EA040639B1 - PROTECTION OF THE DIGITAL FILE FROM FORGERY - Google Patents

Description

The field of technology to which the invention belongs

The present invention relates to the field of protecting digital data from forgery or falsification, as well as the possibility of tracking digital files.

State of the art

The problems of forgery and falsification of digital files are well known and serious, and their number is constantly growing. A well-known example is the falsification of data printed on an original digital document, such as a digital identity document or a digital version of a diploma, and the situation is even worse when considering a digital copy of the original (possibly genuine) digital document. Simply keeping track of identifiers such as serial numbers, or even including some digital watermarks, is generally not a good enough solution, as counterfeiters can easily copy such numbers or digital watermarks.

Ahto Buldas et al.: Efficient Record-Level Keyless Signatures for Audit Logs, International Association for Cryptologic Research, issue 20140718:122633, pp. 1-13, July 15, 2014, discloses a record log signature scheme that allows integrity verification of the entire entry log and a representation of any entry, and a concise proof that the entry has not been modified since the entry log was signed, where the entry log is an ordered sequence of blocks, where each block is in turn an ordered sequence of entries.

US 2012125997 A1 discloses an approach that actually uses public key infrastructure (PKI) digital signature technology and a barcode to provide a passport whose data authenticity and integrity can be verified in printed form. There is a barcoding tool that includes a data extraction component; data concatenation component; a digital signature generating component; and a barcode generating component. There is also a barcode reader tool which includes reading identification data and digital signature barcode characters using a barcode reader; displaying the identification data and the digital signature on the display device; verifying the electronic signature and displaying the verification results on the display device. Another disadvantage of most traditional methods of authenticating digital files or protecting their digital data is that they tend to view files in isolation, even if they are members of a well-defined group, such as a digital document package. This ignores valuable authentication information.

Thus, the purpose of the present invention is to protect a digital file from forgery and falsification of data associated with it and, in particular, data relating to its belonging to a certain package of digital files. It is also an object of the present invention to enable offline verification of the authenticity of a digital file protected according to the present invention and the conformity of the contents of its digital data with the contents of a genuine digital file.

Brief description of the invention

One aspect of the present invention relates to a method for protecting a given original digital file from a package of a plurality of original digital files from forgery or falsification, wherein each original digital file of the package contains its own digital data, the method being characterized in that it includes the steps:

for each original digital file of the package, calculating by means of a one-way function the signature of its digital data associated with the digital file;

calculating a control aggregated digital signature corresponding to the package of original digital files from all the signatures of the original digital files of the package by means of a one-way adder of said digital file signatures, and providing the control aggregated digital signature to the user;

determining the digital file verification key corresponding to the signature of the specified original digital file by means of a partial one-way adder of other digital file signatures used to calculate the control aggregated digital signature, as a result of which the potential signature of the digital file corresponds to the signature of the original digital file of the package, in the case of extracting the control aggregated a digital signature from a one-way function of said potential digital file signature and a corresponding digital file verification key; and including in the given original digital file a corresponding machine-readable digital security mark containing a representation of its digital data and its corresponding digital file verification key, thereby obtaining a marked original digital file whose digital data is protected from forgery or falsification.

The control aggregated digital signature associated with the package of original digital files can either be published in an environment open to the user, or stored in a searchable database of aggregated signatures open to the user, or stored in the blockchain, or stored in blockchain-protected database open to the user.

The marked original digital file may additionally include data on access to aggregated signatures containing information sufficient to gain access to the control aggregated digital signature corresponding to the package of original digital files, while this information is a link to the interface for collecting aggregated signatures, respectively, one of next:

an environment in which a control aggregated digital signature is published, wherein the environment is open to the user through said aggregated signature collection interface configured to receive from the user an aggregated signature request containing digital data or a digital signature of said digital data obtained from a digital security marking tagged original digital file, and sending back the control aggregated digital signature of the associated package;

a searchable aggregated signature database in which a control aggregated digital signature is stored, wherein the aggregated signature database is open to the user through a specified aggregated signature collection interface configured to receive an aggregated signature request from the user containing digital data or a digital signature said digital data obtained from the digital security marking of the marked original digital file, and sending back the control aggregated digital signature of the associated package;

blockchain, respectively, a database protected by a blockchain in which an aggregated digital signature with a timestamp is stored, while the blockchain, respectively, a database protected by the blockchain is open to the user through the specified interface for collecting aggregated signatures, configured to receive a request from the user to an aggregated signature containing digital data or a digital signature of said digital data obtained from the digital security marking of the marked original digital file, and sending back the control aggregated digital signature of the associated package.

According to the present invention, a virtual digital file may be considered to belong to a package of original digital files, said virtual digital file having corresponding virtual digital data and a signature associated with the virtual digital file obtained through a one-way function of its virtual digital data, said virtual digital file the file is not real, but is only used to generate a signature associated with the virtual digital file from the corresponding virtual digital data; and the control aggregated digital signature associated with said package of original files is calculated from all the signatures of the original digital files of the package, including the virtual digital file signature, by means of a one-way adder.

The one-way function may be a hash function, and the signature of the original digital file may be a sequence of a given set of bits with lower bit values; selected from the bits of the hash value of the corresponding digital data.

In the above method, additional digital data corresponding to the digital data associated with the tagged original digital file can be stored in a searchable information database open to the user through an information database interface configured to receive from the user an information request containing digital data or corresponding digital file signature data obtained from the digital security marking of the marked original digital file, and sending back the corresponding additional digital data.

Moreover, the digital data of the tagged original digital file may include CDD control characteristic digital data of the corresponding unique physical characteristic of the associated object or person.

Another aspect of the present invention relates to a method for verifying the authenticity of a digital file protected according to the above method, or the correspondence of a copy of such a protected digital file relative to the original file, the method comprising the steps of processing a test file representing said digital file or said copy of the digital file, by means of processing unit connected to memory:

saving a test file in memory; reading a digital data representation and a test file verification key on the digital security marking in the stored test file, and extracting corresponding digital data and a test file verification key from said read representation, respectively;

storing in memory the control aggregated digital signature of the corresponding package of digital files and programming in the processing unit of the one-way function and the one-way adder; verification of the actual correspondence of the extracted digital data and the verification key of the test file of the stored control aggregated digital signature by performing the following steps:

calculating a digital signature of the extracted digital data using a one-way function; calculating a potential aggregated digital signature from the calculated digital signature of the extracted digital data and the extracted test file verification key using a one-way adder; and checking that the obtained potential aggregated digital signature matches the stored control aggregated digital signature, whereby if said aggregated digital signatures match, the digital data of the test file is the data of the original original digital file.

A verification method in which a digital file is protected by storing a control aggregated digital signature associated with a package of original digital files in a searchable database of aggregated signatures open to the user, and in which the processing unit is further connected to a communication unit configured to send and receiving data back via a communication channel may include preliminary steps:

sending by the communication unit via the communication channel a request to the specified database of aggregated signatures and receiving back the control aggregated digital signature associated with the package of original digital files; and storing the received aggregated digital signature in memory.

In the specified verification method, in which the tagged original digital file additionally includes data on access to aggregated signatures containing information sufficient to gain access to the control aggregated digital signature corresponding to the package of original digital files, while this information is a link to the interface for collecting aggregated signatures, and in which the processing unit is further connected to the communication unit, configured to send and receive data back via the communication channel, may include the preliminary steps:

reading data on access to aggregated signatures included in the test file;

sending by the communication unit via a communication channel an aggregated signature request to the specified aggregated signature collection interface containing digital data or a digital signature of said digital data obtained from the digital security marking in the test file, and receiving back the corresponding control aggregated digital signature of the associated package; and storing the received aggregated digital signature in memory.

In the above verification method, the original digital file may be protected with additional digital data stored in a searchable information database open to the user through the information database interface as disclosed above, and the processing unit may be further connected to the communication means performed with the ability to send to the information database interface a request for information containing digital data or a corresponding signature of a digital file obtained from a digital security marking in the test file, and receive back the corresponding additional digital data.

Moreover, in the above verification method, if the digital data of the tagged original digital file includes the reference characteristic digital data CDD of the corresponding unique physical characteristic of the associated object or person, and the processing unit is connected to a sensor capable of detecting the unique physical characteristic of the associated object or person , the processing unit is programmed to extract the corresponding unique physical characteristic digital data from the detection signal received from the sensor, the processing unit may additionally store CDD reference characteristic digital data in memory corresponding to said unique physical characteristic of the associated object or person, and the method includes additional steps, when considering a subject representing, respectively, the specified related object or person: detecting a unique characteristic of the subject and extracting the corresponding leading potential characteristic digital data CDD ^c ; comparing the obtained potential characteristic digital data CDD ^c with the stored control characteristic digital data CDD; and if the candidate CDD characteristic digital data ^c is similar to the stored reference CDD characteristic digital data, subject to a predetermined tolerance criterion, the subject is considered genuine.

Another aspect of the present invention relates to a tagged digital file belonging to a package of a plurality of original digital files and protected from forgery or falsification according to the above protection method, wherein each original digital file of the package has its own digital data, said package has a corresponding control aggregated digital signature, the tagged digital file contains a machine-readable digital security marking, including a representation of its digital data and the corresponding digital file verification key. Moreover, the digital data of the marked digital

- 3 040639 files may additionally include CDD control characteristic digital data of the corresponding unique physical characteristic of the associated object or person.

According to another aspect, the present invention relates to a system for verifying the authenticity of a tagged original digital file protected according to the aforementioned protection method, or the correspondence of a copy of such a digital file relative to the original file, wherein the system comprises a processing unit with memory, the memory stores a control aggregated digital signature of the corresponding package of digital files and a one-way function and a one-way adder programmed in the processing unit, wherein the system is configured to receive a test file representing the specified digital file or a copy of the digital file, and store the resulting test file in memory; reading a digital data representation and a test file verification key on the digital security marking in the stored test file, and extracting corresponding digital data and a test file verification key from said read representation, respectively; verifying the actual correspondence of the extracted digital data and the verification key of the test file of the stored control aggregated digital signature by performing the steps programmed in the processing unit: calculating the digital signature of the extracted digital data using a one-way function; calculating a potential aggregated digital signature from the calculated digital signature of the extracted digital data and the extracted test file verification key using a one-way adder; and checking that the obtained potential aggregated digital signature matches the stored control aggregated digital signature, whereby, if said aggregated digital signatures match, the digital data of the test file is the data of a genuine original digital file, and the system is configured to deliver an indication that the digital data on the test file are the data of a genuine original digital file.

Such a system for verifying a digital file protected according to the aforementioned protection method, or the correspondence of a copy of such a digital file with respect to the original file, in case the digital data of the marked original digital file includes the control characteristic digital data CDD of the corresponding unique physical characteristic of the associated object or person, can be additionally equipped sensor connected to the processing unit and configured to detect a unique physical characteristic of the associated object or person, and while the processing unit is programmed to extract the corresponding characteristic digital data from the detection signal received from the sensor, the system stores in the memory the control characteristic digital data CDD corresponding to the specified unique physical characteristic of the associated object or person, the system is additionally configured to detect, using a sensor, a unique the physical characteristics of the subject representing the specified associated object or person, and extracting the corresponding potential characteristic digital data CDD ^c ; comparing the obtained potential characteristic digital data CDD ^c with the stored reference characteristic digital data CDD; and if the candidate CDD characteristic digital data ^c is similar to the stored reference CDD characteristic digital data, subject to a predetermined tolerance criterion, delivering an indication that the subject is considered genuine.

Hereinafter, the present invention will be described more fully with reference to the accompanying drawings, which illustrate the main aspects and features of the present invention.

Brief description of the drawings

In FIG. 1 is a schematic view of a general method for protecting a package of digital files according to the present invention;

in fig. 2A shows a secure digital biometric passport as an example of a digital biometric identity document secured in accordance with the present invention;

in fig. 2B is a control of a person having a secure digital biometric passport according to FIG. 2A, an authorized officer;

in fig. 3 is a package of aircraft components protected according to the present invention.

Detailed description

The present invention is herein described in detail with reference to the non-limiting embodiments illustrated in the drawings.

In FIG. 1 illustrates a general method according to the present invention relating to the protection of a package of digital files and to a method for calculating the encoding of verified information that can be associated with each digital file. In FIG. 1 illustrates a group or package of digital files A1, A ₂ , A ₃ , ... containing a digital representation of a machine-readable security mark 110 (in this case illustrated with a two-dimensional bar code). Hereinafter, the expression digital security mark 110 actually means a digital representation of a machine-readable security mark 110.

- 4 040639

A package of digital files may, for example, refer to a normal production cycle, goods delivered by a specific supplier, goods manufactured or shipped over a period of time, a set of related images, a group of people, a herd or flock, or any other user-defined grouping of any objects, for which a digital file Ai (having digital content Di) can be defined. In FIG. 1 also shows the virtual digital file A _v , which is an optional piece of software that can be included to provide encoding of the selected data. This is explained next. By way of example only, it is assumed that the virtual digital file A _v is included and will be treated below as the other (real) digital files A ₁ , A2, A ₃ , ..., since it can be processed in much the same way (although it does not correspond to a real file , for example stored in memory). Of course, the set of virtual digital files A _v1 , A _v 2, ..., A _vk can be used to encode digital data and create more secure digital signatures (see below).

For each digital file A ₁ , A2, A ₃ , ..., A _v the corresponding digital data D ₁ , D2, D ₃ , ..., D _v are linked or extracted (or in the case of a virtual digital file Av created) by in any suitable way. This data may be some measure of physical characteristics, textual data such as a completed form or product information, a serial number or other identifier, content indications, a digital representation of an image, or any other information that the system designer chooses to associate with the file. The digital data Di of the digital file A _i can be retrieved from a human-readable representation of the data (eg, alphanumeric data) by means of a reader capable of generating a corresponding digital data file. Additional digital data may be associated with the extracted data to create the Di digital data contained in the Ai file.

For a virtual digital file Av, the associated digital data Dv may include, for example, a packet identification number, a (pseudo) random number to increase security by increasing data entropy, date and/or time information, and so on. Another form of associated digital data can be indications of valid or invalid transaction rules, expiration dates, and so on. In short, the digital data D _v can be anything that can be represented in digital form.

For each digital file, its respective digital data D ₁ , D2, D ₃ , ..., D _v are preferably mathematically converted so that they are essentially hidden, although this is not an absolute requirement for any implementation. This transformation, applied to the digital data Di of the digital file Ai, serves to create the corresponding digital signature xi. This digital signature is obtained through a one-way function (i.e., a function that is easy to compute but hard to invert, see S. Goldwasser and M. Bellare Lecture Notes on Cryptography, MIT, July 2008, http://www-cse .ucsd.edu/users/mihir).

One such advantageous transformation is, for example, applying the hash function H( ) = hash( ) to digital data, which usually has the property of returning an output of known length in bits regardless of the size of the input: this technical effect is especially useful for creating a digital signature digital data associated with a digital file, regardless of the size of the associated digital data and the package size of the corresponding digital files. The hash function is a well-known example of a one-way function. If a cryptographic hash function is used, such as the SHA (Secure Hash Algorithm) function class, such as SHA-256, then there are additional advantages that the function is almost irreversible and collision resistant, i.e. the probability that two different sets of inputs will produce the same output is negligible. As will be clear from the description below, this is also not a requirement of the present invention, although it is advantageous for the same reasons as in other applications. As shown in FIG. 1, the values x1, x ₂ , x ₃ , ..., x _v are hash values, i.e. signatures associated with digital files, corresponding digital data of digital files, i.e. x, = H(Dj), for j=1, ..., v. For brevity, X (capital letter) is used here and in FIG. 1 to denote a set of hashed data values; thus X = (x ₁ , x ₂ , ..., x _v ) (if the virtual digital file A _v is included; otherwise, x _v can be omitted).

To shorten the signature, the signature x, of digital file A, may even be simply a sequence of a given set of lower bits, chosen from the bits of the hash value H(Dj): for example, using the SHA-256 hash function of the SHA-2 family, it is sufficient to keep only the lower 128 bits of the 256 bits of the signature to still have a strong signature against a cryptanalytic attack.

The aggregated digital signature or package value B is then computed over X by means of a (quasi-commutative) one-way adder (see Josh Benaloh and Michael de Mare OneWay Accumulators: A Decentralized Alternative to Digital Signatures, Advances in Cryptology - Eurocrypt' 93, LNCS, issue 765, pp. 274-285, Springer-Verlag, 1993). In general, for a set □ of signatures x ₁ , x ₂ , ..., .χ _μ (possibly including the signatures of one or more virtual digital files), the corresponding

- 5 040639 the total value f(x1, x ₂ , ..., χ _μ ), abbreviated as f(X) with X = (x1, x ₂ , ..., χ _μ ), given by the one-way adder f, is f(Xl.X ₂ .....Xμ) = f(f(f(...f(f(f(Xl),X ₂ ) - X ₃ ).....Xμ - ₂ )'Xμ -1)'Χμ)·

In general, one can write f(x1, x ₂ ) = x1®x ₂ where ® is the associated operator, preferably chosen such that f(X) is difficult enough to invert so that the computational burden is too high for practical implementation. This concept of computational impracticality used in the embodiments is further disclosed below. According to the present invention, a one-way adder is chosen to calculate aggregated signatures due to the size constraint B. In fact, such an adder has the technical effect of producing a digital value whose size (i.e. number of bits) is independent of the size of its arguments.

As an elementary example, the value of a packet can be a function f(X), such as commutative addition modulo a given modulo m, i.e. f(x) = x mod m and f(x, y) = x®y, with the associated commuting operator ® defined by x®y = (x+y) mod m. Thus, in this case, they have

This one-way adder has the following commutative property (although only quasi-commutativity is needed for the present invention):

And now X ⁱ consider the set of all elements of X, except for xP For example, where i = 1, X ¹ = (x2, x ₃ , ..., x _μ ). Assuming for simplicity that f(X) is commutative with respect to the elements of X, and given the f(X) property above, this leads to:

c = f(X) = х-^ЦХ ¹ ) = ЦХ ¹ )® x _x = (х ₂ ®х ₃ ® ...®χ _μ )®χ ₁ = k ₁ ®x ₁ with verification key k1 = ( x ₂ ®x ₃ ® ... ®χ _μ ) = f(X1).

According to the present invention, the aggregated digital signature B of a package of digital files becomes immutable and therefore tamper-proof by virtue of its publication in a (public) environment open to the user, who must verify the authenticity of the digital file (or data associated with it), or its storage in a searchable database of aggregated signatures open to the user, or preferably stored on a blockchain open to the user. The user can then store the B value obtained from these available sources.

For each digital file Ai, the corresponding digital file verification key ki is then computed by a partial one-way adder of the other digital file signatures x _j (where j^i), i.e. one-way digital file signature adder x1, ..., xi-1, x _i+1 , ...., χ _μ or f(Xi). For example, in module 120 of FIG. 1, the verification key ki of the digital file Ai is calculated as ki = f(Xi), and for the operation of checking whether the digital data Di and the verification key ki of the digital file A _i actually correspond to the digital data of the genuine digital file belonging to the package with the package value B, only verification is necessary that ki® f(H(Di)) = B, i.e. ki® xi = B. The resulting compact (due to the adder property) verification key ki, as part of the verification information Vi = (Di, ki) needed to calculate B, is included in the digital security marking 110 in the digital file Ai along with the digital data Di AI. This is an important aspect of the present invention, since the space available for data on a digital security mark is usually limited, in particular to perform offline authentication of a protected digital file and offline verification of the conformity of data associated with it against the data of a genuine original digital file. The type of one-way adder for f is well chosen to meet the technical challenge of reducing the size of the verification key data to be included in the digital security marking. In fact, the property of quasi-commutativity (or, even more so, commutativity) of such adders makes it possible to sign the data of a given digital file belonging to a package of digital files, without the need to further include data related to the ordering of the digital files in the package or the position of the specified given digital file according to the order in the package. Moreover, without the mentioned property of quasi-commutativity, much more computers would be needed for verification operations.

Calculation module 120 is preferably included in security system 100 for executing code provided for performing calculations for f(X), for key values k _i for different digital files, and for a common (aggregated) value B. Security system 100 may also include suitable modules to enter (programmed) values corresponding to the digital data D _{v of} the virtual digital file A _v . The hashing of the digital data Di of the digital file Ai to obtain the corresponding signature of the digital file xi can also be performed, for example, in the calculation module 120. It would also be possible to perform hash calculations associated with digital files externally (e.g., on a connected remote server), for example, wherever the digital files are generated, to avoid having to transfer the raw digital data Di over the network from this site (or sites) to protection system 100 if there is a problem.

- 6 040639

For each digital file Ai, the corresponding verification information Vi is compiled and encoded into some form of machine-readable security marking 110, which is then associated with the corresponding digital file.

For any virtual digital file A _v its corresponding verification information V _v can be associated with it within the security system 100 . The verification information typically at least includes, for any file Ai of the digital file package, the corresponding digital data Di and the corresponding digital file verification key ki: Vi = (Di, ki). According to the present invention, data encoding Di and data encoding ki may be different (providing an additional level of security against cryptanalytic attacks).

The additional digital data may further be associated with the digital file and may include, for example, the B package value or any other information that the system designer chooses to include, such as file serial number, package ID, date/time information, content name, A URL that points to other online information associated either with a single file (for example, a digital image of the respective product, etc.), or with a package, or with a phone number that can be called for verification, etc. d. Additional digital data may be stored in a searchable information database exposed to the user (via the information database interface).

After calculating the verification ki of the original digital file Ai and including (i.e. by encoding or any chosen data representation) along with the corresponding digital data D _i in a machine-readable digital security mark 110 added to the original digital file, the resulting marked original digital file and the digital data associated with it is indeed protected from forgery and falsification. An advantage of the present invention is that no encode/decode key is included in the digital security marking.

There are many well-known methods for encoding information so that it can be displayed as a digital image of a machine-readable design. Any such method can be used in implementations of any embodiment of the present invention. One common form of digital marking is the well-known QR code. As is well known, for a given display area, the more data a QR code can encode, the higher the modulus density (roughly speaking, the density of black/white squares) and the higher the resolution required for printing and reading. In addition to density (in the number of modules squared), QR codes are also commonly classified according to what level of error correction they include. There are currently four different standard levels, L, M, Q and H, each representing a degree of damage, i.e. data loss, the QR code image can withstand and from which can recover. Levels L, M, Q and H can withstand approximately 7%, 15%, 25% and 30% damage respectively. The following table shows at least approximate values for different versions of the QR code:

Version Size (in modules) Number of encoded bits level L ESS level H ESS 10 57x57 2192 976 25 117x117 10208 4304 40 177x177 23648 10208

However, not all bits can be used to encode the data download, as some modules are used for scan objects, mask pattern, and error correction modules. Thus, there is a trade-off between the amount of information that the QR code (or any other marking 110) can encode and how much information is included in the verification information V and needs to be encoded.

Therefore, for the selected type of digital security marking 110 (e.g. QR code) with limited encoding capability, an appropriate encoding function f(X) must also be selected: a function whose output is too large in terms of required bits cannot be used at all, and a function whose range is too small may not be reliable enough. Moreover, in many applications, scalability can be an issue. For example, some data protection schemes include signatures that grow as the number of packet elements increase, and which may unacceptably limit the packet size in terms of how many bits the digital security marking 110 can encode. adder.

- 7 040639

In one exemplary embodiment, the one-way adder function f(X) is chosen to be a simple (commutative) modulo multiplication, i. f(x) = x mod m, and f(x, y) = x0y = x * y mod m.

Thus, in this case, we get f(x, y) = f(x) * f(y) and μ / μ \ f(X) = P Xi mod m = i Xj j mod m i=i \i=i /

those. f(X) = x ₁ ®x ₂ ® ...®x^ where m is the module and X corresponds to the μ signatures □ of the digital files in the package X = (x ₁ , ..., x _μ ). Modulo multiplication is a very simple example of a one-way adder (not only quasi-commutative, but also commutative), although not reliable. Thus, in words, the value of the packet B = f(X) is calculated by multiplying all the hash values of the digital files x _i together, and then taking the remainder of this product after dividing by the modulus m. In some cases, this can lead to an impractically large product. For example, suppose there are 1000 digital files in a batch and each hash value xi is 256 bits long (as obtained using the SHA-256 hash function). It would be possible to do 999 multiplications and store the result, and then divide by m to get the remainder, but this is inconvenient and would require unnecessary computational effort in the form of storing values without truncation.

Instead, the system can use the property of modulo operations that the result can be evaluated multiple times, in pairs, as shown in the following pseudocode:

B = 1

For j = 1 to μ

B := [B * x(j)] mod m

Next j

Thus, the value of B can be calculated without having to multiply more than two hash values before determining the product modulo m.

Of course, any other method can be used to compute f(X) using the modulo m method shown above. A similar algorithm can be used to calculate the verification keys ki - to calculate the key ki, you just need to skip the stage where j=i.

There are several advantages to using the modulo m method to determine the value of package B and verification keys. One advantage is that the bit length will not be greater than m, which can be chosen by the user. Moreover, the calculations do not require floating point operations, and therefore there will be no errors due to truncation - note that changing one bit in the signature of a digital file will result in a completely different packet value.

The choice of the integer modulus m also reflects a compromise between security and size, both in the number of bits that the digital security marking 110 can encode and in the number of files in the packet. To illustrate, consider a very simplified package example that includes only three digital files having digital file signature hash values x ₁ , x ₂ , x ₃ . Now suppose m > max(x1, x ₂ , x ₃ ), then: x ₁ mod m = x ₁ x ₂ mod m = x ₂ , and x ₃ mod m = x ₃ .

In other words, with this choice of m, there is no protection for individual values of H. On the other hand, except when m is chosen as m >> max(x ₁ , x ₂ , x ₃ ), it is unlikely that the product of any two hashes -values modulo m will remain the same value, and it is even less likely that there will be a product of all three. The more files and therefore hash values in the batch, the more the total product will wrap modulo m (have a non-zero divisor) and the more difficult it will be to use a brute force attack to find a fake multiplicand (the hash value of a digital file) that, multiplied to a known key value, will give the same package value modulo m. As a very simple example, let's say that x ₁ , x ₂ , x ₃ and m are 3, 6, 8 and 10.

mod 10 = 3, mod 10 = 6 and mod 10 = 8, but

B = 3x6x8 mod 10 = 144 mod 10 = 4.

If the verification key for the first digital file is set to 6x8 mod 10 = 8 and the packet value B = 4, to guess the hash value 3 of the digital data would still need to guess a set of ten possibilities. The complexity will of course grow as the length in bits xi and m increases. Especially for batches of more than ten digital files or more than 100 digital files, where m is set to m > max _i (x _i ), for example, up to the maximum value that can be represented for a given bit length (such as 256 to implement , which uses the SHA-256 hash function), it would be inefficient for an attacker to attempt to computationally forge a hash value for each signature of a package of digital files, especially in implementations where the importance or even financial value of each digital file in the package is too low to justify the attempt. such an attack. In other words, using this embodiment, there is no point in trying to forge the information encoded in the marking.

The advantage of choosing m > max(x ₁ , x ₂ , ..., x _μ ) is that for all hash values (ximod m =

- 8 040639 xj there is an equivalence property, but it is not required. Rather, any value may be chosen, particularly to provide the desired bit length for B. It is also not necessary that m be constant across all implementations of the present invention, or even across all packets. As one example, an administrator, service provider, etc. can choose different module m for different packages. They may be stored in a database, either in the security system 100 or elsewhere, or delivered through some other channel to a user, such as a recipient of the digital files, so that only that recipient can easily verify the digital files based on their digital security markings 110.

To avoid having to maintain module values in the database, one could also calculate m itself for each packet, for example, as a function of hash values x _P As just one example, m can be chosen as m = [max(x1, x ₂ , ..., x _μ )]+1. Module 120 may then determine the modulus of m before performing other calculations such as f(X), _kj , and B. Module 120 may also enter a user-selected encoding size (eg, QR code version) and determine the usable modulus (and, hence the size in bits) to ensure that the encoded data (D _H kJ in the digital security marking will match, i.e. the data needed to extract x _j = H(D _J ) and calculate the packet value B from fCxjQX ¹ ) = XjQfCX ¹ ) = fCXjQXj = kjQXj.

The user, the recipient of a digital file such as A1, for example, can then scan (or otherwise read) with a reader the digital security marking on A1 and extract the digital data D1 and the verification key k1 (and any other information that may have been encoded in the digital security label). An example of a reader is a computer with a display. To verify the marked file A1, the user must first extract the verification information V ₁ =(D ₁ , k1) from the digital security marking on A1 and thus calculate the signature of the digital file x1 from the extracted digital data D1: in order to perform such an operation, the user must know the one-way function that is used to calculate the signature of a digital file, in this case it is the hash function H( ), and then perform the operation x1 = H(D1) to obtain the full data (x1, k1) needed to calculate the corresponding potential aggregated digital signature B ^c . The user may, for example, securely accept a one-way function (eg, using a public/private key pair) or by requesting it from a digital file provider or any other entity that has generated signatures and keys or has already programmed them into the user's reader processing unit.

Then, in order to calculate such a potential aggregated digital signature B ^c , the user needs to additionally know the type of one-way adder f( ) that will be used for this, in this case the user needs to know the modulus m of modulo multiplication (or similar information when using some other function f ). Assuming that the standard module is not used, for example, for all digital files from the provider, the user can then accept the module in any known way, either securely (for example, using a public/private key pair), or simply by requesting it from the digital file provider or any other the entity that created the verification data or has already programmed it in the user processing unit.

Using the module m, the user can then calculate a potential aggregated digital signature B ^c = k1®x1, which should then be equal to the available (or published) value B: this value may have been previously obtained by the user and/or already stored in the memory of the reader processing unit, it can also be a value that the recipient requests and receives from the system administrator in any known manner. By matching the potential B ^c and the available aggregated digital signatures B, this calculation then verifies the information in the security digital marking 110 and confirms that the digital file A1 belongs to the correct package.

A link to access the package value B for the package corresponding to the digital file A1 may be included in the digital security marking 110 (eg, a web address if B can be retrieved from the corresponding website), although this is not a preferred option.

In some implementations, recipients of the digital file A _j may be able to visually extract the data corresponding to the digital data D _j directly from the digital file. For example, the data may be textual, such as a serial number, or be text in a descriptive letter, or some alphanumeric encoding and human readable from the digital files themselves. Recipients of digital files may also be provided with suitable software, such as a module in a reader such as a smartphone, computer, or tablet, that either enters data or reads the data and then calculates xj = H(Dj) for the current digital file. For example, by using the digital security mark 110 on the digital file A ₁ , which is a standard QR code, the user can easily obtain by decoding the QR code with a computer using a standard QR code decoding application running on a computer, the digital data D1 and k1 digital file verification key, application

- 9 040639 for verification on the user's computer can then calculate x1 = H(D ₁ ) and B ^c = f(X) = f(x1® X ¹ ) = x ₁ ®f(X ¹ ) = f(X ¹ )® x ₁ = ki®xi, and also compare this value with the available value of package B, as described above. For example, if the operator ® corresponds to modulo multiplication, then k1®x1 = (k1 * x1) mod

m.

Preferably, the aggregated digital signature (i.e., the packet value) B is stored in a searchable database of aggregated signatures, which can be accessed (via a communication channel) by the user with his computer equipped with a communication device, as is the case with the above above is an example of a smartphone. The user who needs to verify the digital file A1 can simply send a request from his smartphone to the database address through the database signature collection interface, a request containing the digital data D1 read on the digital security mark 110 to A1 (or the computed signature of the digital file x1 = H(D1)), which allows extracting the corresponding value of the packet B, and the data collection interface will return the aggregated digital signature B to the smartphone (or computer). The database can be secured with a blockchain to enhance the immutability of stored aggregated digital signatures. The advantage of the present invention is to establish a relationship between a physical object, i.e. the original digital file (for example, stored in memory), and its attributes, i.e. associated digital data and its belonging to a package of digital files, almost invariably through the corresponding aggregated digital signature.

The above method of verifying the Ai digital file can also serve to authenticate the human-readable content of the Ai data on the corresponding printed version of the Ai digital file. Indeed, the user can read on the computer display the corresponding digital data D _i as decoded from the digital security marking in the digital file A _i by means of an imaging device and visually check whether the displayed information matches the printed data on the printed version of the digital file.

In a preferred embodiment, the digital data Di further includes characteristic digital data CDD of the corresponding unique physical characteristic of the object or person associated with the tagged original digital file Ai, which can be used to (tangibly) authenticate the associated object or associated person by comparing the characteristic digital data extracted from a digital security marking, and corresponding unique physical characteristic detection data obtained from a suitable sensor. Thus, with the characteristic digital data corresponding to the unique physical characteristic in the digital file A _i representing the CDD _i , the corresponding unique physical signature data UPSi can be obtained by encoding the CDDi (preferably by a one-way function): for example, taking the hash value of the characteristic digital CDDi data, i.e. UPSi = H(CDDi). However, any other known encoding can be used instead, for example, to have a short signature, the elliptic curve digital signature algorithm can be used. As a very simplified illustrative example of CDDi characteristic digital data corresponding to a unique physical characteristic of the OBJi object associated with the digital file Ai, consider a simple digital image obtained by displaying the OBJi object (or a specific area on the OBJi), for example, using a smartphone camera, while the corresponding the unique physical signature data UPSi is, for example, the hash value of the digital image, UPS _i = H(CDD _i ). The characteristic digital data CDDi that generated the UPSi signature is the signature characteristic digital data for Ai, and the resulting UPSi signature is the corresponding unique physical signature check data for Ai. Preferably UPSi, i.e. the control data of the unique physical signature for the digital file A _i , is stored in a searchable database or on a blockchain (or blockchain-secured database) open to users (for example, through a request containing digital data Di readable on a digital security mark in the digital file Ai, or their respective digital file signature xi). Thus, the stored UPSi becomes immutable. A copy of the CDDi can be additionally stored in the memory of the user's smartphone (or reader, or computer). In an embodiment, a copy of the UPSi may also be optionally stored in the memory of the user's smartphone (or reader, or computer) to enable an offline verification operation.

Authenticity verification of the digital file A _i can be done by extracting the potential characteristic digital data CDD _i ^c from the digital data Di read (in this case by a decoding application running on a smartphone) on the digital security marking included in the digital file Ai and comparing them with the control characteristic digital data CDDi stored in the memory of the smartphone: if CDDi ^c = CDDi matches, the digital file Ai is considered authentic (its digital content corresponds to the content of the genuine marked original digital file). If the control characteristic digital data CDDi is not stored in the memory of the smartphone, but rather the control data of the unique physical signature is stored in the memory of the smartphone (with the advantage that it takes up much less memory compared to CDD), then the authenticity of Ai is all it is still possible to check by verifying that the potential unique physical signature data UPSi ^c , obtained by calculating the hash value of the potential characteristic digital data CDDi ^c , extracted from the digital data Di, i.e. UPSic = H(CDDi ^c ) matches the unique physical signature control data UPS _i stored in memory.

The user can further verify the authenticity of the received digital Ai file, still through an offline process (self-checking), by detecting said unique physical characteristic on an object or person associated with the digital Ai file, by means of a sensor capable of making such a measurement (in this case a camera smartphone) and deriving potential CDDi ^c characteristic digital data from the detected characteristic (in this case, a digital image taken by a smartphone). Thus, the user can compare (through the image processing unit of his smartphone, or visually on the display of his smartphone) received CDDic with a copy of the control CDDi (stored in the memory of the smartphone): some predetermined rejection or similarity criterion), the digital file Ai is considered to be authentic (i.e. its digital content matches the content of the authentic tagged original digital file).

Moreover, the user can also additionally calculate the corresponding potential unique physical signature data from the copy of the control CDDi stored in the smartphone memory as UPSic = H(CDDi) and compare it with the UPSi physical signature control data stored in the smartphone memory: in case of a match UPSi ^c = UPSi, the digital file Ai is confirmed to be authentic with a higher degree of certainty (because one bit of difference is enough to cause a mismatch). Moreover, in the case of a match, the authenticity of the digital data Di associated with Ai, which was verified as corresponding to the data of the original digital file as disclosed above, is also established by extracting the corresponding packet B value from the read verification information (Di, ki) stored in digital security markings in AI.

In an embodiment, verification of the authenticity of the digital file A _i by the user may be performed through an online process. In this case, the control data, i.e. characteristic digital data CDDi and/or control data of the unique physical signature UPS _i , are stored in a searchable database, open to the user, where the control data related to the digital file A _i are stored in connection with the corresponding digital data D _i , respectively. (included in the digital security marking in A _i ) or with the corresponding signature of the digital file xi (which can be calculated by the user once the data Di is extracted from the digital security marking via the operation xi = H(Di)): control data can be requested by sending to the database request data containing, respectively, Di or xi.

The usual way to protect an object is to apply a security marking based on the material (possibly tamper-proof), i.e. a mark that has a detectable intrinsic physical or chemical property that is very difficult (if not impossible) to reproduce. If a suitable sensor detects this intrinsic property of the mark, the mark is considered genuine with a high degree of certainty, and hence the corresponding marked object. There are many examples of such well-known authenticating intrinsic properties: the marking may include some particles, perhaps randomly distributed, or have a certain layered structure, having intrinsic properties of optical reflection, or transmission, or absorption, or even emission (for example, luminescence, or polarization, or diffraction, or obstruction, etc.), possibly detectable under certain illumination conditions with light of a certain spectral composition. This intrinsic property may be the result of the particular chemical composition of the marking material: for example, luminescent pigments (perhaps not commercially available) may be dispersed in an ink used to print some pattern on an object and used to emit a particular light (for example, in a spectral window in infrared range) when illuminated with a certain light (for example, light in the UV spectral range). This is used, for example, to protect banknotes. Other intrinsic properties can also be used: for example, the luminescent particles in the marking may have a certain decay time of the luminescent emission after illumination with a suitable excitation light pulse. Other types of intrinsic properties are the magnetic property of the particles included, or even the property of the fingerprint of the object itself, such as, for example, the relative position of initially randomly distributed fibers of the paper substrate of a document in a given area on the document, which, when viewed at sufficient resolution, can serve to extract a unique characteristic feature. a signature or some random printed data artifact printed on an object that, when viewed at sufficient magnification, could also result in a unique signature, etc. The main problem associated with the intrinsic property of an object's fingerprint is its resistance to aging or wear. However, for

- 11 040639 material-based security marking does not always also protect the data associated with the marked object: for example, even if the document is marked with a material-based security marking, such as a logo printed with security ink in some area of the document, the data printed on the remainder of the document documents can be falsified. Moreover, overly complex authentication signatures often require significant storage involving external databases and communication channels for queries against such databases, so that offline authentication of an entity is not possible. According to the present invention, an object marked with a material-based security marking and associated with a (digitally) marked digital file is protected by an interlacing resulting from the fact that the characteristic digital data corresponding to the unique physical characteristic of the marked object, or its corresponding unique physical signature data , are immutable (due to the publication or storage of the aggregated digital signature on the blockchain) and are protected from forgery, are associated with digital data in a digital security marking, which is part of the associated digital file. Thus, the present invention can be used to protect both a package of objects and a corresponding package of associated digital files.

Of course, any other known intrinsic physical/chemical property can be used to obtain CDDi characteristic digital data relating to the object unique physical characteristic OBJi associated with the digital file Ai and corresponding to the unique physical signature data UPSi. As another illustrative example, a two-dimensional barcode forming a material-based security mark can be printed on an object with a security ink containing a luminescent pigment having a characteristic decay time constant, as well as a light excitation wavelength window and a luminescent emission wavelength window: as a result, the ink has a certain reference value of decay time τ, which serves as a fingerprint of the ink material. It suffices to illuminate the barcode with excitation light in an illumination wavelength window encompassing the pigment excitation wavelength window, and to collect the resulting luminescent light from the barcode with a sensor capable of detecting light intensity within the luminescence emission wavelength window to authenticate the barcode, and hence the object. For example, a user reader may be equipped with a flash configured to apply excitation light to a barcode, a photodiode configured to collect an appropriate fluorescent light intensity profile I(t) (during a detection time interval) from the barcode, and a reader CPU , programmed to calculate the decay time value based on the received intensity profile I(t). For example, the excitation wavelength window may be in the UV (ultraviolet) range and the emission wavelength window in the IR (infrared) range. If, during object verification, the intensity of the fluorescent light collected by the user's imaging device shows a characteristic decay over time corresponding to a potential decay time t _s , then the ink and therefore the object are considered genuine if t _c " τ (within the specified deviation range ). In this case, the characteristic digital data CDDi of the tagged object OBJi includes at least a reference decay time t (and possibly data related to the excitation wavelength window and the emission wavelength window). As can be seen from the above examples, the technical result of including the control (unique) characteristic digital data in the digital security marking verification information of the associated digital file A _i is to provide a tamper-proof connection between the digital data of the digital file and the authentication data of the associated object.

Instead of the modulo m product in the above illustrative example, any other known (commutative or quasi-commutative) one-way adder (with its corresponding ® operator) can be used. For example, a quasi-commutative one-way adder defined by f(x) = f(I; x) = I ^x mod m (i.e. exponentiation modulo m) or the equivalent symbolic representation of the operator Yux, where I is a given number (an integer ), and m is the given modulus. Thus f(x, y) = f(I; x, y) = f(f(I; x), y) = f(I; x)®y = (I ^x mod m) ^y mod m = I ^x * ^y mod m = Yux * y. An aggregated digital signature B for a package μ of digital files A1, A2, ..., A _μ (which may include virtual files) whose respective digital data is D1, D2, ..., D _μ , with the corresponding associated digital files signatures x1, x ₂ , ..., x _μ , calculate for X = (x1, x ₂ , ..., x _μ ) as B = f(I; X), i.e.

В = Γ(Γ(ί(..Τ(ί(Γ(Ι,χ ₁ ),χ ₂ ),χ ₃ ),...,χ _μ _ ₂ ),χ _μ _ ₁ ),χ _μ ), which can be reduced, on the basis of the quasicommutativity of f, to

B = f(X) Ξ f(I; X) = (1P4) modm = I® P _{x b μX} , i.e. P xi \u003d x1 * x ₂ * ... * x _μ . Indeed, the quasi-commutativity of this one-way adder allows us to write (for all I and all x, y): f(f(I;x),y) = f(f(I;y),x), where the aforementioned 040639 This has the advantage that the verification step does not require additional information about the ordering of the signatures xi.

The signatures of the digital files xi are calculated, as disclosed above, by means of any known one-way function. Preferably, the signature of the digital file xi is obtained by means of a hash function of the corresponding digital data D _i :xi = H(Di) (for the above reasons).

The digital file verification key kj corresponding to the signature of the digital file xj of the digital data Dj of the digital file Aj of the digital file package □ is calculated as follows:

kj = I ⁽ⁿ x ^i/xj) mod m, where (P xi/xj) = x ₁ * x ₂ * ... * xj-i * xj+1 ... * x _μ , or where symbolic designation kj \u003d Yux ₁ * x ₂ * ... * x _j-1 * x _j+1 ... * x _μ .

If the notation X ^j = (x1 * x2 * ... * x^ * xj+1 ... * xD get a more compact formula kj = f(X ^j ), where (P xi / xj) = x1 * x ₂ * ... * xj _-1 * xj ₊₁ ... * x _μ is the product of the components of X ^j .

Therefore, for the operation of checking the actual correspondence of the digital data Dj and the digital file verification key kj from the digital security mark of the digital file Aj to the data of the genuine digital file belonging to the package having the package value B, it is only necessary to calculate the signature of the digital file xj in the form xj = H( Dj) and then verifying that xj and kj extract the aggregated digital signature B by means of kj ^H( - ^Dj) mod m = kj ^Xj mod m = B (or kj ® Xj = B) .

Preferably, the (integer) modulus m is chosen to be at least 2048 bits in size to provide good resistance against cryptanalytic attacks.

The above exponentiation operator (and all its well-known variants, such as the Naccache operator f(x) = I ^x C ^x-1 mod m, for example, for any given numbers I and C) is just another example of a one-way adder given here for illustrative non-limiting purposes.

Another exemplary embodiment of the present invention relates to a package of digital biometric identification documents, such as digital biometric passports, as shown in FIG. 2. Each digital passport, as a digital file, is associated with the corresponding person, i.e. with the passport holder. For clarity, the digital data A ₁ is shown in FIG. 2 as equivalent textual and alphanumeric information (i.e. human-readable), for example, as it can be displayed from a digital pdf (Portable Document Format) file, and a digital security mark is shown as an equivalent conventional 2D QR code pattern .

This example still uses the hash function as a one-way function for signing digital passport data, preferably the SHA-256 hash function due to its well-known reliability. Indeed, given a given packet size, the hash function that is chosen (having a known list of segments) to sign the digital passport data is thus an example of a one-way encryption function such that each individual digital passport has a separate digital signature of the passport, which makes unique signature. The domain of a hash function (i.e. the set of possible keys) is larger than its range (i.e. the number of different table indexes), it will map multiple different keys to the same index, which can lead to conflicts: such conflicts can be avoided when the packet size is known by looking at the bucket list associated with the hash table of the hash function and keeping only the function giving zero collisions, or by independently choosing a hash table conflict resolution scheme (e.g. coalesced hashing, cuckoo hashing or hopscotch hashing).

In FIG. 2A shows an example of a digital biometric passport A ₁ protected by a machine-readable digital security marking 210 (in this case a QR code) encoded in A ₁ and containing passport digital data 230 containing conventional passport data, such as digital data representing the title of the document 230a. (Passport), Passport Holder Biodata Set 230b: Last Name (Dow), First Name (John), Gender (M), Date of Birth (March 20, 1975), Citizenship (US), Place of Residence (Des Moines), Location of birth (Auckland), issue date 230c (February 24, 2018) and expiration date 230d (February 23, 2020). This digital passport data may additionally contain some(s) (unique(s)) serial number(s) 235 assigned by the authority issuing the passport (in this case 12345). The digital passport data further comprises biometric data of the passport holder in the form of characteristic digital data (CDD) corresponding to a unique physical characteristic of the person associated with the digital passport. A machine-readable representation 230e (eg, alphanumeric) of data indicative of said unique physical characteristic (not shown) corresponding to said biometric data is associated with the digital data 230 of the passport. The representation of digital data should be understood in the broadest sense of the term: for this representation of data, it is only necessary to ensure that the original digital data is retrieved. The machine readable representation 230e of the data, i. e. biometric data, a unique physical characteristic, may correspond, for example, to a fingerprint or iris identification of a digital passport holder. For example, biometric data 230e corresponding to a human fingerprint may be the result of analysis of a set of specific small features of the fingerprint projections, such as ridge termination, bifurcation, and short ridges (according to the traditional Henry classification system).

Thus, for a given digital passport Aj of the delivered digital biometric passport packet μ, in this case where μ = 1024, the associated digital data Dj includes the aforementioned digital data 230a-230e. Preferably, the additional passport digital data is associated with the aforementioned passport digital data 230 . For example, a digital image of the fingerprint of a passport holder or a digital photo of an identity, etc. In an embodiment, these additional digital passport data are stored in a searchable infobase 250, which can be searched with an information query containing some of the passport data (e.g., the holder's name, or biometric data, or data from a security marking, or unique serial number 235) to extract the corresponding fingerprint pattern data and receive it back. Preferably, a link to the information database 250 is included as the information access data 240 in the digital passport: in this case, this information access data is encoded in a digital representation of a QR code containing a reference index to extract the corresponding additional data in the information database 250 data. However, in a variant of a passport control operation involving access to a remote information database (online operation), the QR code may contain, for example, the URL of an information database accessible via the Internet.

The digital signature of the passport with the one-way hash function of the digital passport data Dj corresponding to the digital data 230a-230e of the digital passport Aj is then computed by, for example, the above SHA-256 secure hash function to obtain the corresponding (unique) passport digital signature Xj = H (DJ). In the same way, the digital signatures of all digital passports in the package for all different holders are calculated.

Based on all the digital signatures of the digital passports in the packet, the aggregated digital signature B is calculated using a one-way adder. For example, in this embodiment, the aggregated signature for the packet is obtained by the aforementioned one-way exponentiation adder modulo m defined by f(x) = I ^x mod m, where I is a given integer and m is a modulo. Thus, the aggregated digital signature B for the package μ of digital biometric passports A1, A ₂ , ..., Ά _μ (which may include virtual digital passports), whose corresponding digital passport data is D1, D2, ..., D _μ , and with corresponding passport-related digital signatures x1 = H(D1), x ₂ = H(D2), ..., x _μ = H(D _μ ), calculate for X = (x1, x2, ..., Xμ), as

where P Xi denotes the product from i=1 to ΐ=μ of the digital signatures of the passport x _b x ₂ , x _μ , i.e. P Xi = x1 * x ₂ * ...* x _μ , and the modulus size m is chosen to be, for example, 2048 bits. As disclosed above, with the notation X ^j = (x1, x ₂ , ...* xj-1, x _j+1 , ..., x _μ ), the verification key kj for the digital passport Aj is calculated as a partial one-way adder kj = f(X ^j ) and verification information (Dj, Kj) are included in the digital security marking 210 of the passport Aj. For the operation of checking the actual correspondence of the digital data of the passport Dj and the verification key kj of the digital biometric passport Aj with the digital data of the original digital biometric passport belonging to the package of digital biometric passports having the package value B, it is only necessary to calculate the digital signature of the passport xj = H(Dj) and verify that xj and verification key kj extract the available corresponding value of package B by: kj ^xj mod m = B (or kj®xj = B). Thus, a digital biometric passport secured according to the present invention provides both a tamper-resistant link between personal data and its holder's biometric data, and a unique and tamper-resistant link between the holder's individual and the holder's identity.

In FIG. 2B illustrates the control process of the secure digital biometric passport A ₁ according to FIG. 2A, in which the passport digital data 230 corresponds to a specific John Doe, the passport biometric data 230e corresponds to John Doe's fingerprint, and the additional passport digital data corresponds to a digital photograph of John Doe's identity 255 that is accessible by reference to the information database 250 included in the data 240. on access to information. The passport data additionally contains a unique serial number 235 assigned by the passport issuing authority. The digital security marking 210 of the digital passport contains verification information (D1, k1), in which the digital data of the passport D1 corresponds to the passport data 230a-230d, the biometric data 230e, and the unique serial number 235, and the verification key k1 corresponds to f(X1), when denoted X ¹ = (x ₂ , ..., x ₁₀₂₄ ), xi = H(Di) i =2, ..., 1024 and f is exponentiation modulo m (with given values of the integers I and m) .

- 14 040639

The value of package B is obtained from all digital signatures of the passport (x1, ..., x ₁₀₂₄ ) as B = f(X), where (X = x1, ..., x ₁₀₂₄ ). The computed aggregated digital signature B may optionally be timestamped and stored on blockchain 260. In this example, the biometric data 230e of the respective package digital biometric passport holders is also stored on blockchain 260 in association with their respective unique serial numbers, respectively (to ensure that these data). John Doe's stored biometric data can be retrieved by sending a request to blockchain 260 with the unique 235 serial number found on his digital passport. Authorities responsible for controlling people's identities (e.g., police, customs, etc.) can access the blockchain 260 via a communication channel, and in this exemplary embodiment also have local stores to store the (published) aggregated digital signatures of all delivered digital packets. biometric passports. In the example shown in FIG. 2B, the infobase 250 is local (i.e., directly available to authorities, without the need for a public communications network). In addition, these organs are equipped with fingerprint scanners 270 for capturing human fingerprints and calculating corresponding machine-readable representations of the fingerprint data, i.e. biometric data 230e.

During John Doe's identity verification by, say, a police or customs officer, the officer takes John Doe's secure digital biometric passport A1, reads and decodes the verification information (D1, k ₁ ) stored in the digital security marking 210 of the passport, through a suitable reader that can be, for example, a suitably programmed computer 290, with the computer connected to local stores 250. If John Doe has only a tangible document, such as a paper, biometric passport (stamped with a printed security mark corresponding to the digital security mark 210), the employee can receive associated digital biometric passport A1 by capturing a digital image of the document using a scanner 280 connected to a computer 290, processing the digital image to convert its data content into the corresponding digital data, and saving the extracted digital data to the computer 290 as a digital file , corresponding to John Doe's A1 digital biometric passport. After reading the digital data of the passport D1 and the verification key k1 and sending them to the computer 290, a certain application (with a programmed hash function H and a one-way adder) running on the computer 290 calculates the digital signature of the passport x1 (as x1 =H(D1)) and the potential value of the package B ^c as k1 ^x1 mod m = B ^c . The computer can then, for example, search the local infobase 250 for the value of the B packet corresponding to the value of B ^c : if there is no match, the digital passport is fake and John Doe (i.e., the verifiable person claiming to be John Doe) can be arrested. If B ^c matches some stored value of package B, the digital passport is considered authentic and the employee can perform additional security checks: the employee retrieves the digital photograph 255 of the person stored in the information database 250 by sending a request through the computer 290 containing the serial number 235 at A1, takes it back and displays the received person photo 255 on the computer screen 290: the employee can then visually compare the displayed face (i.e. John Doe's face) with that of the person being tested and judge whether the two faces are similar or not; and the employee extracts the biometric data 230e in the digital passport A ₁ by reading this data on the digital security marking 210 using the computer 290 and scans the person's fingerprint with the fingerprint scanner 270 connected to the computer 290 and obtains the corresponding person's biometric data: the employee then checks, through a program running on the computer 290, whether the extracted biometric data 230e is similar (within a predetermined error) to the obtained human biometric data.

If the two faces and biometrics are considered the same, all is well, and the person being tested is indeed John Doe, the owner of the authentic digital biometric passport A ₁ (and thus possibly also the physical biometric passport from which the A ₁ was derived).

Should any of the above additional security checks fail, it is clear that the person in front of the employee is not the true owner of a genuine A1 digital biometric passport and has likely stolen the passport of one John Doe. Thus, with the secure digital biometric passport of the present invention, a simple offline check can quickly detect any fraud.

In fact, it is even possible to reduce a digital biometric passport document to a simple digital file with a simple digital representation of a 2D barcode (as in the above QR code example) including verification information V = (D, k): with V containing the holder's biographical data and (unique) biometric data such as the holder's fingerprint (in the digital data D of the passport) and a verification key. In fact, according to the present invention, even this reduced secure digital passport has the full advantage

- 15 040639 of the aforementioned tamper-proof link created between the personal biographical data and biometric data of the passport holder and a unique and tamper-proof link between the holder's natural person and the holder's identity.

Another exemplary embodiment of the present invention relates to aircraft components as shown in FIG. 3. Due to the very high cost of some critical components, the failure of which may affect the safety of the aircraft, such as some parts of the reactors (for example, turbine blades, pumps, etc.) or landing gear, or batteries, etc., counterfeiters are interested in producing copies of these components, but, of course, without meeting the necessary technical security requirements due to their usually lower quality. Even if an aircraft component is usually marked with an appropriate unique serial number to identify it, this kind of marking can be easily counterfeited. These fake aircraft parts are usually defective and can cause serious damage or even a plane crash. This is a growing security issue today. Moreover, even if the components are genuine, they may not be suitable for certain versions of the same type of aircraft, and there is a serious risk that an unsuitable component will be accidentally used, for example, to repair a given aircraft. Thus, it is important to provide at least critical genuine components that are approved for a given aircraft.

Typically, each component has a corresponding (possibly digital) data sheet, listing, for example, the technical name of the component, the unique serial number of the component, the name of the component manufacturer, the date of manufacture of the component, and certification information. Moreover, for a given aircraft, the corresponding record contains all (digital) technical data sheets of its respective components. However, counterfeit components may have a corresponding counterfeit digital data sheet, and therefore it is not obvious (unless, for example, technical tests are carried out) to detect fraud. For example, how can you be sure that a digital data sheet correctly matches a component installed on a particular aircraft (and vice versa)?

According to an exemplary embodiment of the present invention, authorized parts that will be used to manufacture or repair a given aircraft, or that are installed on an aircraft, are considered to belong to the package of components (or objects) for that particular aircraft.

In the specific illustrative embodiment shown in FIG. 3, each component of the aircraft package, i.e. each authorized aircraft component to be installed or repaired on that aircraft has a corresponding ACID aircraft component digital identification document that contains the same numerical component data as in a regular data sheet (e.g. aircraft identification code, aircraft manufacturer name, component technical name, unique serial number of the component, name of the component manufacturer and date of manufacture of the component) together with additional numeric data corresponding to the aircraft identification code, the name of the aircraft manufacturer, the date the component was assembled on the aircraft, the name of the person responsible for performing the conformance check, together with the date of the conformance check and the corresponding ( unique) digital signature of the verifier. In addition, each aircraft component AC-ID is protected by a machine-readable digital security marking added to it. For clarity, the digital data of AC-ID:A ₁₂₅ is shown in FIG. 3 as equivalent textual and alphanumeric information (ie, human-readable), and the digital security marking 310 is shown as an equivalent conventional 2D QR code pattern.

Preferably, each time a component or set of components is replaced on an aircraft, corresponding secure digital AC-ID documents are created, and a corresponding updated version of the aircraft package is also created with the aforementioned corresponding additional digital data (related to new installation operations).

Thus, all (critical) installed components on a particular aircraft (in this case, the aircraft with the identifier HB-SNO) belong to the corresponding package of installed components (in this case, a total of μ components) and are documented in the corresponding package of associated μ digital files, t .e. AC-ID digital identification document. A digital security mark 310 (in this case in the form of a two-dimensional representation of a QR code) is included in each aircraft component digital identification document, for example ACID:C ₁₂₅ , which is associated with the corresponding aircraft component, in this case C ₁₂₅ , installed on the HB-SNO aircraft . In FIG. 3 in particular shows component C ₁₂₅ of the aircraft package, which is a turbine blade adapted to the type of reactor installed on an HB-SNO aircraft and marked with a unique factory serial number (in this case 12781, usually engraved by the manufacturer). The digital data of the component D ₁₂₅ in the digital security marking 310 of the aircraft component identification document AC-ID:C ₁₂₅ associated with the component C ₁₂₅ contains the digital data corresponding to the data of the data sheet C ₁₂₅ : aircraft identification code 330a (in this case HB-SNO), aircraft manufacturer name 330b (in this case AeroABC), component technical name 330c (turbine blade ^1st ring in this case), component serial number 330d (in this case 12781), component manufacturer name 330e (in this case in the case of PCX), date of manufacture of the 330f component (in this case November 13, 2017), date of assembly of the component on the 330g reactor (in this case February 24, 2018), name of the person responsible for performing the 330h conformance check (in this case the inspector Martin White) along with the date of the 330i compliance check (in this case March 20, 2018) and the (unique) digital signature of the 330j verifier (in this case 2w9s02u).

Signature of digital file x ₁₂₅ of digital data D ₁₂₅ of digital file AC-ID: C ₁₂₅ of component C ₁₂₅ is calculated by a one-way hash function H as x ₁₂₅ = H(D ₁₂₅ ). In the same way, all signatures of digital files x _i of digital data Dj of digital file AC-ID: C of component C are calculated by means of a one-way hash function H in the form xi = H(Dj) (in this case i = 1, ..., μ ). Let X correspond to the entire set of digital signatures of the components X = (x1, x ₂ , ..., χ _μ ), and let X ^j correspond to the entire set of digital signatures of the components, except for the signature xi, i.e. X ^j = (x1, x2, ...* x _j - ₁ , x _j+1 , ..., χ _μ ). As already disclosed, the aggregated digital signature B for the AC-ID:C1, ..., AC-ID:C _μ (digital files) aircraft component digital identification document packet μ, aircraft components C1, ..., C _μ , is calculated by one-way adder f in the form B = f(X). The aggregated digital signature is then stored in a searchable database (preferably a blockchain) open to those responsible for monitoring or replacing installed components.

For a given digital file AC-ID: C _i of the packet, the corresponding digital file verification key k _j is calculated by the corresponding partial one-way adder as k _j = f(X ^j ). For each component Ci installed on the HB-SNO aircraft, the associated digital data Dj and the corresponding verification key kj are embedded in a digital security marking included in the corresponding digital identification document of the aircraft component AC-ID: Ci. For example, in the case of an inspection operation of a component on an HB-SNO aircraft, the technician may send a query to a searchable database containing the serial number 12781 of the component read on the digital file AC-ID: A125 of the C125 component to be inspected, or its verification key k125, readable on the digital security marking 310 of the AC-ID document: A125 using a suitable reader, such as a computer programmed to decode the contents of the digital security marking, and will receive back the corresponding packet B value. specialist has a memory that stores all aggregated digital signatures related to the aircraft to be controlled. In this last option, the technician can then check if the component is genuine by reading the digital data of the D125 component on the digital security marking 310, checking that the unique serial number 330d (in this case 12781) retrieved from the D125 matches the serial number physically stamped on the the installed aircraft component C125, calculating the corresponding digital signature of the x125 component (for example, by running a programmed application on the computer CPU that calculates the signature x125 = H(D125) from the read digital data D125), calculating the potential value of the packet B ^c by means of a one-way adder function programmed on the computer CPU in the form of B ^c - k125®x ₁₂₅ (operator ®, corresponding to a one-way adder f), and checking whether the potential value of the package B ^c matches one of the values of the package stored in the computer’s memory (i.e., B, corresponding to a package of digital files for the HB-SNO aircraft). In case of a complete match (i.e. match of serial numbers and B ^c = B), component C125 is considered genuine and belongs to the (updated) aircraft package of allowed HB-SNO aircraft components, in case of mismatch of B ^c with the stored value of package B, or in the event of a serial number mismatch, the C125 component is likely to be a fake, or a genuine component not authorized for the HB-SNO aircraft (for example, C ₁₂₅ does not belong to the correct package for this aircraft), and must be replaced.

In the same way, the present invention will detect fraud (or errors) in packages of AC-ID protected spare parts stored in a warehouse by verifying the authenticity of the markings on the stored parts and checking that the serial number of the component from the digital security label matches the number marked on the corresponding component. . In the case of a highly critical component, the component may additionally have a material-based tamper-resistant security marking applied, while the characteristic digital CDD data related to the corresponding control unique physical characteristic (for example, captured by a suitable sensor when applying the security marking based on material) of this marking are preferably part of the digital data of component D in the digital security marking of the aircraft component's digital identification document for that component, and the corresponding control data of the unique physical signature of the UPS is calculated (for example, by taking a hash value of the CDD characteristic digital data, i.e. .UPS = H(CDD)) and can also be

- 17 040639 part of the digital data of component D. This additional layer of security enhances the protection provided by the unique serial number stamped on the component by its manufacturer. Preferably, control CDDs and UPSs are stored on the blockchain (to ensure they are immutable) and are available to a specialist. Moreover, these control values can also be additionally stored in the memory of a technician's computer to allow for offline authentication of a material-based security marking on a highly critical component.

A further off-line authentication operation of this material-based security marking may involve measuring a unique physical characteristic on the component by means of a suitable sensor connected to a computer and deriving potential characteristic digital data CDD ^c from the measured characteristic (e.g. through a special application programmed into the CPU of its computer) . Then the specialist (or the CPU of his computer, if he is programmed accordingly) compares the received ^CDDs with a copy of the control CDDs stored in the computer's memory: in the case of a reasonable match CDD ^c ® CDD (i.e., within some predetermined criterion of acceptable errors) security markings are based on the material and therefore the component is considered genuine.

As mentioned above, a copy of the reference physical characteristic digital data CDD, instead of being stored in the memory of the specialist's computer, is part of the digital data D included in the digital security marking in the digital identification document of the aircraft component AC-ID: C component C, and may be obtained by direct reading on the digital security marking. Then the specialist can read the potential CDD ^c on the digital security marking and check the match of the UPS signature stored in the computer memory with the potential signature UPS ^c calculated from the read potential CDD ^c by calculating UPS ^c = H(CDD ^c ): in case of a match UPS ^c = UPS, the material-based security marking, and thus the component and its associated digital component ID, are verified to be genuine.

In an embodiment, verification of the authenticity of the digital identity document of the component and its associated component by a person skilled in the art can alternatively be performed via an online process similar to that already disclosed in the first detailed embodiment of the present invention and will not be repeated here.

According to the present invention, it is possible to verify the authenticity of the digital identification document of an aircraft component AC-ID: C ₁₂₅ , for example against an original genuine secure digital file. In fact, if the specialist responsible for inspection (or repair) operations has access to the digital file AC-ID: C ₁₂₅ on his computer (which can also be, for example, a smart phone programmed in a suitable way), he can check the compliance of the digital data component data of the original document by performing the following operations: reading the digital data of the component D ₁₂₅ and the verification key k ₁₂₅ on the digital security mark 310 of the digital identification document of the component AC-ID: C ₁₂₅ ; obtaining control value B of the package corresponding to the document AC-ID: C ₁₂₅ ; this reference value may already be in the computer's memory, or it may be obtained via a communication link from a database storing the reference values of the aircraft component digital identification document package, if the computer is equipped with a communication unit, by sending a request containing, for example, the (unique) serial number of the component or simply the key k ₁₂₅ read on the digital security marking 310 and receiving back the corresponding packet B control value; calculating (using a programmed one-way function H) a digital file signature x ₁₂₅ from the read digital data component Di ₂₅ , using x ₁₂₅ = H(D ₁₂₅ ); calculation of the potential value of the package (by means of a programmed one-way adder and its corresponding operator ®) B ^c with B ^c = k ₁₂₅ ®x ₁₂₅ ; and verifying that the potential value of packet B ^c matches the control value of packet B.

As described above, the present invention is explicitly compatible with offline and local verification operations for verifying the authenticity of a secure digital file or whether the data of a copy of a secure digital file matches the data content of an original secure digital file. However, the present invention is also compatible with an online verification process, such as by receiving (via a communication channel) a packet check value from an external source (such as a server or blockchain), or performing some or all of the calculation steps involving a one-way function or a one-way adder through external computing means (for example, running on a server), or even verifying that the potential aggregated digital signature matches the control aggregated digital signature (and simply getting the result).

The foregoing subject matter is to be considered illustrative and not restrictive and serves to better understand the present invention as defined by the independent claims.

Claims (17)

CLAIM 1. A method for protecting a given original digital file from a package of a plurality of original digital files (A1, A2, A ₃ ) from forgery or falsification, with each original digital file of the package containing its own digital data (D1, D2, D ₃ ), which differs in that that the method includes the steps, for each original digital file of the package, calculating, by means of a one-way function, the signature (x1, _x2 , _x3 ) associated with the digital file of its digital data; calculating the control aggregated digital signature (B) corresponding to the package of original digital files from all the signatures of the original digital files of the package by means of a one-way adder of said digital file signatures and providing the user with the control aggregated digital signature; determining the verification key (ki) of the digital file corresponding to the signature of the specified original digital file by means of a one-way adder of all other digital file signatures used to calculate the control aggregated digital signature, whereby the potential signature of the digital file corresponds to the signature of the original digital file of the package, in the case of calculating the control aggregated digital signature by means of a one-way adder of the specified potential signature of the digital file and the corresponding digital file verification key; and including in the given original digital file the digital representation of a machine-readable security mark (110) containing the digital data representation of the given original digital file and its corresponding digital file verification key, thereby obtaining a marked original digital file whose digital data is protected from forgery or falsification. 2. The method according to claim 1, characterized in that the control aggregated digital signature associated with the package of original digital files is either published in an environment open to the user, or stored in a searchable database of aggregated signatures open to the user, or stored in the blockchain (260), or in a database protected by the blockchain, open to the user. 3. The method according to claim 2, characterized in that the tagged original digital file additionally includes data on access to aggregated signatures containing information sufficient to gain access to the control aggregated digital signature corresponding to the package of original digital files, while this information is a link to the interface for collecting aggregated signatures, respectively, one of the following: an environment in which a control aggregated digital signature is published, wherein the environment is open to the user through said aggregated signature collection interface configured to receive from the user an aggregated signature request containing digital data or a digital signature of said digital data obtained from a digital representation of a machine-readable security marking of the marked original digital file, and sending back the control aggregated digital signature of the associated package; a searchable aggregated signature database in which a control aggregated digital signature is stored, wherein the aggregated signature database is open to the user through a specified aggregated signature collection interface configured to receive an aggregated signature request from the user containing digital data or a digital signature said digital data obtained from a digital representation of the machine-readable security marking of the marked original digital file, and sending back the control aggregated digital signature of the associated package; blockchain, respectively, a database protected by a blockchain in which an aggregated digital signature with a timestamp is stored, while the blockchain, respectively, a database protected by the blockchain is open to the user through the specified interface for collecting aggregated signatures, configured to receive a request from the user to an aggregated signature containing digital data or a digital signature of said digital data obtained from a digital representation of the machine-readable security marking of the marked original digital file, and sending back the control aggregated digital signature of the associated package. 4. The method according to any one of claims 1 to 3, characterized in that the virtual digital file (A _v ) is considered to belong to a package of original digital files, while said virtual digital file has a corresponding virtual digital data (D _v ) and is associated with a virtual a digital file, a signature (x _v ) obtained by means of a one-way function of its virtual digital data, said virtual digital file being not real, but only used to generate a signature associated with the virtual digital file from the respective virtual digital data; And - 19 040639 The control aggregated digital signature associated with the specified package of original digital files is calculated from all the signatures of the original digital files of the package, including the signature of the virtual digital file, by means of a one-way adder. 5. The method according to any one of claims 1-4, characterized in that the one-way function is a hash function, and the signature of the original digital file is a sequence of a given set of bits with lower bit values selected from the bits of the hash value of the corresponding digital data. 6. The method according to any one of claims 1 to 5, characterized in that the additional digital data corresponding to the digital data associated with the tagged original digital file is stored in a searchable infobase (250) open to the user via the information interface. a database configured to receive from a user a request for information containing digital data or corresponding digital file signature data obtained from a digital representation of the machine-readable security marking of the marked original digital file, and send back the corresponding additional digital data. 7. The method according to any one of claims 1 to 6, characterized in that the digital data of the tagged original digital file includes the control characteristic digital data CDD (230e) of the corresponding unique physical characteristic of the associated object or person. 8. A method for verifying the authenticity of a digital file protected according to the method according to any one of claims 1 to 7, or the correspondence of a copy of such a protected digital file with respect to the original file, characterized in that the method includes the steps of processing a test file, which is a specified digital file or a specified a copy of the digital file, by means of a processing unit connected to the memory: saving a test file in memory; reading a digital data representation and a test file verification key on a digital representation of a machine-readable security mark in the stored test file, and extracting corresponding digital data and a test file verification key from said read representation, respectively; storing in memory the control aggregated digital signature of the corresponding package of digital files and programming in the processing unit of the one-way function and the one-way adder; verifying the actual correspondence of the extracted digital data and the verification key of the test file of the stored control aggregated digital signature by performing the steps of calculating the digital signature of the extracted digital data using a one-way function; calculating a potential aggregated digital signature from the calculated digital signature of the extracted digital data and the extracted test file verification key using a one-way adder; and checking that the obtained potential aggregated digital signature matches the stored control aggregated digital signature, whereby if said aggregated digital signatures match, the digital data of the test file is the data of the original original digital file. 9. The method according to claim 8, characterized in that the digital file is protected by storing the control aggregated digital signature associated with the package of original digital files in a searchable database of aggregated signatures, open to the user, according to the method according to claim 2, and the processing unit is additionally connected to the communication unit, configured to send and receive data back via the communication channel, the method comprising the preliminary steps of sending the communication unit via the communication channel a request to the specified database of aggregated signatures and receiving back the control aggregated digital signature associated with the package original digital files; and storing the received aggregated digital signature in memory. 10. The method according to claim 8, characterized in that the digital file is protected according to the method according to claim 3, and the processing unit is additionally connected to the communication unit, configured to send and receive back data via a communication channel, while the method includes preliminary steps of reading data on access to aggregated signatures included in the test file; sending by the communication unit via a communication channel a request for an aggregated signature to the specified interface for collecting aggregated signatures, containing digital data or a digital signature of said digital data obtained from the digital representation of the machine-readable security mark in the test file, and receiving back the corresponding control aggregated digital signature of the associated package; and storing the received aggregated digital signature in memory. - 20 040639 11. The method according to any one of claims 8 to 10, characterized in that the digital file is protected according to the method according to claim 6, and the processing unit is additionally connected to communication means configured to send to the information database interface a request for information containing digital data or a corresponding signature of the digital file obtained from the digital representation of the machine-readable security marking in the test file, and receiving back the corresponding additional digital data. 12. The method according to any one of claims 8 to 11, characterized in that the digital file is protected according to the method according to claim 7, and the processing unit is connected to a sensor configured to detect a unique physical characteristic of the associated object or person, the processing unit is programmed to extract corresponding unique physical characteristic digital data from the detection signal received from the sensor, the processing unit stores CDD reference characteristic digital data in memory corresponding to said unique physical characteristic of the associated object or person, the method including additional steps, when considering a subject representing, respectively , the specified associated object or person, detecting a unique characteristic of the subject and extracting the corresponding potential characteristic digital data CDD ^c ; comparing the obtained potential characteristic digital data CDD ^c with the stored reference characteristic digital data CDD; and if the candidate CDD characteristic digital data ^c is similar to the stored reference CDD characteristic digital data, subject to a predetermined tolerance criterion, the subject is considered genuine. 13. A marked digital file belonging to a package of a plurality of original digital files and protected from forgery or falsification according to the method according to any one of claims 1 to 7, wherein each original digital file of the package has its own digital data, said package has a corresponding control aggregated digital signature, wherein the file contains a digital representation of a machine-readable security marking, including a representation of the digital data of the marked digital file and the corresponding digital file verification key. 14. The tagged digital file as claimed in claim 13, wherein the digital data of the tagged digital file includes CDD reference characteristic digital data of a corresponding unique physical characteristic of the associated object or person. 15. The tagged digital file of claim 14, wherein the unique physical characteristic of the associated object is a characteristic of a material-based security marking applied to the associated object. 16. A system for verifying the authenticity of a marked original digital file protected according to the method according to any of claims 1-7, or the correspondence of a copy of such a digital file relative to the original file, while the system contains a processing unit with memory, the memory stores the control aggregated digital signature of the corresponding package of digital files and a one-way function and a one-way adder programmed in the processing unit, wherein the system is configured to receive a test file representing the specified digital file or a copy of the digital file, and store the resulting test file in memory; reading a digital data representation and a test file verification key on a digital representation of a machine-readable security mark in the stored test file, and extracting corresponding digital data and a test file verification key from said read representation, respectively; verification of the actual correspondence of the extracted digital data and the verification key of the test file of the stored control aggregated digital signature by implementing the steps programmed in the processing unit: calculating a digital signature of the extracted digital data using a one-way function; calculating a potential aggregated digital signature from the calculated digital signature of the extracted digital data and the extracted test file verification key using a one-way adder; and checking that the obtained potential aggregated digital signature matches the stored control aggregated digital signature, whereby, if said aggregated digital signatures match, the digital data of the test file is the data of a genuine original digital file, and the system is configured to deliver an indication that the digital data on the test file are the data of a genuine original digital file. 17. The system according to claim 16 for verifying a digital file protected according to the method according to claim 7, or matching a copy of such a digital file with respect to the original file, additionally based - 21 040639 equipped with a sensor connected to the processing unit and configured to detect a unique physical characteristic of the associated object or person, and while the processing unit is programmed to extract the corresponding characteristic digital data from the detection signal received from the sensor, the system stores in the memory the control characteristic digital CDD data corresponding to said unique physical characteristic of the associated object or person, wherein the system is further configured to detect, with the sensor, a unique physical characteristic of the subject representing said associated object or person and extract corresponding potential characteristic digital data CDD ^c ; comparing the obtained potential characteristic digital data CDD ^c with the stored control characteristic digital data CDD; and if the potential CDD characteristic digital data ^c is similar to the stored reference CDD characteristic digital data, subject to a predetermined tolerance criterion, delivering an indication that the subject is considered genuine.