to a central location, such as an identification server, see for example German patent application DE 10 2013 100 635.3 In this case, it may be desirable – for example, for data protection reasons – that not all data provided by a typical identification document is sent to the central location. In other words, it may be desirable to ensure that only relevant data is sent. Certain sensitive data can be exempted from transmission.

Therefore, there is a need for technologies that, on the one hand, enable a high level of reliability and/or forgery-proofness of user identification by means of a user identification document; on the other hand, however, protect certain data on the identification document from unauthorized access.

This object is solved by the independent claims. The dependent claims define further embodiments.

According to a first aspect, the invention relates to a method for sending masked image data of an identification document to a central server. The masked image data depicts an identification document. The method comprises capturing image data with the camera of the user terminal. The image data depicts the identification document. The method comprises capturing further image data with the camera of the user terminal, wherein the further image data depicts the identification document, wherein the further image data has a lower resolution than the image data, wherein the resolution of the further image data is so low that sensitive data of the identification document cannot be recognized. The method comprises recognizing the identification document in the further image data. The method comprises obtaining control data from image recognition of the further image data. The method further comprises changing pixel values in the image data in the region of a mask to mask the identification document. The mask is determined based on a pose of the identification document in the image data and based on the control data that defines a type of the identification document. The method further comprises sending at least portions of the image data with the modified pixel values to the central server.

The central server can, for example, be configured to authenticate and/or identify the user based on the sent image data. Identification can mean, for example, determining an identity or at least certain identity parameters of a user. Identity parameters can include, for example, name, address, age, citizenship, etc. Authentication can mean, for example, comparing certain identity parameters with predefined values.

Masking can mean: locally changing pixel values - for example compared to measured pixel values - to make Information depicted by the pixel values, which concerns some sensitive data. For example, the pixel values can be set to a uniform value, such as black, white, or yellow. Other effects, such as smearing, etc., are also possible. Changing the pixel values can mean, for example, changing them relative to a reference value, changing them relative to a measured value, and/or changing them relative to a value of a neighboring pixel, etc. When changing them, the pixel values of neighboring pixels can also be taken into account.

Using the techniques described above, the effect of reliable masking of the image data can be achieved. In particular, sensitive data can be masked securely and appropriately for the identification document. By determining the mask depending on the pose of the identification document in the image data, particularly reliable masking of the sensitive data can be achieved. In particular, the masking can be robust to different poses of the identification document. Depending on the different type of identification document, sensitive data to be masked can be located in different positions on the identification document, e.g., in the top left of an identity card, but in the bottom right of a passport. This can be taken into account by determining the mask depending on the tax data.

In particular, the additional image data can be captured first and only then the image data can be captured.

Recognizing the identification document in the additional image data can mean: determining that the identification document is depicted in the additional image data and, optionally, determining a pose of the identification document in the additional image data. In other words, it can first be checked whether the additional image data depicts the identification document at all and then, optionally, it can be checked with which pose the additional image data depicts the identification document. The pose of the identification document can mean a position and an orientation of the identification document in the image data and/or in relation to the camera, i.e., it can be determined, for example, by the spatial position, i.e., the distance from the camera and an orientation in space.

The pose of the identification document in the image data can be determined, e.g., using image recognition techniques. In a simple embodiment, the basis for determining the pose can be the image data itself or, alternatively or additionally, previously acquired additional image data, for example, as a reference or initial value or as a representative value. For example, based on the pose of the identification document in the additional image data, the pose of the identification document in the image data can be anticipated. The method can therefore further comprise: recognizing a pose of the identification document in the additional image data and determining the pose of the identification document in the image data based on the recognized pose in the additional image data.

In this way, for example, it may be possible to determine the mask before the image data is captured. This can make masking particularly efficient and less computationally intensive. Furthermore, it would be possible to anticipate and disregard certain pixel values during the image data capture process. Sensitive data can therefore be rendered unrecognizable at an early stage of data capture and processing. This could ensure particularly high security against unauthorized reading of the information to be masked. Certain deviations in the pose of the identification document between the additional image data and the image data may be tolerable; for example, the mask could be determined with a corresponding tolerance range. Movements and shifts between the additional image data and the image data could be compensated for in this way, e.g., provided that the time period between the capture of the additional image data and the image data is not too long.

It would also be possible to determine the mask directly from the image data, i.e., after it has been captured. The pose of the identification document can thus be determined directly from the image data. This has the effect of particularly precise masking.

The control data can be obtained, for example, from user input. It would be possible, for example, for the user to initially specify the type of identification document, e.g., via a corresponding user interface on the user terminal. The control data can be obtained alternatively or additionally from image recognition of the additional image data. The control data can be obtained alternatively or additionally from image recognition of the image data. Suitable image recognition techniques can be used for this purpose. This ensures that the control data specifies the correct type of identification document. This allows for precise masking of sensitive data. Incorrect masking can be avoided.

For example, a geometric reference shape of the mask can be specified. Alternatively or additionally, the geometric reference shape can be received from the central server. The method can further comprise: determining the mask by transforming the geometric reference shape according to the pose of the identification document in the image data.

The reference shape can, for example, be different for different types of identification documents. In other words, the reference shape can be specific to a type of identification document. For example, the geometric reference shape of the mask can comprise a shape of the mask for a specific reference pose of the respective identification document. The transformation can then correspond to a geometric transformation of the reference pose into the pose of the identification document in the image data.

For example, the method may further include sending the control data to the central server. For example, it may be possible to determine the appropriate geometric reference shape based on the sent control data. The control data may not contain any identity-related information, so the control data can be sent before the image data is masked.

In general, the additional image data and the image data can be selected flexibly, for example with regard to format, type, resolution, etc. For example, the additional image data can be a still image or a single image. For example, the image data can be a still image or a single image. For example, the additional image data can be a film. For example, the image data can be a film. For example, the additional image data and the image data can be part of a film, e.g., the same film. Changing the pixel values during masking can occur in real time during the film. This can ensure the effect of reliable user identification, while simultaneously reliably masking sensitive data. For example, if the pose of the identification document changes over time during the film, it would be possible for the pose to be determined in real time, and for the sensitive data to be reliably masked by masking with a current pose of the identification document. The changing pose of the displayed identification document can also ensure that it is not a forgery or fraud; this can make identification more reliable.

The image data and/or the additional image data can each comprise a sequence of individual images. The individual images can depict the identification document in different poses. The pixel values can be changed individually for each individual image in the image data. For example, a current pose could be determined for each individual image, e.g., based on the corresponding individual image and/or a previous individual image and/or the additional image data. This ensures that, even if the identification object moves over time, a valid and current masking of the sensitive data is always performed. The portions of the image data with the changed pixel values could, for example, be sent to the central server as part of a live chat. The live chat can enable particularly secure identification; the time-resolved change in the pixel values can ensure that the sensitive data remains hidden for the duration of the live chat. In such a case, in particular, the individual images can be captured at points in time that are separated by only a few tens of milliseconds or less. In other words, the image data and/or the additional image data can comprise individual images if they are part of a film. However, it would also be possible for a larger time interval to exist between the capture of the various individual images. It would also be possible for the capture of the individual images to be user-initiated.

The additional image data and the image data can, for example, have different resolutions. Resolution can refer to a density of pixels relative to image area or a total number of pixels per image. For example, the additional image data can have a lower resolution than the image data, or vice versa. For example, a first resolution of the additional image data can be equal to or less than 4 megapixels, preferably 2 megapixels, particularly preferably 1 megapixel. A first resolution of the additional image data could be equal to or less than 350 pixels per inch (dpi), preferably 250 dpi, particularly preferably less than 75 dpi.

For example, the resolution of the additional image data may be so low that sensitive data cannot be recognized, even without appropriate masking of the additional image data. At the same time, the resolution of the additional image data may be sufficiently high that recognition of the identification document, optionally the pose of the identification document, is still possible in the additional image data. This may allow reliable masking of sensitive data even at a time when masking is not yet possible or only possible to a limited extent, e.g., because an image recognition technology has not yet recognized the identification document. Sensitive data can be particularly well protected against unauthorized access.

Furthermore, the identification document can be recognized quickly and with a particularly low computational effort in the additional image data, provided the data has a comparatively low resolution. Initiating the capture of the image data can therefore be particularly fast.

According to a further aspect, the invention relates to a user terminal configured to send masked image data to a central server. The masked image data depicts an identification document. The user terminal comprises a camera, a processor, and an interface. The camera is configured to capture image data. The image data depicts the identification document. The camera is further configured to capture additional image data, wherein the additional image data depicts the identification document, wherein the additional image data has a lower resolution than the image data, wherein the resolution of the additional image data is so low that sensitive data of the identification document cannot be recognized. The processor is configured to recognize the identification document in the additional image data and to obtain control data from image recognition of the additional image data. The processor is further configured to change pixel values in the image data in the region of a mask for masking the identification document. The mask is determined depending on a pose of the identification document in the image data. The mask is further determined depending on control data that defines the type of identification document. The interface is configured to send at least parts of the image data with the modified pixel values to a central server.

For such a user terminal, effects can be achieved that are comparable to the effects that can be achieved for a method for transmitting masked image data according to a further aspect.

The user terminal can be configured to execute a method for transmitting masked image data according to another aspect. For example, the processor can be configured to determine the mask according to the described techniques. For this purpose, the first image data can also be captured by the camera and processed accordingly by the processor.

The features presented above and the features described below can be used not only in the corresponding explicitly presented combinations, but also in further combinations or in isolation without departing from the scope of the present invention. In particular, it is possible to combine the various features of the methods for identifying the user and for providing image data.

• 1 illustriert ein Identifizierungs-Dokument, das sensible Daten umfasst.
• 2 illustriert das Identifizierungs-Dokument der 1, wobei die sensiblen Daten maskiert sind.
• 3 illustriert ein Benutzerendgerät, das zur Identifikation eines Benutzers anhand von Bilddaten, die das Identifizierungs-Dokument abbilden, in Verbindung mit einem Identifizierungs-Server steht.
• 4 illustriert weitere Bilddaten, in denen das Identifizierungs-Dokument abgebildet ist.
• 5 illustriert Bilddaten, in denen das Identifizierungs-Dokument abgebildet ist und in denen sensible Daten maskiert sind.
• 6 illustriert das Maskieren der Bilddaten in Abhängigkeit von der Pose des Identifizierungs-Dokuments.
• 7 ist ein Flussdiagramm eines erfindungsgemäßen Verfahrens zum Senden von maskierten Bilddaten.
• 8 illustriert ein Szenario, bei dem die weiteren Bilddaten und die Bilddaten jeweils eine Abfolge von Einzelbildern als Film umfassen.

The above-described properties, features and advantages of this invention, as well as the manner in which they are achieved, will become clearer and more clearly understood in connection with the following description of the embodiments, which are explained in more detail in connection with the drawings.

• 1 illustrates an identification document containing sensitive data.
• 2 illustrates the identification document of the 1 , with the sensitive data masked.
• 3 illustrates a user terminal that is connected to an identification server for identifying a user based on image data representing the identification document.
• 4 illustrates further image data in which the identification document is depicted.
• 5 illustrates image data in which the identification document is depicted and in which sensitive data is masked.
• 6 illustrates the masking of the image data depending on the pose of the identification document.
• 7 is a flowchart of a method according to the invention for transmitting masked image data.
• 8 illustrates a scenario in which the further image data and the image data each comprise a sequence of individual images as a film.

The present invention is explained in more detail below using preferred embodiments with reference to the drawings. In the figures, identical reference numerals denote identical or similar elements. The figures are schematic representations of various embodiments of the invention. Elements shown in the figures are not necessarily drawn to scale. Rather, the various elements shown in the figures are depicted in such a way that their function and general purpose will be understood by those skilled in the art.

Connections and couplings between functional units shown in the figures and elements can also be implemented as an indirect connection or coupling.

A connection or coupling can be implemented wired or wirelessly. Functional units can be implemented as hardware, software, or a combination of hardware and software.

The figures illustrate techniques for generating masked image data for subsequent user identification. Reliable and secure identification of individuals is required in various business processes—whether opening an account or securities account, concluding a mobile phone contract, consuming age-restricted content, or generally preventing fraud in business transactions. Such identification often requires the verification of an identity document, which is typically checked for authenticity and compared with the face of the person to be identified. Furthermore, a copy of the ID card is often made in this context. Especially in processes where the verification is not carried out in person, but via electronic methods such as sending a copy of the ID card, taking a photo/video of the ID card, or showing the ID card in a live video connection, a copy of the ID card is automatically created, as this should be stored, at least temporarily, by the identification service provider.

This can be problematic for data protection reasons, as the identification document contains various personal data. Often, the identification document displays significantly more data than is required for the actual identification process. Furthermore, some sensitive data is printed on the identification document that should be transmitted to third parties.

The following explains techniques that enable identification while preventing the disclosure of sensitive data. 1 shows a typical identification document 200, e.g., a driver's license. Of course, alternative identification documents 200 are possible, e.g., credit cards, student IDs, library cards, identity cards, passports, other official documents, etc. In general, the identification document 200 should have certain integrity or validity features 203 that can be used to verify its authenticity, e.g., watermarks, holograms, reliefs, check digits, etc. Authenticity can, for example, be particularly advantageously determined using image data that depict the identification document 200 in different poses, e.g., by tilting or rotating it, etc. Furthermore, the identification document 200 should have certain identification information 202 that can be used to identify the user or holder of the identification document 200. Typical examples would be name, address, age, passport photo, etc.

In addition, the identification document of the 1 also contains sensitive data 201. For data protection reasons, such sensitive data 201 should not be passed on to third parties, e.g., not even for identification purposes. The sensitive data 201 could, for example, be specified by the user or determined according to certain general guidelines. Examples would be: the verification code of a credit card, the Card Access Number (CAN) of a German identity card, the registration number of a student ID card, etc.

Typically, the position of the sensitive data 201 on the identification document 200 is known and depends on the type of identification document 200. This is in 2 There, it can be seen that certain areas of the identification document 200 have been blacked out. These areas, where the sensitive data 201 is located, are thus rendered unrecognizable (masked). Alternative masking techniques can be selected, for example, from the following group: blacking out, deleting, obscuring, pixelating, blurring, distorting, etc.

If corresponding image data are subsequently sent to a central location, e.g. to an identification server 50 (cf. 3 ), the corresponding areas are illegible and the sensitive data 201 is protected from unauthorized access. Techniques are described below that enable the masking of the image data to be sent, which is captured by a camera 65 of a user terminal 60, in a particularly efficient and secure manner – especially when the identification involves sending image data as part of a film, such as in a live chat. The user terminal 60 can be, for example, a cell phone, a tablet, a PC with a webcam, a television with a camera, or the like. The connection between the user terminal 60 and the identification server 50 can be established, for example, via the Internet. For this purpose, the user terminal has a corresponding interface 69. The interface 69 can operate wirelessly and/or wired. Packetized data can be exchanged. The user terminal 60 can have a user interface 66, by means of which user input can be sensed and/or information can be output to the user. The user interface 66 can include: Voice output, image output via a touchpad, a touchpad, buttons, sliders, keys, etc. For example, the user interface 66 may include a screen on which image data captured by the camera 65 is displayed in real time. Furthermore, the user terminal 60 includes a processor 67 configured to perform various techniques related to image capture and image processing. These may include, for example, image recognition and masking techniques, as explained below. The processor 67 may be configured to perform these techniques in real time.

In 4 further image data 301 captured by the camera 65 are shown, which depict the identification document 200 (in 4 only shown schematically). The further image data 301 have a specific resolution, which can be selected to be comparatively low, e.g., less than 4 megapixels, preferably less than 2 megapixels, particularly preferably less than 1 megapixel. For example, the resolution can be selected such that the identification document 200 can still be recognized in the further image data 301, but at the same time, in particular, the content of the sensitive data 201 is illegible. It may be unnecessary for the integrity information 203 and/or the identification information 202 to be recognized. In other words, the further image data 301 can have such a low resolution that text, etc., of the sensitive data 201 is not recognizable or can only be recognized to a limited extent. This ensures that the sensitive data 201 cannot be read out of the further image data 301 without authorization. Furthermore, the further image data 301 should not be sent to the identification server 50. This further ensures that these additional image data 301, in which no masking has yet taken place, are used without authorization to access the sensitive data 201.

The additional image data 301 can, for example, be captured as a film with a specific frame rate. This makes it particularly easy for the user to photograph the identification document 301. Using suitable image recognition techniques, such as edge detection, template matching, or landmark recognition, the identification document 200 can then be recognized in the additional image data 301. For this purpose, for example, a corresponding image recognition can be carried out in a predetermined area of the additional image data 301 (in 4 illustrated by the indicated frame). Optionally, the pose, ie the position and orientation of the identification document 200, can also be recognized.

As soon as the identification document 200 is recognized in the further image data 301, the sensitive data 201 can be masked in image data 302. In the subsequently acquired image data 302 (cf. 5 ) it is then possible to mask the sensitive data 201. For this purpose, a mask is determined. The determination of the mask 502 is described in 6 illustrated. A geometric reference shape 501 is predefined. The geometric reference shape 501 can, for example, be permanently stored in the user device, e.g., assigned to the respective type of identification document 200. However, it would also be possible, alternatively or additionally, for the reference shape 501 to be received by the identification server 50, e.g., before the additional image data 301 is captured.

The reference form 501 can be specifically assigned to a certain type of identification document 200. This can be the case because the position of the sensitive data 201 on an identity card, for example, typically differs from the position of the sensitive data 201 on a driver's license. Therefore, it may be necessary to determine the type of identification document 200. This can be done, for example, via a corresponding preselection by the user via the user interface 66. Alternatively or additionally, the type of identification document 200 can also be determined from the further image data 301 and/or the image data 302, for example using image recognition techniques.

The reference form 501 is transformed (into 5 shown as a vertical arrow) to determine the mask 502. The transformation may include: compression, distortion, rotation, scaling, etc. The transformation takes into account the pose of the identification document 200 in the image data 302. The mask is then adapted to the specific pose with which the identification document 200 is contained in the image data 302 (cf. 5 ).

In general, various techniques are possible for determining the pose of the identification document 200 in the image data 302. For example, the pose of the identification document 200 could be determined from the additional image data 301 using corresponding techniques mentioned above. This pose in the additional image data 301 could then be used to determine the pose in the image data 302. This makes it possible to determine the pose in the image data 302 particularly quickly. Alternatively or additionally, it would also be possible to apply certain image recognition techniques to the image data 302 to determine the pose directly from the image data 302.

Such preceding techniques make it possible, in particular, for the further image data 301 and the image data 302 to be part of a film. The masking of the sensitive data 201 can be carried out in real time. It would also be possible for the image data 302 to be extracted from a running film as a higher-resolution photo or to be inserted. In particular, for example, the image data 302 could have a higher resolution than the other image data 301; then, server-side identification can be carried out particularly reliably based on the identification information 202 and the integrity features 203. Forgeries or deceptions can be reliably detected.

In 7 1 shows a flowchart of a method according to the invention. The method begins in step S1. First, in step S2, the additional image data 301 are captured, e.g., as a film. In step S2, the additional image data 301 could be output as a live image on a screen of the user interface 66. In step S3, it is checked whether the additional image data 301 depicts the identification document 200. Image recognition techniques, as are generally known to those skilled in the art, can be used for this purpose. As long as the identification document 200 is not depicted, steps S2 and S3 are repeated. Optionally, in step S3, a pose of the identification document 200 could also be determined in the additional image data 301. Steps S2 and S3 are optional.

Otherwise, the process continues with step S4—e.g., automatically or after user input. In step S4, the image data 302 is captured, e.g., with a comparatively higher resolution. Then, in step S5, the image data 302 is masked. For this purpose, the mask 502 is determined from the pose of the identification document 200 in the image data 302 and based on control data that indicates the type of the identification document 200. The mask 502 is then applied to the image data 302. The image data 302 masked in this way is sent to the identification server 50 (step S6). The method ends with step S7.

Out of 7 It can be seen that the masked image data 302 is sent first to the identification server 50. The unmasked additional image data 301 is not sent. The additional image data 301 is used to initially recognize the identification document 200. The data protection of sensitive data can thus be ensured, e.g., even if the additional image data 301 and the image data 302 are a film.

For example, steps S4-S6 could be repeated in real time for a certain predetermined period of time or until manually initiated termination. For example, in this context, a live video chat could be established between the user terminal 60 and the identification server 50. For example, the image data 302 can comprise a sequence of individual images as a film, which depict the identification document in different poses. The changing of the pixel values can then be done individually for all individual images. In other words, the mask for each of the individual images can be determined depending on the corresponding pose. In this way, a high degree of identification reliability can be ensured, while at the same time, by adapting the mask for the various individual images, the disclosure of the sensitive data 201 is avoided. Such an embodiment, in which the further image data 301 and the image data 302 comprise a sequence of individual images as a film, is also described in 8 There it can be seen that both the further image data 301 and the image data 302 each comprise several consecutive individual images, which thus form a film. For example, the pose of the identification document 200 could be determined individually for each individual image of the image data 302, for example from the previous individual image or directly from the corresponding individual image. 8 It is also apparent that the additional image data 301 has a lower resolution or fewer pixels than the image data 302. In 8 The individual images of the image data 302 and the further image data 301 have a fixed time interval between them. However, a variable time interval would also be possible.

Of course, the features of the previously described embodiments and aspects of the invention can be combined with one another. In particular, the features can be used not only in the described combinations, but also in other combinations or on their own, without departing from the scope of the invention.

Thus, techniques were primarily described above in which the masking of the image data occurs after the image data has been captured. However, it would also be possible for the masking of the image data to already take place during capture, e.g., by not reading out the corresponding pixel values of image points from the camera of the user terminal, i.e., by changing them compared to a measured value, or by only reading them out in a manipulated manner. This may require that the mask be determined before the image data is captured. In such cases, in particular, it may be desirable to determine the mask based on the pose of the identification document in the additional image data. In such a case, it may also be desirable for there to be only a comparatively short period of time, e.g., in the millisecond range, between the capture of the additional image data and the capture of the image data, so that there is no or no significant change in the pose between between the additional image data and the image data. Then the pose in the additional image data is in good agreement with the pose in the image data. Accordingly, if the image data comprises multiple individual images, it would of course be possible to use a previous individual image of the image data to determine the mask in the subsequent individual image of the image data.

Furthermore, the above primarily described techniques in which the pose of the identification document was determined at least partially from the additional image data. However, it is also possible for the pose to be determined directly from the image data itself.

List of reference symbols

50

Identification server

60

User terminal

65

camera

66

User interface

69

interface

200

Identification document

201

Sensitive data

202

Identification information

203

Integrity features

301

Further image data

302

Image data

501

Geometric reference shape

502

mask

S1-S7

Step

Claims (8)

A method for sending masked image data depicting an identification document (200) to a central server (50), the method comprising: - capturing image data (302) with a camera (65) of a user terminal (60), wherein the image data (302) depicts the identification document (200), - capturing further image data (301) with the camera (65) of the user terminal (60), wherein the further image data (301) depicts the identification document (200), wherein the further image data (301) has a lower resolution than the image data (302), wherein the resolution of the further image data (301) is so low that sensitive data of the identification document (200) cannot be recognized, - recognizing the identification document (200) in the further image data (301), - obtaining control data from image recognition of the further image data (301), - Changing pixel values in the image data (302) in the area of a mask (502) for masking the identification document (200), wherein the mask (502) is determined as a function of a pose of the identification document (200) in the image data (302) and as a function of the control data that defines a type of the identification document (200), - Sending at least parts of the image data (302) with the changed pixel values to the central server (50). Procedure according to Claim 1 , the method further comprising: - recognizing the pose of the identification document (200) in the further image data (301), - determining the pose of the identification document (200) in the image data (302) based on the recognized pose in the further image data (301). Method according to one of the preceding claims, wherein a resolution of the further image data (301) is equal to or less than 4 megapixels, preferably 2 megapixels, particularly preferably 1 megapixel. Method according to one of the preceding claims, wherein a geometric reference shape (501) of the mask (502) is predetermined and/or received from the central server (50), the method further comprising: - determining the mask (502) by transforming the geometric reference shape (501) according to the pose of the identification document (200) in the image data (302). Method according to one of the preceding claims, wherein the image data (302) are part of a film, wherein the changing of the pixel values occurs in real time. Method according to one of the preceding claims, wherein the image data (302) comprise a sequence of individual images which depict the identification document in different poses, wherein the changing of the pixel values occurs individually for the individual images. A user terminal (60) configured to send masked image data depicting an identification document (200) to a central server (50), the device comprising: - a camera (65) configured to capture image data (302), the image data (302) depicting the identification document (200), the camera (65) further configured to capture further image data (301), the further image data (301) depicting the identification document (200), wherein the further image data (301) have a lower resolution than the image data (302), wherein a resolution of the further image data (301) is so low that sensitive data of the identification document (200) cannot be recognized, - a processor (67) which is configured to recognize the identification document (200) in the further image data (301) and to obtain control data from an image recognition of the further image data (301), wherein the processor (67) is further configured to change pixel values in the image data (302) in the region of a mask (502) for masking the identification document (200), wherein the mask (502) is determined as a function of a pose of the identification document (200) in the image data (302) and as a function of the control data which define a type of the identification document (200), - an interface (69) which is configured to process at least parts to send the image data (302) with the changed pixel values to a central server (50). User terminal (60) to Claim 7 , wherein the user terminal (60) is arranged to carry out a method according to one of the Claims 2 - 6 to execute.

Images