EA040711B1 - DOUBLE MATERIAL AND DIGITAL PROTECTION OF THE PRODUCT AGAINST FORGERY - Google Patents

Description

The technical field to which the invention belongs

The invention relates to the protection of products and data marked on such products from forgery or falsification, as well as the correspondence of digital images of such marked products to original products, and the possibility of traceability of products.

State of the art

With regard to mechanical parts, electronic components, pharmaceutical products and a host of other products, counterfeiting and counterfeiting problems are well known and serious, and their number is constantly growing. Moreover, the falsification of product-related data is also a serious problem. A well-known example is the falsification of data marked on an original printed document, such as an identity document or a diploma (product), and the situation is even worse when considering a digital copy or photocopy of the original (possibly genuine) document. Simply keeping track of identifiers such as serial numbers is generally not an adequate solution, as counterfeiters can easily copy such numbers.

There are many other protection schemes for manufacturing products, but they generally do not provide a sufficient level of protection, they have too high administrative overhead in terms of the information that needs to be stored and accessed, they are often impractical to use, except as in well-controlled environments, or they simply cannot be implemented physically. For example, many schemes for digitally securing documents in a verifiable manner are not suitable for use in contexts that involve many physical goods that are impractical or otherwise undesirable to be marked with appropriate signatures.

Another disadvantage of most traditional methods for ensuring the authenticity of products or protecting data associated with them is that they tend to view products in isolation, even if they are members of a well-defined group, such as a production batch. This ignores valuable authentication information.

A common way to protect a product is to affix a material-based (possibly tamper-proof) security mark, i.e. a mark that has a detectable intrinsic physical or chemical property that is very difficult (if not impossible) to reproduce. If a suitable sensor detects this intrinsic property of the mark, the mark is considered genuine with a high degree of certainty, and hence the corresponding marked product. There are many examples of such well-known authenticating intrinsic properties: the marking may include some particles, perhaps randomly distributed, or have a certain layered structure, having intrinsic properties of optical reflection, or transmission, or absorption, or even emission (for example, luminescence, or polarization, or diffraction, or obstruction, etc.), possibly detectable under certain illumination conditions with light of a certain spectral composition. This intrinsic property may be the result of the particular chemistry of the marking material: for example, luminescent pigments (perhaps not commercially available) may be dispersed in an ink used to print some pattern on an article and used to emit a particular light (for example, in a spectral window in infrared range) when illuminated with a certain light (for example, light in the UV spectral range). This is used, for example, to protect banknotes. Other intrinsic properties can also be used: for example, the luminescent particles in the marking may have a certain decay time of the luminescent emission after illumination with a suitable excitation light pulse. Other types of intrinsic properties are the magnetic property of the particles included, or even the fingerprint property of the product itself, such as, for example, the relative position of initially randomly distributed fibers of the paper backing of a document in a predetermined area on the document, which, when viewed at sufficient resolution, can serve to extract a unique characteristic feature. signature or some random printed data artifacts printed on the product, which, when viewed at sufficient magnification, can also lead to a unique signature, etc. The main problem associated with the intrinsic fingerprint property of the product is its resistance to aging or wear. However, material-based security markings do not always also protect the data associated with the marked product: for example, even if a document is marked with a material-based security marking, such as a logo printed with security ink in some area of the document, the data printed on the remainder of the document , can be falsified. Moreover, overly complex authentication signatures often require significant storage involving external databases and communication channels for queries against such databases, so that offline authentication of the product is not possible.

Thus, the purpose of the present invention is to protect the product from counterfeiting and falsification of data associated with it and, in particular, data relating to its belonging to a certain batch of products. It is also an object of the present invention to enable offline verification of the authenticity of an object protected according to the present invention and the correspondence of data associated with it to that of a genuine object.

Brief description of the invention

One aspect of the present invention relates to a method for protecting a given original product from a batch of a plurality of original products from forgery or falsification, while each original product of the batch has its own product data associated with it and the corresponding digital product data, while the method includes the steps: for each original batch items, calculating by means of a one-way function the digital signature associated with the item of its corresponding digital item data; calculating a control aggregated digital signature corresponding to a batch of original products from all digital signatures of original products of a batch by means of a one-way adder of said digital signatures of products, and providing the user with a control aggregated digital signature; determining the product verification key corresponding to the digital signature of the specified specified original product, by means of a partial one-way adder of other digital signatures of the products used to calculate the control aggregated digital signature, as a result of which the potential digital signature of the product corresponds to the signature of the original product of the batch, in the case of extracting the control aggregated digital signature from a one-way function of the specified potential digital signature of the product and the corresponding product verification key; and applying to the specified original product an appropriate machine-readable product security marking, including the presentation of digital data associated with the product and its corresponding product verification key, thereby obtaining a marked original product, the product data of which is protected from counterfeiting or falsification.

The control aggregated digital signature associated with a batch of original products can either be published in an environment open to the user, or stored in a searchable aggregated signature database, open to the user, or stored on the blockchain, or stored in a database protected by the blockchain. , open to the user. Moreover, the marked original product may additionally contain data on access to aggregated signatures, marked on it and containing information sufficient to gain access to the control aggregated digital signature corresponding to the batch of original products, while this information is a link to the interface for collecting aggregated signatures , respectively, one of the following: an environment in which the control aggregated digital signature is published, while the environment is open to the user through the specified interface for collecting aggregated signatures, configured to receive from the user an aggregated signature request containing product data or a digital signature of the specified data products resulting from the security marking of the marked original product, and sending back the control aggregated digital signature of the associated batch; a searchable aggregated signature database in which a control aggregated digital signature is stored, wherein the aggregated signature database is open to the user via a specified aggregated signature collection interface configured to receive an aggregated signature request from the user containing product data or a digital signature specified product data, obtained from the security marking of the marked original product, and sending back the control aggregated digital signature of the associated lot; blockchain, respectively, a database protected by a blockchain in which an aggregated digital signature with a timestamp is stored, while the blockchain, respectively, a database protected by the blockchain is open to the user through the specified interface for collecting aggregated signatures, configured to receive a request from the user to an aggregated signature containing product data or a digital signature of said product data, obtained from the security marking of the marked original product, and sending back the control aggregated digital signature of the associated batch.

According to the present invention, a virtual item may be included in a batch of original items, wherein said virtual item has data associated with the virtual item and its corresponding virtual item digital data, as well as a digital signature associated with the virtual item obtained through a one-way function, while said virtual item the product is not created, but only used to generate a digital signature associated with the virtual product from the corresponding digital data of the virtual product; the control aggregated digital signature associated with the specified batch of original products is calculated from all digital signatures of the original products of the batch, including the digital signature of the virtual product, by means of a one-way adder.

The one-way function may be a hash function, and the digital signature of the original product may be a sequence of a predetermined set of bits with lower bit values selected from the bits of the hash value of the corresponding digital product data.

In the above method, additional digital product data corresponding to the data

- 2 040711 products associated with a branded original product can be stored in a searchable information database open to the user through an information database interface configured to receive from the user a request for information containing product data or corresponding digital signature data , obtained from the security marking of the marked original product, and sending back the corresponding additional digital product data.

The branded original product may further comprise a corresponding product data marking affixed to it, wherein said product data marking includes appropriate product data associated with said branded original product.

The branded original product digital data may include the UPC control physical characteristic digital data of the corresponding unique physical characteristic of the branded original product or associated object or person. Moreover, the unique physical characteristic of the marked original product may be the characteristic of the material-based security marking applied to the original product.

Another aspect of the present invention relates to a method for verifying the authenticity of an article protected according to the above method of protecting an original article, or the correspondence of a copy of such a protected article relative to the original article, the method comprising the steps, when considering a test object that is a specified article or a specified copy of the article: obtaining digitally imaging the security mark on the test object by means of an imaging apparatus having an imaging unit, a CPU with memory, and an image processing unit; reading an article digital data representation and an article-related verification key in the obtained digital image of the security marking on the test object, and extracting corresponding article digital data and the article verification key from said read representation, respectively; storing in memory the control aggregated digital signature of the corresponding batch of products and programming the one-way function and the one-way adder in the CPU; verifying the actual correspondence of the extracted digital product data and the product-related verification key of the stored control aggregated digital signature by performing the steps of: calculating a digital signature of the extracted digital product data using a one-way function; calculating a potential aggregated digital signature from the calculated digital signature of the extracted product digital data and the extracted product verification key using a one-way adder; and verifying that the received potential aggregated digital signature matches the stored reference aggregated digital signature, whereby, if said aggregated digital signatures match, the product data in the test object is that of a genuine original product.

A verification method in which the product is protected by storing a control aggregated digital signature associated with a batch of original products in a searchable database of aggregated signatures open to the user, and in which the imaging device is further equipped with a communication unit configured to send and receiving data back via the communication channel may include the preliminary steps of: sending the communication unit via the communication channel a request to the specified database of aggregated signatures and receiving back the control aggregated digital signature associated with the batch of original products; and storing the received aggregated digital signature in the memory of the imaging device.

In the verification method, the article may be protected by including data on access to aggregated signatures as mentioned above, and the imaging device may be further equipped with a communication unit configured to send and receive back data through a communication channel, while the verification method includes preliminary the steps of: reading the aggregated signature access data marked on the test object with an imaging device; sending by the communication unit via a communication channel a request for an aggregated signature to a specified interface for collecting aggregated signatures containing product data or a digital signature of said product data obtained from a security mark on the test object, and receiving back the corresponding control aggregated digital signature of the associated batch; and storing the received aggregated digital signature in the memory of the imaging device.

The product may be protected with additional product data as mentioned above, and the imaging apparatus may be further equipped with communication means capable of sending to the information database interface an information request containing the product data or the corresponding digital signature data obtained from the security marking. on the test object, and receiving back the corresponding additional digital product data.

The product may be protected by the product data marking as mentioned above, wherein the verification method includes the additional steps of: reading the product data marked on the product data marking on the test object using an imaging device; and verifying that the product data read from the product data marking matches the digital product data extracted from the security marking on the test object.

The product may be protected by the product data marking and may additionally have a material-based security marking as mentioned above, and the imaging device may additionally be equipped with a sensor capable of detecting a unique physical characteristic of the marked original product or associated object or person, and a CPU is programmed to extract the corresponding unique physical characteristic digital data from the detection signal received from the sensor, the imaging device stores in the memory the control UPC physical characteristic digital data corresponding to the specified unique physical characteristic of the marked original product or associated object or person, the method including additional the steps, when considering a subject that is a specified product or a specified associated object or person: detecting, using a sensor, a unique physical which characterization of the subject and extracting the corresponding potential digital data of the unique physical characteristic UPC ^c ; comparing the obtained UPC unique physical characteristic ^c potential digital data with the stored reference UPC physical characteristic digital data; and if the potential digital data of the UPC unique physical characteristic ^c is similar to the stored control physical characteristic digital data of the UPC, subject to a predetermined tolerance criterion, the subject is considered genuine.

Another aspect of the present invention relates to a method for verifying the conformity of a digital image of an original product protected according to the above method with respect to a marked original product, the method including the steps of: imaging, a CPU with memory and an image processing unit; reading an article digital data representation and an article-related verification key in the received security marking digital image, and extracting corresponding article digital data and the article verification key from said read representation, respectively; storing in memory the control aggregated digital signature of the corresponding batch of products and programming in the CPU of a one-way function and a one-way adder; verifying the actual correspondence of the extracted digital product data and the associated verification key of the stored control aggregated digital signature by performing the steps: calculating a digital signature of the extracted digital product data using a one-way function; calculating a potential aggregated digital signature from the calculated digital signature of the extracted product digital data and the extracted verification key using a one-way adder; and checking that the obtained potential aggregated digital signature matches the stored control aggregated digital signature, whereby, if said aggregated digital signatures match, the product data in the digital image of the product is the data of a genuine original product.

The product may be protected by storing a control aggregated digital signature associated with a batch of original products in a searchable database of aggregated signatures open to the user, as disclosed above, and the imaging device may additionally be equipped with a communication unit configured to send and receiving data back via a communication channel, wherein the method for verifying compliance includes the preliminary steps: sending a request to the specified database of aggregated signatures by the communication unit via a communication channel and receiving back a control aggregated digital signature associated with a batch of original products; and storing the received aggregated digital signature in the memory of the imaging device.

In a variant, the product may be protected with data on access to aggregated signatures, as mentioned above, and the imaging device may additionally be equipped with a communication unit configured to send and receive data back via a communication channel, while the method of verifying conformity includes the preliminary steps: reading the access data to the aggregated signatures with the device for forming an image on the received digital image of the product, showing the access data marked on the product; sending by the communication unit via a communication channel a request for an aggregated signature to a specified interface for collecting aggregated signatures containing product data or a digital signature of said product data obtained from a security marking image on the product, and receiving back the corresponding control aggregated digital signature of the associated batch; and storing the received aggregated digital signature in the memory of the imaging device.

The article may be protected by the article data marking as disclosed above, and the method for verifying the conformity of the article's digital image may include the additional steps of: reading the article data marked on the article data marking on the received digital article image by means of an imaging device; and verifying that the product data read from the digital image of the product data mark matches the digital product data extracted from the security mark on the received digital image of the product.

According to another aspect, the present invention relates to a marked product belonging to a batch of a plurality of original products and protected from forgery or falsification according to the above method, while each original product of the batch has its own associated product data and corresponding digital product data, said batch has a corresponding a control aggregated digital signature, wherein the product contains: a machine-readable security marking applied to it and including the presentation of digital data associated with the product and the corresponding product verification key.

The tag item numeric data may include a reference UPC physical characteristic numeric data corresponding to the unique physical characteristic of the tag item or associated object or person.

The unique physical characteristic of the marked article may be a characteristic of a material-based security marking applied to the marked article.

The present invention further relates to a system for verifying the authenticity of a marked original product protected according to the aforementioned protection method, or the correspondence of a copy of such an product with respect to the original product, the system comprising an image forming apparatus having an imaging unit, a CPU with memory and an image processing unit, wherein in this case, the memory stores the control aggregated digital signature of the corresponding batch of products and the one-way function and one-way adder programmed in the CPU, while the system is configured to: receive a digital image of the security mark on the test object, which is the specified product or the specified copy of the product; reading an article digital data representation and an article-related verification key in the obtained digital image of the security marking on the test object, and extracting corresponding article digital data and the article verification key from said read representation, respectively; verifying the actual correspondence of the extracted digital product data and the associated verification key of the stored control aggregated digital signature by performing additional programmed steps on the CPU: calculating a digital signature of the extracted digital product data using a one-way function; calculating a potential aggregated digital signature from the calculated digital signature of the extracted product digital data and the extracted verification key using a one-way adder; and checking that the received potential aggregated digital signature matches the stored control aggregated digital signature, whereby, if said aggregated digital signatures match, the system is configured to deliver an indication that the item data in the test object is genuine original item data.

In the aforementioned system for verifying a product protected by UPC physical signature control data, which may relate to a material-based security marking as disclosed above, the imaging device may further be equipped with a sensor capable of detecting a unique physical characteristic of the marked original product or associated object or person, and the CPU is programmed to extract the corresponding unique physical characteristic digital data from the detection signal received from the sensor, the imaging device stores in memory the reference UPC physical characteristic digital data corresponding to the specified unique physical characteristic of the marked original product or associated object, or of a person, while the system is additionally configured to: detect, using a sensor, a unique physical characteristic of the subject, representing the specified product or the specified associated object or person, and extracting the corresponding potential digital data of the unique physical characteristic UPC ^c ; comparing the obtained UPC unique physical characteristic ^c potential digital data with the stored reference UPC physical characteristic digital data; and if the potential digital data of the UPC unique physical characteristic ^c is similar to the stored control physical characteristic digital data of the UPC, subject to a predetermined tolerance criterion, delivering an indication that the subject is considered genuine.

The present invention also relates to a system for verifying the conformity of a digital image of an original product protected according to the above protection method with respect to a marked original product, the system comprising an image forming apparatus having an imaging unit, a CPU with a memory, and an image processing unit, wherein the memory saves a control aggregated digital signature of the corresponding batch of products and a one-way function and a one-way adder programmed in the CPU, wherein the system is configured to: receive a digital image of the product demonstrating the security marking on the original product; reading an article digital data representation and an article-related verification key in the received security marking digital image, and extracting corresponding article digital data and the article verification key from said read representation, respectively; verifying the actual correspondence of the extracted digital product data and the associated verification key of the stored control aggregated digital signature by performing additional programmed steps on the CPU: calculating a digital signature of the extracted digital product data using a one-way function; calculating a potential aggregated digital signature from the calculated digital signature of the extracted product digital data and the extracted verification key using a one-way adder; and checking that the received potential aggregated digital signature matches the stored control aggregated digital signature, whereby, if said aggregated digital signatures match, the system is configured to deliver an indication that the product data in the product digital image is genuine original product data.

Hereinafter, the present invention will be described more fully with reference to the accompanying drawings, which illustrate the main aspects and features of the present invention.

Brief description of the drawings

In FIG. 1 is a schematic view of a general batch protection method according to the present invention.

In FIG. 2A illustrates a secure biometric passport as an example of a biometric identity document secured in accordance with the present invention.

In FIG. 2B illustrates a control of a person having a secure biometric passport according to FIG. 2A by an authorized employee.

In FIG. 3 illustrates a batch of aircraft components protected in accordance with the present invention.

In FIG. 4 illustrates a batch of pharmaceutical products protected according to the present invention.

Detailed description

The present invention is herein described in detail with reference to the non-limiting embodiments illustrated in the drawings.

In FIG. 1 illustrates a general method according to the present invention relating to the protection of a batch of products, and to a method for calculating the encoding of verified information that can be associated with each product. In FIG. 1 illustrates a group or batch of articles A ₁ , A ₂ A ₃ , ... which can be anything capable of carrying or containing a physical machine-readable security mark 110 (in this case illustrated by a two-dimensional bar code) or carrying something that, in turn bears or contains a physical security marking. An article may be a manufactured product or its packaging, a physical document or image, a package containing multiple products (eg, a drug blister pack), or a container containing pallets of product cartons, etc. Even a human or animal can be an article in the context of embodiments of the present invention; for example, authorized participants in an event or members of a group, or members of a herd or flock may carry some form of identification badge or (especially in the case of animals) be physically marked.

A batch may, for example, refer to a normal production cycle, goods delivered by a specific supplier, goods manufactured or shipped over a period of time, a set of related images, a group of people, a herd or flock, or any other user-defined grouping of any objects for which data Ai be determined. In FIG. 1 also shows the virtual item A _v , which is an optional piece of software that can be included to provide encoding of selected data. This is explained next. By way of example only, the virtual item A _v is assumed to be included and will be treated below as other items A ₁ , A ₂ , A ₃ , ... since it can be handled in much the same way (although it does not correspond to a real object). Of course, the set of virtual products A _v1 , A _v2 , ..., A _vk can be used to encode digital data and create more secure digital signatures of the product (see below).

For each item A ₁ , A2, A ₃ , ... A _v the corresponding digital data of the item D ₁ , D ₂ , D ₃ , ... , D _v are associated or extracted (or, in the case of the virtual item Av, created) with using any suitable method. This data may be some measure of physical characteristics, textual data such as a completed form or product information, a serial number or other identifier, content indications, a digital representation of an image, or any other information that the system designer chooses to associate with the product. The digital product data Di can be extracted from human readable data (e.g., alphanumeric data) marked on the product (e.g., printed on the product or on a label affixed to the product) by

- 6 040711 reader configured to create the corresponding digital data file. Additional digital data (for example, a command to use the product or a security command, etc.) may be associated with the extracted data to create digital product data Di.

For the virtual item A _v, the associated digital data may include, for example, a batch identification number, number of items in a batch, a (pseudo-) random number to increase security by increasing data entropy, date and/or time information, etc. Another form of associated data can be indications of valid or invalid transaction rules, expiration dates, etc. In short, digital data D _v can be anything that can be represented in digital form.

For each product, its corresponding digital product data D1, D2, D3, ..., D _v is preferably mathematically converted so that it is essentially hidden, although this is not an absolute requirement for any implementation. This transformation, applied to the digital data Di of the product Ai, serves to create the corresponding digital signature xi. This digital signature is obtained through a one-way function (i.e., a function that is easy to compute but difficult to invert, see S. Goldwasser and M. Bellare Lecture Notes on Cryptography, MIT, July 2008, http://www-cse.ucsd. edu/users/mihir).

One such advantageous transformation is, for example, the application of the hash function H( ) = hash( ) to the digital data of a product, which usually tends to return an output of a known length in bits, regardless of the size of the input: this technical effect is especially useful for generating a digital digital data signatures associated with a product, regardless of the size of the associated digital product data and lot size. The hash function is a well-known example of a one-way function. If a cryptographic hash function is used, such as the SHA (Secure Hash Algorithm) function class, such as SHA-256, then there are additional advantages that the function is almost irreversible and collision resistant, i.e. the possibility that two different groups input data will lead to the same output data, is negligible. As will be clear from the description below, this is also not a requirement of the present invention, although it is advantageous for the same reasons as in other applications. As shown in FIG. 1, the values x1, x ₂ , x ₃ ,..., x _v are hash values, i.e. the product-related digital signatures of the respective product data sets, i.e. Xj = H(Dj), for j=1, . ..,v. For brevity, X (capital letter) is used here and in FIG. 1 to denote a set of hashed data values; thus, X = (x1, x ₂ , ..., x _v ) (if the virtual item A _v is included; otherwise, the element x _v can be omitted).

To shorten the signature, the digital signature Xj of item Aj can even be simply a sequence of a given set of bits with lower bit values selected from the bits of the hash value H(Dj): for example, using the SHA-256 hash function of the SHA-2 family, it is enough to store only 128 bits with the lower bit values of the 256 bits of the signature to still have a strong signature against a cryptanalytic attack.

The aggregated digital signature or batch B value is then computed over X by a (quasi-commutative) one-way adder (see Josh Benaloh and Michael de Mare OneWay Accumulators: A Decentralized Alternative to Digital Signatures, Advances in Cryptology - Eurocrypt' 93, LNCS, issue 765, pages 274-285, Springer-Verlag, 1993 and one way function - Disadvantages of one-way accumulators? - Cryptography Stack Exchange by unknown author, April 12, 2014). In general, for a set μ of signatures x1,x ₂ , ....x _μ (possibly including digital signatures of one or more virtual items), the corresponding total value f(x1, x ₂ , .... x _μ ), abbreviated as f(X) with X = (x1, x ₂ , .... x _μ ) given by the one-way adder f is:

f(x _n X ₂ , .... Χ _μ ) = f(f(f(... f(f(f(Xi), X ₂ ) ... X ₃ ), - , Χμ- ₂ } Χμ -1λ Χμ)·

In general, one can write f(x1, x ₂ ) = x10x ₂ where 0 is the associated operator, preferably chosen such that f(X) is hard enough to invert so that the computational burden is too high for practical implementation. This concept of computational impracticality used in the embodiments is further disclosed below. According to the present invention, a one-way adder is chosen to calculate aggregated signatures due to the B size constraint condition. In effect, such an adder produces a digital value whose size (i.e., number of bits) is independent of the size of its arguments.

As an elementary example, the batch value can be a function f(X), such as commutative addition modulo a given modulo m, i.e. f(x) = x mod m and f(x, y) = x0y, with the associated commutating operator 0, defined x0y = (x + y) mod m. So in this case they have:

f(x,y) = f(x) + f(y) (that is, f(x,y) = f(x)0f(y)).

This one-way adder has the following commutative property (although only quasi-commutativity is needed for the present invention):

- 7 040711

B \u003d f (X) \u003d X ₁ ®X ₂ ®X ₃ ® ...®Xμ \u003d x ₁ ® (x ₂ ®x ₃ ® ...®Xμ) \u003d X ₂ ® (Xι®X ₃ ® .. .®Χ _μ ) _; etc.

And now X ⁱ consider the set of all elements of X, with the exception of xi. For example, where i \u003d 1, X ¹ \u003d (x ₂ , x ₃ , ... χ _μ ). Assuming for simplicity that f(X) is commutative with respect to the elements of X, and given the f(X) property above, this leads to:

В = f(X) = χγίζΧ ¹ ) = ίζΧ ¹ )® x _t = (х ₂ ®х ₃ ® ...®χ _μ )®χ ₁ = kY with verification key to _x = (х ₂ ®х ₃ ® ... ®χ _μ ) = fCX ¹ )·

According to the present invention, the aggregated digital signature B of a batch of products becomes immutable and therefore tamper-proof by publishing it in a (public) environment open to the user, who must verify the authenticity of the product (or related data), or by storing it in an accessible to search a database of aggregated signatures open to the user, or preferably store it on a blockchain open to the user. The user can then store the B value obtained from these available sources.

For each item Ai, the corresponding item verification key ki is then computed by a partial one-way adder of other digital signatures of items Xj (where j^i), i.e. a one-way adder of digital signatures x1, ... xi-1, x _i+1 .... x _u or f(Xi) For example, in module 120 of FIG. 1, the verification key ki of product Ai is calculated as ki = f(Xi), and for the operation of checking whether the digital data of product Di and the verification key ki of product Ai actually correspond to the data of a genuine product belonging to a lot with a value of lot B, only verification that k _i ®f(H(D _i )) = B, i.e. ki®xi = B. The resulting compact (due to the adder property) verification key ki, as part of the verification information Vj = (Di, ki) needed to compute B, included in the security marking 110 applied to the product A _i along with the digital data D _i of the product Ai. This is an important aspect of the present invention since the space available for security marking data is generally limited, in particular to perform offline verification of the authenticity of a secure item and offline verification of the consistency of associated data with genuine item data. The type of one-way adder for f is well chosen to meet the technical challenge of reducing the size of the verification key data to be included in the security marking. In fact, the quasi-commutative (or even commutative) property of such adders makes it possible to sign the data of a given item belonging to a batch of items without having to further include data relating to the order of the items in the batch or the position of said given item according to the order in the batch. Moreover, without the mentioned property of quasi-commutativity, much more computers would be needed for verification operations.

Calculation module 120 is preferably included in security system 100 for executing code provided for performing calculations for f(X), for key values k _i for different products, and for the total value V. Security system 100 may also include suitable modules for input (programmed ) values corresponding to the digital data D _v of the virtual item A _v . The hashing of the digital data D _i of the product A _i to obtain the corresponding digital signature of the product xi can also be performed, for example, in the calculation module 120. It would also be possible to perform the hash calculations associated with the products externally (e.g., on a connected remote server), for example, wherever the products are manufactured, to avoid having to transfer the raw data of the product Di over the network from this site (or sites) to the system 100 protection if there is a problem.

For each item Ai, the corresponding verification information Vi is compiled and encoded in some form of machine-readable security marking 110, which is then physically applied or otherwise associated with the respective item. For example, Vi can be encoded on an optically or magnetically readable label, RFID tag, etc., which is attached to the product or printed directly on the product or its packaging. Alternatively, the marking may be on the inside of the product or on its packaging, if necessary, either by direct application or, for example, by inclusion in some form of documentation that is inside the packaging.

For any virtual item A _v its corresponding verification information V _v can be associated with it within the security system 100 . The verification information typically at least includes, for any product A _i of the product batch, the corresponding digital product data D _i and the corresponding verification key ki: Vi = (Di, ki). According to the present invention, the data encoding D _i and the data encoding k _i may be different (providing an additional level of security against cryptanalytic attacks).

Additional item data may further be associated with the item and may include, for example, a B lot value, or any other information that the system designer chooses to include, such as item serial number, lot ID, date/time information,

- 8 040711 product name, a URL that points to other online information associated either with an individual product (for example, an image of a product or its label or packaging, etc.), or with a batch, or with a supplier/manufacturer, a telephone number to call for verification, etc. Additional product data may be stored in a searchable information database that is open to the user (via the information database interface).

After calculating the verification k _i of the original product Ai and including (i.e. by encoding or any chosen data representation) together with the corresponding digital product data Di in the machine-readable product security marking 110 applied to the product, the resulting marked original product and associated data products are really protected from forgery and falsification. An advantage of the present invention is that no encode/decode key is included in the security marking.

There are various types of physical (security) markings that can be used to encode the verification key and digital product data (or any other data). However, many labeling systems that can be used in practice on small goods or services that cannot accept high-resolution physical labels cannot encode a large amount of data. One way to solve this problem would be to include several markings, each of which includes one or more elements of the verification vector. In many cases this is impractical due to lack of physical space or unsuitability of the sign surface, or simply because it would be aesthetically unacceptable.

There are many well-known methods for encoding information that can be applied to physical surfaces. Any such method can be used in implementations of any embodiment of the present invention. One common form of physical marking is the well-known QR code. As is well known, for a given area, the more data a QR code can encode, the higher the modulus density (roughly speaking, the density of black/white squares) and the greater the resolution required for printing and reading. In addition to density (in the number of modules squared), QR codes are also commonly classified according to what level of error correction they include. There are currently four different standard levels, L, M, Q and H, each representing the degree of damage, i.e. data loss, that a QR code image can withstand and recover from. Levels L, M, Q and H can withstand approximately 7%, 15%, 25% and 30% damage, respectively. The following table provides at least approximate values for different versions of the QR code:

Version Size (in modules) Number of encoded bits level L ESS level H ESS 10 57x57 2192 976 25 117x117 10208 4304 40 177x177 23648 10208

However, not all bits can be used to encode data downloads, as some modules are used for scan objects, mask pattern, and error correction modules. Thus, there is a trade-off between the amount of information that the QR code (or any other marking 110) can encode and how much information is included in the verification information V and needs to be encoded.

Therefore, for the selected type of security marking 110 (e.g., QR code) with limited encoding capability, an appropriate encoding function f(X) must also be selected: a function whose output is too large in terms of required bits cannot be used at all, and the function , whose range is too small, may not be reliable enough. Moreover, in many applications, scalability can be an issue. For example, some data protection schemes include signatures that grow as the number of elements of a batch increases, and which may unacceptably limit the size of the batch in terms of how many bits the security marking 110 can encode. .

In one exemplary embodiment, the one-way adder function f(X) is chosen to be simple (commutative) modulo multiplication, that is, f(x) = x mod m, and f(x, y) = x®y = x * y mod m .

Thus, in this case, we get f(x, y) = f(x) * f(y) and:

- 9 040711 μ / μ h f(X) = j”J Xi mod m = ij”J x, 1 mod mi=l \i=l / i.e. f(X) = x10x ₂ ® ...®x _μ , where m is the module and X corresponds to μ digital signatures of μ items in batch X = (x1, ...,x _μ ). Modulo multiplication is a very simple example of a one-way adder (not only quasi-commutative, but also commutative), although not reliable. Thus, in words, the value of the lot B = f(X) is calculated by multiplying all the hash values of the products xi together, and then taking the remainder of this product after dividing by the modulus m. In some cases, this can lead to an impractically large product. For example, suppose there are 1000 items in a batch and each hash value xi is 256 bits long (as obtained using the SHA-256 hash function). It would be possible to do 999 multiplications and store the result, and then divide by m to get the remainder, but this is inconvenient and would require unnecessary computational effort in the form of storing values without truncation. Instead, the system can use the property of modulo operations that the result can be evaluated multiple times, in pairs, as shown in the following pseudocode:

B = 1

For j = 1 to μ

B := [B * x(j)] mod m

Next j.

Thus, the value of B can be calculated without having to multiply more than two hash values before determining the product modulo m.

Of course, any other method can be used to compute f(X) using the modulo m method shown above. A similar algorithm can be used to calculate the verification keys ki - to calculate the key ki, you just need to skip the stage where j=i.

There are several advantages to using the modulo m method to determine the value of lot B and the verification keys. One advantage is that the bit length will not be greater than m, which can be chosen by the user. Moreover, the calculations do not require floating point operations, and therefore there will be no errors due to truncation - it is worth noting that changing one bit in the digital signature of the product will result in a completely different batch value.

The choice of an integer modulus m also reflects a compromise between security and size, both in the number of bits that the security marking 110 can encode, and in the number of items in a lot. To illustrate, consider a very simplified example of a batch that includes only three items having digital signature hash values x1, _x2 , _x3 . Now suppose m > max(x1, x ₂ , x3), then:

x _x mod m \u003d x _b x ₂ mod m \u003d x ₂ , and x ₃ mod m \u003d x ₃

In other words, with this choice of m, there is no protection for individual values of H. On the other hand, except when m is chosen as m >> max(x1, x ₂ , x ₃ ), it is unlikely that the product of any two hashes values modulo m will remain the same value, and it is even less likely that there will be a product of all three. The more items and therefore hash values in a batch, the more the total product will wrap modulo m (have a non-zero divisor) and the more difficult it will be to use a brute force attack to find a fake multiplicand (item hash value) that, multiplied by a known key value will give the same batch value modulo m. As a very simple example, let's say that _xb x ₂ , x ₃ and m are 3, 6, 8 and 10.

mod 10 =3, mod 10 =6, and mod 10 =8 but

B=3x6x8 mod 10=144 mod 10=4

If the verification key for the first item is set to 6x8 mod 10 = 8, and the batch value B = 4, to guess the hash value of 3 items, you still need to guess a set of ten possibilities. The complexity will of course grow as the bit length x _i and m increases. Especially for parties from

- 10 040711 more than ten items or more than 100 items, where m is set to m > maxi(xi), for example, up to the maximum value that can be represented for a given bit length (such as 256 for an implementation that uses hash- SHA-256 function), it would be inefficient for an attacker to attempt to computationally forge a hash value for each signature of a batch of products, especially in implementations where the financial value of each product in the batch is too low to justify attempting such an attack. In other words, using this embodiment, there is no point in trying to forge the information encoded in the marking.

The advantage of choosing m > max(x1, x ₂ , .... x _μ ) is that there is an equivalence property for all hash values (ximod m = xi), but this is not required. Rather, any value may be chosen, particularly to provide the desired bit length for B. It is also not necessary that m be constant across all implementations of the present invention, or even across batches. As one example, an administrator, a manufacturer, etc. can choose different modulus m for different batches. They may be stored in a database, either in the security system 100 or elsewhere, or delivered through some other channel to a user, such as a recipient of the products, so that only that recipient can easily verify the products based on their security markings 110.

To avoid having to maintain module values in the database, one could also calculate m itself for each batch, for example, as a function of hash values x _i . As just one example, m may be chosen as m = [max(x1, x ₂ , .... x _μ )] + 1. Module 120 may then determine the modulus of m before performing other calculations, such as, f(X), ki, and B. Module 120 may also enter a user-selected encoding size (e.g., QR code version) and determine a valid unit (and hence bit size) to ensure that the encoded data (Di, ki ) in the security label will match, that is, the data needed to extract xi = H(Di) and calculate the value of lot B from:

f(Xj® λ ¹ ) = Xj(x) f(Xi) = f(Xi) ® Xj = kj® Хр

The user, the recipient of an article such as _A , for example, can then scan (or otherwise read) with an imaging device the security marking on A ₁ and extract the digital data of the article D1 and the verification key k1 (and any other information that could be encoded in the label). To verify the marked product A1, the user must first extract the verification information V ₁ =(D ₁ , k ₁ ) from the security mark on A ₁ and thus calculate the digital signature x ₁ from the extracted digital product data Dp to perform such an operation, the user must know the one-way function that is used to calculate the digital signature of the product, in this case it is the H() hash function, and then perform the operation x ₁ = H(D ₁ ) to obtain the full data (x ₁ , k ₁ ) required for calculation of the corresponding potential aggregated digital signature B ^c . The user may, for example, securely accept a one-way function (for example, using a public/private key pair) or by requesting it from the product supplier or any other entity that has generated signatures and keys or has already programmed them into the processing unit of the device to form the user's image.

Then, in order to calculate such a potential aggregate digital signature B ^c , the user needs to additionally know the type of one-way adder f() that will be used for this, in this case the user needs to know the modulus m of modulo multiplication (or similar information when using some other function f ). Assuming that the standard module is not used, for example, for all products from the supplier, the user can then accept the module in any known way, either securely (for example, using a public and private key pair), or simply by asking this from the supplier of products or any other entity, who created the verification data or has already programmed it in the user processing unit.

Using the module m, the user can then calculate a potential aggregated digital signature B ^c = k1®x1, which should then be equal to the available (or published) value B: this value may have been previously obtained by the user and/or already stored in the memory of the processing unit of the device for imaging, it can also be a value that the recipient requests and receives from the system administrator in any known manner. By matching the potential B ^c and the available aggregated digital signatures B, this calculation then verifies the information in the security marking 110 and confirms that the product A1 belongs to the correct batch. Security markings are preferably provided and/or applied to the product in any manner that is difficult to copy and/or difficult to remove (tamper proof). In this case, a match of the aggregated digital signatures may indicate to the user that the item is likely to be genuine. This is of particular interest because, in order to authenticate the article A ₁ , it is not necessary to authenticate its material, ie through the intrinsic physical characteristic of the A ₁ or through the material-based security marking applied to the A ₁ .

A link to access the batch value B for the batch corresponding to product A ₁ can be included in the security marking 110 (e.g., a web address if B can be retrieved from the corresponding

- 11 040711 website), although this is not the preferred option.

In some implementations, recipients of item Άι may be able to visually retrieve item data corresponding to digital item data D _b directly from the item. For example, product data may be textual, such as a serial number or text in a descriptive letter, or be some alphanumeric encoding elsewhere on the product or its packaging and be human-readable from the products themselves or anything attached to them or included in them. Recipients of the products may also be provided with suitable software, such as a module in an imaging device such as a smartphone, that either inputs data or reads the data optically through the phone's camera and then calculates xi = H(Di) for the current product. For example, with the security mark 110 on the product Άι, which is a standard QR code, the user can easily obtain digital data by scanning the QR code with an imaging device using a standard QR code reader application running on the imaging device. D1 and k1, the verification application on the user's imaging device can then calculate x1 = H(D1)) and B ^c = f(X) = f(x1® X ¹ ) = x1® f(X ¹ ) = f( X ¹ )®x1 = ^0x1 and also compare this value with the available value of batch B, as described above. For example, if the operator ® corresponds to modulo multiplication, then k1®x1 = (k, * x1) mod m.

Preferably, the aggregated digital signature (i.e. batch value) B is stored in a searchable database of aggregated signatures, which can be accessed (via a communication channel) by the user with his imaging device equipped with a communication device, as is the case with the smartphone example above. The user who needs to verify the product Ά1 can simply send a request from his smartphone to the database address through the database signature collection interface, a request containing the data of the product D1 read on the security mark 110 to Ά1 (or the calculated digital signature x1 = H( D1)), which allows to extract the corresponding value of batch B, and the data collection interface will return the aggregated digital signature B to the smartphone. The database can be secured with a blockchain to enhance the immutability of the stored aggregated signatures. The advantage of the present invention is to establish a link between the physical object, i.e. the original product and its attributes, i.e. the associated product data and its belonging to the product batch, almost invariably through the corresponding aggregated digital signature.

The aforementioned Ai product verification method can also serve to authenticate human-readable product data additionally marked with Ai on the corresponding product data marking affixed to the Ai or printed on the Ai packaging or brochure. Indeed, the user can read on the display of the imaging device the corresponding digital product data D _i as read on the security label on the product A _i and decoded by the imaging device, and visually check whether the displayed information matches the product data on the product data label.

In a preferred embodiment, the product data or its corresponding digital product data Di further includes unique physical signature data of the unique physical characteristic of the marked original product Ai, which can be used for (tangible) authentication of Ai. Thus, with the digital data corresponding to the unique physical characteristic of the product Ai, which is UPCi, the corresponding unique physical signature data UPSi can be obtained by encoding the UPCi (preferably through a one-way function): for example, taking the hash value of the UPCi digital data, i.e. UPSi = H(UPCi). However, any other known encoding can be used instead: for example, to have a short signature, one can use the elliptic curve digital signature algorithm. As a very simplified illustrative example of digital data UPC _i corresponding to the unique physical characteristic of the product Ai, consider a simple digital image obtained by mapping the product Ai (or a specific area to Ai), with the corresponding unique physical signature data UPSi being, for example, a hash value digital image, UPSi = H(UPCi). The UPCi digital data that generated the UPSi signature is the physical characteristic digital control data for Ai, and the resulting UPSi signature is the corresponding physical signature control data for Ai. Preferably, the UPSi, i.e. the physical signature control data for item Ai, is stored in a searchable database or on a blockchain (or a blockchain-secured database) open to users (for example, through a request containing the digital data of item D _i , readable on the security marking A _i , or their corresponding digital signature x _i ). Thus, the saved UPSi becomes immutable. A copy of the UPCi may be further stored in the memory of the device to form an image of the user. In an embodiment, a copy of the UPSi may also be optionally stored in the memory of the user imaging device (to enable an offline verification operation).

- 12 040711

Authenticity verification of the product Ai can be performed by extracting the potential digital data of the unique physical characteristic UPCi ^c from the digital data Di read (in this case by a decoding application running on an imaging device, which may be, for example, a smartphone)) on security marking on the Ai product, and comparing it with the UPCi unique physical characteristic digital control data stored in the memory of the imaging device: if UPCic = UPCi matches, the Ai product is considered genuine (its digital content corresponds to the content of the genuine marked original product). If the UPCi unique physical characteristic digital signature data is not stored in the memory of the imaging device, but rather the UPCi unique physical signature verification data is stored in the imaging device memory (with the advantage that it takes up much less memory compared to UPCi), then the authenticity of Ai can still be verified by verifying that the potential unique physical signature data UPSi ^c obtained by computing the hash value of the potential digital unique physical characteristic data UPCi ^c extracted from the digital data Di, i.e. UPSic = H(UPCi ^c ) , match the UPSi unique physical signature control data stored in memory.

The user can further verify the authenticity of the received article A _i still through an off-line process (self-checking), by detecting said unique physical characteristic on A _i , by means of a sensor capable of making such a measurement (in this case, the imaging unit of the imaging device), and deriving potential digital data of the unique physical characteristic UPCi ^c from the detected characteristic (in this case a digital image captured by the imaging device). Thus, the user can compare (through the image processing unit of his imaging device, or visually on the display of the imaging device) received UPCic with a copy of the control UPSi (stored in the memory of the imaging device): in the case of a reasonable match UPCic ® UPCi ( i.e. two digital data agree with some predetermined criterion of deviation or similarity), the product Ai is considered genuine.

Moreover, the user can also additionally calculate the corresponding potential physical signature data from a copy of the UPC _i control stored in the imaging device memory as UPSic = H(UPCi) and compare it with the physical signature control data UPSi stored in the device memory for imaging: in case of a match UPS _i ^c = UPS _i , it is confirmed that the product A _i is genuine with a higher degree of certainty. Moreover, in the case of a match, the digital product data Di associated with Ai, which has been verified as corresponding to the genuine product data as disclosed above, is also authenticated by extracting the corresponding batch B value from the read verification information (Di, ki) on the security marking on Ai. In the preferred mode, a copy of the control physical characteristic digital data UPCi, instead of being stored in the memory of the user imaging device, is part of the digital product data D _i included in the security marking on the product Ai, and can be obtained by reading it on the security marking (using an imaging device). However, in a variant (still compatible with offline verification), a copy of the reference physical characteristic digital data UPCi could instead be included in the product data marking applied to the product A _i (and read by the user's imaging device).

In an embodiment, verification of the authenticity of the product Ai by the user can be performed through an online process: in this case, the control data of the UPCi and/or UPSi is stored in a searchable database open to the user, while the control data related to the product Ai is stored in relation, respectively, to the corresponding digital product data Di (included in the security marking on Ai) or to the corresponding digital signature of the product xi (which can be calculated by the user when extracting the data Di from the security marking through the operation xi = H(Di) and can be requested by sending a query to the database containing, respectively, Di or xi.

Of course, any other known intrinsic physical/chemical property can be used to derive the digital unique physical characteristic UPCi of the item Ai and the corresponding unique physical signature data UPSi. As another illustrative example, a two-dimensional barcode can be printed forming a security mark 110 on an original product using a security ink containing a luminescent pigment having a characteristic decay time constant, as well as a light excitation wavelength window and a luminescent emission wavelength window: as a result the ink has a certain reference decay time τ, which serves as a fingerprint of the ink material. It is sufficient to illuminate the security marking 110 with excitation light in the illumination wavelength window spanning the excitation wavelength window.

- 13 040711 pigment, and collect the resulting luminescent light from the security mark with a sensor configured to detect light intensity within a window of the luminescent emission wavelength to authenticate the security mark. For example, the user imaging apparatus may be equipped with a flash capable of delivering excitation light to the security mark, a photodiode capable of collecting an appropriate luminescent light intensity profile I(t) (during the detection time interval) from the security mark, and a CPU an imaging device programmed to calculate a decay time value based on the obtained intensity profile I(t). For example, the excitation wavelength window may be in the UV (ultraviolet) range and the emission wavelength window in the IR (infrared) range. If, during product verification, the intensity of fluorescent light collected by the user's imaging device shows a characteristic decay over time corresponding to the potential decay time t _c , then the ink and hence the security marking are considered authentic if t _c ^ τ (within the given range deviations). In this case, the UPC digital data of the tagged article Ai includes at least a decay time reference value τ (and possibly data related to the excitation wavelength window and the emission wavelength window). As can be seen from the above examples, the technical result of including the unique physical characteristic digital control data in the security marking verification information is to provide a tamper-proof connection between the digital data of the product and the authentication data of this particular product.

Instead of the product modulo m in the above illustrative example, any other known (commutative or quasi-commutative) one-way adder (with its corresponding ® operator) can be used. For example, a quasi-commutative one-way adder defined by f(x) = f(I; x) = I ^x mod m (that is, exponentiation modulo m) or the equivalent symbolic representation of the operator Yux, where I is a given number (an integer ), and m is the given modulus. Thus f(x, y) = f(I; x, y) = f(f(I; x), y) = f(I; x) ® y = (I ^x mod m) ^y mod m = I ^x * ^y mod m = I ® x * y. Aggregated digital signature B for batch μ of items A1, A2 .... Α _μ (which may include virtual items) whose respective item digital data is D1, D2 .... D _μ , with corresponding item-related digital signatures x1 , x ₂ .... x _μ , calculate for X \u003d (x1, x ₂ ... .xD, as B \u003d f (I; X), that is:

В = f(f(f(...f(f(f(I,xO,x ₂ ),x ₃ y which can be reduced, based on the quasi-commutativity of f, to:

B = f(X) = f(I;X) = (ΐΠ ^χ ί) mod m = I ®P*b where P x _i denotes the product from i=1 to ϊ=μ of the digital signature components x1, _x2 ... x _μ X, i.e. nxi = x1 * x 2 * ... * x _μ . Indeed, the quasi-commutativity of this one-way adder allows us to write (for all I and all x, y): f(f(I;x),y) = f(f(I;y),x), where the above result the advantage is that the verification step does not require additional information about the ordering of signatures x _i .

Calculate the digital signatures of products x _i , as disclosed above, by means of any known one-way function. Preferably, the digital signature x _i is obtained by a hash function of the corresponding digital product data Di: xi = H(Di) (for the above reasons).

The verification key kj, corresponding to the digital signature xi of digital data Dj of product Aj from batch □ of products, is calculated as follows: kj = I(nxi/xj)mod m, where (P xi/xj) = x1 * x ₂ * ... * x _jx * x _j+1 ... * x _μ , or where the symbolic designation is kj = I ® x1 * x ₂ * ... * x _jx * x _j+1 ... * x _μ .

If the designation X ^j = (x1 * x2 * ... * Xj-1 * Xj+1 ... * xμ), get a more compact formula kj- = f(X ^j ), where (П xi/x ) = x1 * x2 * ... * xj-1 * xj+i ... * xμ is the product of the components of X ^j .

Therefore, for the operation of checking the actual correspondence of the digital data of the product Dj and the verification key kj from the security marking of the product Aj to the data of the genuine product belonging to the batch that has the value of batch B, it is only necessary to calculate the digital signature of the product xj in the form xj = H(Dj), and then verifying that xj and kj extract the aggregated digital signature B by:

kj ⁿ mod m = kj ^Xj mod m = B (or kj ® Xj = B) .

Preferably, the (integer) modulus m is chosen to be at least 2048 bits in size to provide good resistance against cryptanalytic attacks.

The above exponentiation operator (and all of its well-known variants, such as the Naccache operator f(x) = I ^x C ^x-1 mod m, for example, for any given numbers I and C) is just another example of a one-way adder given here for illustrative non-limiting purposes.

- 14 040711

Another exemplary embodiment of the present invention relates to a batch of biometric identification documents, such as biometric passports, as shown in FIG. 2.

This example still uses the hash function as a one-way function for signing the passport data, preferably the SHA-256 hash function due to its well-known reliability. Indeed, given a given batch size, the hash function that is chosen (having a known list of segments) to sign the passport data is thus an example of a one-way encryption function such that each individual passport has a separate passport signature, making the signature unique. The domain of a hash function (i.e. the set of possible keys) is larger than its range (i.e. the number of different table indexes), it will map multiple different keys to the same index, which can lead to conflicts: such conflicts can be avoided when the batch size is known, either by looking at the list of segments associated with the hash table of the hash function and keeping only the function that yields zero collisions, or by independently choosing a hash table conflict resolution scheme (such as coalesced hashing, cuckoo hashing, or hopscotch hashing ).

In FIG. 2A shows an example of a biometric passport A _b protected by a machine-readable security marking 210 (in this case a QR code), and containing a passport data marking 230 containing normal passport data, i.e. visible printed data such as document title 230a (Passport), a set of biographical Passport holder details 230b: last name (Dow), first name (John), gender (M), date of birth (March 20, 1975), nationality (USA), place of residence (Des Moines), place of birth (Oakland), date 230c issuance (February 24, 2018) and expiration date 230d (February 23, 2020). This passport data may additionally contain some(s) (unique(s)) serial number(s) 235 assigned by the passport issuing authority (in this case 12345).

The passport data further comprises the passport holder's biometric data in the form of data corresponding to the unique physical characteristic (UPC) of the person associated with the passport. A machine-readable representation 230e (eg, alphanumeric) of data characterizing said unique physical characteristic (not shown) corresponding to said biometric data is associated with passport data 230. The representation of digital data should be understood in the broadest sense of the term: for this representation of data, it is only necessary to ensure that the original digital data is retrieved. The machine-readable representation 230e of the data, ie, biometric data, of a unique physical characteristic, may correspond to, for example, fingerprint identification or iris identification of the passport holder. For example, the biometric data 230e corresponding to a human fingerprint may be the result of analysis of a set of specific small features of the fingerprint protrusions, such as ridge termination, bifurcation, and short ridges (according to the traditional Henry classification system).

Thus, for a given passport Aj from a batch μ of delivered biometric passports, in this case where μ = 1024, the associated digital data Dj of the passport includes the digital data corresponding to the above data 230a-230e. Preferably, the additional digital data of the passport is associated with the aforementioned data 230 of the passport. For example, a digital image of a passport holder's fingerprint pattern or a digital identity photograph, etc. In an embodiment, this additional digital passport data is stored in a searchable infobase 250, which can be searched with a request for information, containing some passport data (for example, the name of the holder, or biometric data, or data from a security marking, or a unique serial number 235) in order to extract the corresponding fingerprint pattern data and receive it back. Preferably, a link to the infobase 250 is included in the information access marking 240 on the passport: in this case, it is a QR code containing a reference index to retrieve the corresponding additional data in the infobase 250. However, in a variant of a passport control operation involving access to a remote information database (online operation), the QR code may contain, for example, the URL of an information database accessible via the Internet.

The digital signature with the one-way hash function of the digital data of the passport Dj corresponding to the data 230a-230e of the passport Aj is then computed by e.g. . In the same way, the digital signatures of all passports in a batch for all different holders are calculated.

Based on all passport signatures in the lot, the aggregated digital signature B is calculated using a one-way adder. For example, in this embodiment, the aggregate signature for a batch is obtained by means of the aforementioned one-way adder of exponentiation modulo m, defined by f(x) = I ^x mod m, where I is a given integer and m is the modulus. Thus, the aggregated digital signature B for a batch μ of biometric passports A1, A2 .... A _μ (which may include virtual passports) whose corresponding digital passport data is D1, D2 .... D _μ , and associated with passports with digital signatures x1 = H(D1), x ₂ = H(D2), ..., x _μ = H(Dn), calculate for X = (x1, x ₂ , ..., χ _μ ), as;

B = f(X) = (Г ^x i) mod m, where nxi denotes the product from i=1 to ί=μ of the digital signatures of the passport x1, x ₂ , x _μ , i.e. nXi = x1 * x ₂ * .. * x _μ , and the modulus size m is chosen to be, for example, 2048 bits. As described above, with the notation Xj = (x1, x ₂ , ... * Xj-1, Xj ₊₁ , ..., xD, the verification key kj for the passport Aj is calculated as a partial one-way adder kj = f(X ^j ), and the verification information (Dj, Kj) is included in the security marking 210 applied to the passport Aj. For the operation of verifying whether the digital data of the passport Dj and the verification key kj of the biometric passport Aj actually correspond to the data of a genuine biometric passport belonging to a lot of biometric passports having a lot value B, it is only necessary to calculate the digital signature of the passport Xj = H(Dj) and verify that Xj and the verification key kj provide the extraction of the available corresponding value of lot B by: kj ^Xj mod m = B (or kjCxj = B). The passport protected according to the present invention provides both a tamper-proof link between personal data and the biometric data of its holder, and a unique and tamper-proof link between have the natural person of the owner and the identity of the owner.

In FIG. 2B illustrates the control process of the secure biometric passport A1 according to FIG. 2A, in which the passport data marking 230 corresponds to a specific John Doe, the passport biometric data 230e corresponds to John Doe's fingerprint, and the additional passport digital data corresponds to a digital photograph of John Doe's identity 255 that is accessible by reference to the information database 250 included in the marking 240. on access to information. The passport data additionally contains a unique serial number 235 assigned by the passport issuing authority. The security marking 210 applied to the passport contains verification information (D1, k1) in which the digital data of the passport D _x corresponds to the printed data 230a-230d of the passport, the biometric data 230e and the unique serial number 235, and the verification key k1 corresponds to f(X1 ), with the notation X ¹ = (x ₂ , ..., x ₁₀₂₄ ), xi = H(Di) i = 2, ..., 1024 and f is exponentiation modulo m (with given values of integers I and m). Batch value B is obtained from all digital signatures of the passport (x _1; ,x ₁₀₂₄ ) as B = f(X), where (X = x1, ..., x1024) The calculated aggregated digital signature B can be additionally assigned a temporary the tag and store it on the blockchain 260. In this example, the biometric data 230e of the respective batch biometric passport holders is also stored on the blockchain 260 in association with their respective unique serial numbers, respectively (to ensure that the data is immutable). The stored biometric data of John Doe can be retrieved by sending a request to blockchain 260 with the unique 235 serial number found on his passport. Authorities responsible for controlling people's identities (e.g., police, customs, etc.) can access the blockchain 260 via a communication channel and in this exemplary embodiment also have local repositories to store the (published) aggregated digital signatures of all delivered shipments biometric passports. In the example shown in FIG. 2B, the infobase 250 is local (i.e., directly available to authorities, without the need for a public communications network). In addition, these organs are equipped with fingerprint scanners 270 for capturing human fingerprints and calculating corresponding machine-readable representations of data indicative of the captured fingerprints, ie biometric data 230e.

During the verification of the identity of John Doe by, say, a police or customs officer, the officer takes John Doe's secure biometric passport A ₁ , reads and decodes the verification information (D1, k1) stored in the security marking 210 on the passport, through a suitable portable reader 280, connected to a computer 290 (forming an imaging device), while the computer is connected to local storages 250. After reading the digital data of the passport D1 and the verification key k1 and sending them to the computer 290, a certain application (with a programmed hash function H and a one-way adder ) running on computer 290 calculates the digital signature of the x1 passport (as x1 =H(D1)) and the potential lot value B ^c as kj ^X1 modm = B ^c . The computer can then, for example, search the local infodatabase 250 for the value of lot B corresponding to the value B ^c : if not, the passport is fake and John Doe (i.e., the person being verified who claims to be John Doe) can be arrested. In the event that B ^c matches some stored value of batch B, the passport is considered authentic and the employee can perform additional security checks: the employee retrieves the digital photograph 255 of the person stored in the information database 250 by sending a request through the computer 290 containing the serial number 235, printed on A1, takes it back and displays the received photo of 255 personality on the computer screen

- 16 040711

290: The employee can then visually compare the displayed face (i.e. John Doe's face) with the face of the person being tested and judge whether the two faces are similar or not; and the employee retrieves the biometric data 230e in the passport A ₁ by reading the data on the security marking 210 with the handheld reader 280 connected to the computer 290 and scans the person's fingerprint with the fingerprint scanner 270 connected to the computer 290 and obtains the biometric data of the respective person: the employee then checks, through a program running on the computer 290, whether the extracted biometric data 230e is similar (within a predetermined error) to the obtained human biometric data.

If the two faces and biometrics are considered the same, everything is fine, and the person being checked is indeed John Doe, the owner of a genuine A1 biometric passport.

Should any of the above additional security checks fail, it is clear that the person in front of the employee is not the true owner of a genuine A1 biometric passport and has likely stolen the passport of one John Doe. Thus, with the secure biometric passport of the present invention, a simple offline check can quickly detect any fraud.

In fact, it is even possible to reduce a biometric passport document to a simple piece of paper with a simply printed 2D barcode (as in the above QR code example) including verification information V = (D, k): with V containing the holder's biographical data and ( unique) biometric data such as the holder's fingerprint (in the digital data D of the passport) and the verification key. In fact, according to the present invention, even this reduced security passport has the full advantage of the aforementioned tamper-proof link created between the personal biographical data and biometric data of the passport holder and the unique and tamper-proof link between the holder's individual and the holder's identity.

Another exemplary embodiment of the present invention relates to aircraft components as shown in FIG. 3. Due to the very high cost of some critical components, the failure of which may affect the safety of the aircraft, such as some parts of the reactors (for example, turbine blades, pumps, etc.) or landing gear, or batteries, etc., counterfeiters are interested in producing copies of these components, but, of course, without meeting the necessary technical security requirements due to their usually lower quality. Even if an aircraft component is usually marked with an appropriate unique serial number to identify it, this kind of marking can be easily counterfeited. These fake aircraft parts are usually defective and can cause serious damage or even a plane crash. This is a growing security issue today. Moreover, even if the components are genuine, they may not be suitable for certain versions of the same type of aircraft, and there is a serious risk that an unsuitable component will be accidentally used, for example, to repair a given aircraft. Thus, it is important to provide at least critical genuine components that are approved for a given aircraft.

Typically, each component has an associated data sheet that lists, for example, the technical name of the component, a unique serial number for the component, the name of the component manufacturer, the date of manufacture of the component, and certification information. Moreover, for a given aircraft, the corresponding record contains all data sheets of its respective components. However, counterfeit components may have a corresponding counterfeit data sheet and therefore it is not obvious (unless, for example, technical tests are carried out) to detect fraud. For example, how can you be sure that the technical data sheet correctly matches the component installed on a particular aircraft (and vice versa)?

According to an exemplary embodiment of the present invention, authorized parts that will be used for the manufacture or repair of a given aircraft or that are installed on an aircraft are considered to belong to the batch of products for that particular aircraft.

In the specific illustrative embodiment shown in FIG. 3, each aircraft batch item, i.e. each aircraft component authorized for installation or repair on that aircraft, has a corresponding AC-ID aircraft component identification document that contains the same component numeric data as in a regular technical data sheet (for example, an aircraft identification code , aircraft manufacturer name, component technical name, unique component serial number, component manufacturer name, and component manufacture date) along with additional numeric data corresponding to the aircraft identification code, aircraft manufacturer name, date of assembly of the component on the aircraft, name of the person responsible for performing the test compliance, together with the date of the compliance check and the corresponding (unique) digital signature of the verifier. In addition, each aircraft component's AC-ID is protected by a machine-readable security marking applied to it (preferably tamper-proof). Preferably, each time a component or set of components is replaced on an aircraft, corresponding

- 17 040711 AC-ID security documents, and a corresponding updated version of the aircraft batch is created with the above corresponding additional digital data (related to new installation operations).

Thus, all (critical) installed components on a particular aircraft (in this case, given aircraft with identifier HB-SNO) belong to the corresponding installed component lot (in this case, □ components in total). A security mark 310 (in this case a QR code) is printed on each aircraft component identification document, for example, AC-ID: A ₁₂₅ , which is associated with the corresponding aircraft component, in this case A ₁₂₅ , installed on the HB-SNO aircraft. In FIG. 3 specifically shows component A ₁₂₅ of the aircraft package, which is a turbine blade adapted to the type of reactor installed on an HB-SNO aircraft and marked with a unique factory serial number (in this case 12781, usually engraved by the manufacturer). The component digital data D ₁₂₅ (or product digital data) associated with the component A ₁₂₅ includes the digital data corresponding to the data of the data marking 330 printed on AC-ID:A125: aircraft identification code 330a (in this case HBSNO), manufacturer name 330b aircraft (in this case AeroABC), technical name 330c of the component (in this case turbine blade - ^1st ring), serial number 330d of the component (in this case 12781), name 330e of the component manufacturer (in this case PCX), date of manufacture of the component 330f (in this case November 13, 2017), the date of assembly of the component at the 330g reactor (in this case February 24, 2018), the name of the person responsible for performing the 330h conformance check (in this case Martin White), along with the date of the check 330i match (in this case March 20, 2018) and the (unique) digital signature of the verifier 330j (in this case 2w9s02u).

The digital signature of component x ₁₂₅ of digital data D ₁₂₅ AC-ID: A ₁₂₅ of component A ₁₂₅ is calculated by means of a one-way hash function H of the form x ₁₂₅ = H(D ₁₂₅ ). In the same way, all digital signatures of component x _i of digital data Dj of component A _i are calculated by means of a one-way hash function H in the form xi = H(D _j ) (in this case i = 1,..., □). Let X correspond to the entire set of digital signatures of the components X = (x1, x ₂ , ..., x _c ), and let X ^j correspond to the entire set of digital signatures of the components, except for the signature xi, i.e. X ^j = (x1, x2, ... * x _j - ₁ , x _j+1 , ..., Χ _μ ). As already disclosed, the aggregated digital signature B for a batch μ of aircraft components A1, ..., A _μ is calculated by a one-way adder f as B = f(X). The aggregated digital signature is then stored in a searchable database (preferably a blockchain) open to those responsible for monitoring or replacing installed components.

For a given component A _j of a batch, the corresponding verification key k _j is calculated by means of the corresponding partial one-way adder as k _j = f(X ^j ). For each component A of the HB-SNO aircraft, the associated component digital data Dj and the corresponding verification key kj are embedded in the security markings affixed to the relevant aircraft component identification document AC-ID: Ai. For example, in the case of a component inspection operation on an HB-SNO aircraft, the technician may send a query to a searchable database containing the serial number 12781 of the component readable on the AC-ID: A125 of the A125 component to be inspected, or its verification key k125 readable on security mark 310 on the corresponding document AC-ID: A125 with a suitable reader, and will take back the corresponding batch B value. relating to aircraft subject to control. In this last option, the technician can then check if the component is genuine by reading the digital data of the D125 component on the security marking 310, checking that the unique serial number 330d (in this case 12781) retrieved from the D125 matches the serial number physically stamped on the installed aircraft component A125, calculating the corresponding digital signature of the x125 component (for example, by running a programmed application on the computer CPU that calculates the signature x125 = H(D125) from the read digital data D125), calculating the potential value of batch B ^c by means of a one-way adder function programmed on Computer CPU, specified as B ^c = k125®x ₁₂₅ (O operator ® corresponding to a one-way adder f), and checking that the potential value of the B ^c batch matches one of the batch values stored in the computer memory (that is, B corresponding to the HB-SNO aircraft) . In case of a complete match (i.e. match of serial numbers and B ^c = B), component A125 is considered genuine and belongs to the (updated) aircraft lot of authorized HB-SNO aircraft components, in case of B ^c mismatch with the saved value of lot B, or in case If the serial numbers do not match, the A125 component is likely a counterfeit, or is a genuine component not authorized for the HBSNO aircraft (eg A ₁₂₅ is not in the correct batch for this aircraft) and must be replaced.

In the same way, the present invention will detect fraud (or errors) in lots of stocked AC-ID protected spare parts by verifying the authenticity of the security markings on the stored parts and verifying that the serial number of the component from the security marking matches the number marked on the corresponding component. In the case of a highly critical component, the component may additionally have a tamper-resistant material-based security mark applied, while the digital data associated with the relevant control unique physical characteristic UPC (e.g. captured by a suitable sensor when applying the material-based security mark ) of this marking are preferably part of the digital data of the component D in the security marking of this component, and the corresponding control data of the unique physical signature of the UPS is calculated (for example, by taking the hash value of the UPC digital data, i.e. UPS = H(UPC)) and may also be part of the component's digital data. This additional layer of security enhances the protection provided by the unique serial number stamped on the component by its manufacturer. Preferably, the control UPCs and UPSs are stored on the blockchain (to ensure they are immutable) and are available to a specialist. Moreover, these control values can also be additionally stored in the memory of a technician's computer to allow for offline authentication of a material-based security marking on a highly critical component.

A further off-line authentication operation of this material-based security marking may include measuring the unique physical characteristic on the component by means of a suitable sensor connected to the computer and obtaining potential digital data of the UPC ^c unique physical characteristic from the measured characteristic (for example, through a special application programmed into the CPU of its computer). Then the specialist (or the CPU of his computer, if he is programmed accordingly) compares the obtained UPC ^c with a copy of the control UPC stored in the computer's memory: in the case of a reasonable match UPC ^c ® UPC (that is, within some predetermined criterion of acceptable errors) security marking based on the material and therefore the component are considered genuine.

As mentioned above, a copy of the UPC physical characteristic digital data, instead of being stored in the technician's computer memory, is part of the product digital data D included in the security marking affixed to the component and can be obtained by directly reading the security marking (from using a reader). Then the specialist can read the potential UPC ^c on the security marking and check the match of the UPS signature stored in the computer memory with the potential signature UPS ^c calculated from the read potential UPC ^c by calculating UPS ^c = H(UPC ^c ): in case of a match, UPS ^c = UPS certifies that the security marking based on the material and thus the component is genuine.

In an embodiment, verification of the authenticity of a component by a specialist may alternatively be performed via an online process similar to that already disclosed in the first detailed embodiment of the present invention and will not be repeated here.

According to the present invention, it is further possible to verify the correspondence of a digital image of a security document, such as an aircraft component identification document AC-ID: Ai ₂₅ , for example, with respect to the original security document. In fact, if the specialist responsible for the control (or repair) operations only has access to a digital image of a secure document, for example by receiving an AC-ID: A ₁₂₅ image on his reader (which could be, for example, a smartphone programmed in a suitable ), it can still verify that the component data printed on the received document image matches the original document data by performing the following operations: reading component digital data D ₁₂₅ and verification key k ₁₂₅ in the security mark image 310 on the digital document image AC- ID: A ₁₂₅ ; obtaining control value In the batch corresponding to the document AC-ID: A ₁₂₅ ; this control value may already be in the memory of the reader (or a computer connected to the reader) or it can be obtained via a communication channel from a database storing control values of a batch of aircraft components, if the reader is equipped with a communication unit, by sending a request containing, for example, ( unique) the serial number of the component or simply the key k ₁₂₅ read on the image of the security mark 310, and receiving back the corresponding control value of lot B; calculating (using the programmed one-way function H) the digital signature of component x ₁₂₅ from the read digital data of component D ₁₂₅ , with x ₁₂₅ = H(D ₁₂₅ ); calculation of the potential value of the batch (via the programmed one-way totalizer and its corresponding operator ®) B ^c with B ^c = ^ ₂₅ ®χι ₂₅ ; and verifying that the potential value of lot B ^c matches the control value of lot B.

The aforementioned conformity verification operations can also be carried out on a plain photocopy of the original AC-ID ₁₂₅ document: indeed, even if the copy protection feature were on the security marking of the original document, which would show that the specialist had only a photocopy, he could nevertheless read the data on the security markings on the photocopy and perform the above operations to verify the conformity of the data read on the copy with respect to

- 19 040711 but original data.

Another exemplary embodiment of the present invention relates to the self-secure serialization of pharmaceutical products such as drug packages as shown in FIG. 4. This embodiment refers to a production batch of drug packs of this type of drug containing □ boxes (or products) A1,A2 ....Ά _μ . In this illustrative example of the typical box A1 shown in FIG. 4, patient tablets are packaged in a set of serial blister packs 401 (only one shown) contained in box Ά1. Each blister pack 401 is labeled with a unique serial number 435 (in this case 12345 applied by the manufacturer) and the box Ά1 is printed with the usual information such as drug name 430a, logo 430b, unique box serial number (box ID) 430c, expiration date 430d . In this example, additional usual data may be printed on the box (or alternatively on the package insert included in box A1): suggested retail price 430e, country of sale 430f, and indication of 430g sales restriction (for example, sold only in a pharmacy ). The Ά ₁ box is protected by a machine-readable security marking 410 in the form of a printed 2D barcode (or data matrix) and is further protected by a material-based security marking in the form of a separate tamper-proof copy protection adhesive stamp 415, including randomly dispersed particles, which printed on box A1. It is known that the (random and therefore unique) positions of the particles on the stamp constitute the unique physical characteristic of the stamp 415 applied to the box A1 and thus in this case also the unique physical characteristic of the box A1 itself. The detected positions of the dispersed particles on the die 415 are typically used to calculate the corresponding control numeric data for the UPC-A1 unique physical characteristic of the A1 box. Typically, the detection of dispersed particles and their positions is carried out by processing a digital image of the stamp. In this case, the particles can be detected when the stamp is illuminated with a simple white flash (for example, a white LED), such as a smartphone flash. Preferably, a dedicated image processing application can be downloaded to a smartphone so that it can display the stamp 415, detect the positions of the dispersed particles, and calculate the corresponding UPC digital data from these positions.

According to the present invention, the barcode 410 of the box Ά, (i e {1,..., □}) of the batch contains the numerical data of the box Di, corresponding to the digital representation of the above-mentioned conventional data 430a-430g of the box Ai, corresponding to the serial numbers 435 of the blister packs 401, contained in the box Ai, and control digital data of the UPC-Ai unique physical characteristic of the box Ai. For each batch box Ai, the box-associated digital signature xi of its box digital data Di is computed by means of a one-way hash function H of the form xi = H(Di), i = 1,..., □. Let X denote the set of all digital signatures of the batch boxes, X = (xi,..., x _μ ) and Xi be the set of all digital signatures of the boxes, except for the signature xi, i.e. Xi = (x1, x ₂ , ... * xi-1, x _i+1 , ..., Χ _μ ). The reference aggregate digital signature B for all boxes of the lot is then calculated by the one-way adder f (and its corresponding operator O) as B=f(X).

For example, a one-way adder f could correspond to the above operator O, indicating (not only quasi-commutative, but also commutative) modular multiplication modulo m (that is, a O b = a*b mod m) with f(x) = x mod m and:

f(X) = 1(1(1(...1(1(1^)^2)^ = ^0xr0x3® ...0χ _μ ) =

1^)01^2)01^)0 ... ®ί(Xμ) = (x imod m) * (x ₂ mod m) * ... * (x _M mod m) = x ₁ *x ₂ * ...*x _M mod m = x ^x ₂ ® ... Ox _g , or may correspond to the operator O indicating quasi-commutative exponentiation modulo m (that is, aOb = abmod m), with f(x) = f(I; x) = Ixmod m (I is a given integer) and:

f(X) Ξ f(I; X) = f(f(f(..,f(f(f( _X1 ), _X2 ),X ₃ ).....= 1(1; x ₁ ®x ₂ ®x ₃ ® ®X _μ ) = I® Π ^x i = (I^Q mod m, and Π ^x i = ^χ ι * ^χ 2 * * ^χ μ

The obtained control aggregated digital signature B is then either published in an environment open to the user who needs to verify the validity of the secure drug package Ai, or stored in a searchable database of aggregated signatures open to the user, or stored in the blockchain (or in the database blockchain-protected data) open to the user. For example, a user can send a request containing the serial number 430c read on the security marking 410 on the specified box A _i to a searchable database or blockchain and receive back the corresponding batch B value. signatures (via the Internet, for example) or blockchains

- 20 040711 well can be included in the box data marking 440 (shown as a QR code in FIG. 4) printed on the box Ai. offline (i.e. not having access to remote storage means to obtain B): for example, the user has a reader, such as a smartphone, configured to read and decode the data in the security marking 410 on the Ai box (via a programmed application running on the CPU smartphone) and whose memory stores the control aggregated digital signature B.

For each box Ai. batch μ of drug packages has a corresponding verification key ki calculated by a partial one-way adder f according to the formula ki = f(X9 = f(f(f(... f(f(f(Xi), X ₂ ), X ₃ ), ..., X _μ _ ₂ ), Χμ--^), Χ _μ ).

The digital value of the box Di and its corresponding box verification key ki (together constituting the verification information Vi of the box Ai) are part of the digital data included in the security marking 410 applied to the box A _i .

If the symbol ® denotes the operator associated with the adder f, then in order to verify the authenticity of the secure box A1 according to FIG. 4 belonging to a batch of boxes having a control aggregated digital signature B, it is only necessary to read and decode the digital data of box D ₁ on the security marking 410 on box A ₁ (using a suitable reader, for example, using the aforementioned smartphone having an additional programmed application for calculating the signature using the one-way hash function H and the batch value with the operator ® corresponding to the one-way adder f), calculating the corresponding digital signature of the box x1 using the one-way function H as x1 =H(D1), obtaining the control aggregated digital signature (batch value) B (in this example, the control value of batch B is stored in the reader's memory) and checking whether the received control aggregated digital signature B matches the potential aggregated digital signature B ^c obtained from the read verification information (D1, K1) as k1®x1. If B ^c ^ B, then box A1 is fake. If B ^c = B, then the security marking 410 corresponds to the marking of the genuine box. In this case, you can perform a few additional security checks. For example, using a reader equipped with a display (such as the aforementioned smart phone), any of the information 430a to 430d can be extracted from the read digital data of the box D1, display the extracted information, and visually check that it matches the corresponding information printed on the box A1. If the displayed information does not match what is printed, the box is fake.

Additional authentication of box A ₁ is possible by verifying the authenticity of the security marking 415 based on the material. It is sufficient to determine the positions of the dispersed particles by displaying the stamp 415 (for example, using the aforementioned smartphone capable of image processing) and calculate, based on these positions, the corresponding potential digital data of the unique physical characteristic UPC ^c - A1, and then check the actual similarity of these UPC ^c - A1 (within a given error) with UPC ^c - A1 unique physical characteristic control digital data extracted from the digital data of box D ₁ : if they are similar, then stamp 415, and thus box A ₁ , is authentic, if they are not are similar, then stamp 415, and thus box A ₁ (the stamp is tamper-proof), is counterfeit.

However, in the case of a verified match of the aggregated digital signatures (i.e., B ^c = B), and even if the information 430a-430d has been verified and/or the material-based security marking 415 is genuine, it can be additionally checked whether the blister packs 401 are contained in box A ₁ are correct: it is enough to check the coincidence of the unique serial numbers 435 marked on the blister packs with the numbers indicated by the digital data of the box D ₁ read from the security marking 410. If these data do not match, this is proof of forgery: blister packs original _A1 box packs have been replaced by others (perhaps counterfeit, or a different brand, or matching a different drug). Moreover, still in the case of a genuine box A1 (i.e. with B ^c = B), even if the blister packs 401 are correct, in case any additional information extracted from the digital data of the box D1: MSRP 430e, market country 430f sale and indication 430g of restriction of sale, does not correspond to the existing conditions of sale (for example, if the package of drug A1 is sold in a country other than that indicated by data 430f), the corresponding fraud can be detected. It is also a strong warning that the party itself, or at least part of it, has been redirected.

Thus, both full traceability and control operations and verification of the authenticity of secure drug packages are possible due to the tamper-proof communication provided in accordance with the present invention through an aggregated digital signature.

- 21 040711 between the data of the box, the data of the contained blister packs, the unique characteristics of the physical properties of the box and the blister packs, as well as the belonging of the box to a given lot.

As described above, the present invention is explicitly compatible with offline and local verification operations for verifying the authenticity of a security item or the consistency of data in an image (or copy) of a security item with respect to data associated with the original security item. However, the present invention is also compatible with an online verification process, such as by receiving (via a communication channel) a batch reference value from an external source (such as a server or blockchain), or performing some or all of the calculation steps involving a one-way function or a one-way adder through external computing means (for example, running on a server), or even performing verification of the match of a potential aggregated digital signature with a control aggregated digital signature (and simply obtaining a result).

The foregoing subject matter is to be considered illustrative and not restrictive and serves to better understand the present invention as defined by the independent claims.

Claims (20)

CLAIM 1. A method for protecting a given original product from a batch of a plurality of original products from forgery or falsification, wherein each original product of the batch has its own product data associated with it and the corresponding digital product data, characterized in that the method includes the steps: for each original product of the batch, calculation by means of a one-way function of the digital signature associated with the product of its corresponding digital product data; calculating a control aggregated digital signature corresponding to a batch of original products from all digital signatures of original products of a batch by means of a one-way adder of said digital signatures of products, and providing the user with a control aggregated digital signature; determining the product verification key corresponding to the digital signature of the specified given original product, by means of a partial one-way adder of all other digital signatures of the products used to calculate the control aggregated digital signature, as a result of which the potential digital signature of the product corresponds to the signature of the original product of the batch, in the case of calculating the control aggregated digital signature signatures from the specified potential product digital signature and the corresponding product verification key through a one-way function; and applying to the specified original product an appropriate machine-readable security marking, including the presentation of digital data associated with the product and its corresponding product verification key, thereby obtaining a marked original product, the product data of which is protected from counterfeiting or falsification. 2. The method according to claim 1, characterized in that the control aggregated digital signature associated with the batch of original products is either published in an environment open to the user, or stored in a searchable database of aggregated signatures open to the user, or stored in blockchain, or in a database protected by the blockchain, open to the user. 3. The method according to claim 2, characterized in that the marked original product additionally contains data on access to aggregated signatures, marked on it and containing information sufficient to gain access to the control aggregated digital signature corresponding to the batch of original products, while the specified information represents a link to the interface for collecting aggregated signatures, respectively, one of the following: an environment in which a control aggregated digital signature is published, wherein the environment is open to the user through said aggregated signature collection interface configured to receive from the user an aggregated signature request containing product data or a digital signature of said product data obtained from the security marking of the marked original product, and sending back the control aggregated digital signature of the associated lot; a searchable aggregated signature database in which a control aggregated digital signature is stored, wherein the aggregated signature database is open to the user via a specified aggregated signature collection interface configured to receive an aggregated signature request from the user containing product data or a digital signature specified product data, obtained from the security marking of the marked original product, and sending back the control aggregated digital signature of the associated batch; - 22 040711 blockchain, respectively, the database protected by the blockchain, in which the aggregated digital signature with a timestamp is stored, while the blockchain, respectively, the database protected by the blockchain, is open to the user through the specified interface for collecting aggregated signatures, configured to receive from the user of a request for an aggregated signature containing product data or a digital signature of said product data obtained from the security marking of the marked original product, and sending back the control aggregated digital signature of the associated lot. 4. The method according to any one of claims 1 to 3, characterized in that the virtual product is included in a batch of original products, while said virtual product has data associated with the virtual product and its corresponding virtual product digital data, as well as a digital product associated with the virtual product. a signature obtained by means of a one-way function, wherein said virtual item is not created, but only used to generate a digital signature associated with the virtual item from the corresponding digital data of the virtual item; and the control aggregated digital signature associated with the specified batch of original products is calculated from all digital signatures of the original products of the batch, including the digital signature of the virtual product, by means of a one-way adder. 5. The method according to any one of claims 1 to 4, characterized in that the one-way function is a hash function, and the digital signature of the original product is a sequence of a given set of bits with lower bit values selected from the bits of the hash value of the corresponding digital data of the product . 6. The method according to any one of claims 1 to 5, characterized in that the additional digital product data corresponding to the product data associated with the marked original product is stored in a searchable information database open to the user through an information database interface, configured to receive from the user a request for information containing product data or the corresponding digital signature data obtained from the security marking of the marked original product, and send back the corresponding additional digital product data. 7. The method according to any one of claims 1 to 6, characterized in that the marked original product additionally contains the corresponding product data marking applied to it, while said product data marking includes the corresponding product data associated with the specified marked original product. 8. The method according to any one of claims 1 to 7, wherein the digital data of the marked original product includes a reference UPC physical characteristic digital data of the corresponding unique physical characteristic of the marked original product or an associated object or person. 9. The method according to claim 8, characterized in that the unique physical characteristic of the marked original product is a characteristic of a material-based security marking applied to the original product. 10. A method for verifying the authenticity of a product protected according to the method according to any one of claims 1 to 9, or the correspondence of a copy of such a protected product with respect to the original product, characterized in that the method includes the steps of considering a test object that is a specified product or a specified copy of the product : obtaining a digital image of the security mark on the test object by means of an imaging apparatus having an imaging unit, a CPU with a memory, and an image processing unit; reading an article digital data representation and an article-related verification key in the received digital image of the security marking on the test object, and extracting, respectively, the respective article digital data and article verification key from said read representation; storing in memory the control aggregated digital signature of the corresponding batch of products and programming in the CPU of a one-way function and a one-way adder; verification of the actual correspondence of the extracted digital data of the product and the verification key associated with the product of the stored control aggregated digital signature by performing the following steps: calculating a digital signature of the extracted digital product data using a one-way function; calculating a potential aggregated digital signature from the calculated digital signature of the extracted product digital data and the extracted product verification key using a one-way adder; and checking the match of the received potential aggregated digital signature with the stored control aggregated digital signature, as a result of which, if the specified aggregated digital signatures match, the product data on the test object is the data of a genuine - 23 040711 original product. 11. The method according to claim 10, characterized in that the product is protected by storing a control aggregated digital signature associated with a batch of original products in a searchable database of aggregated signatures open to the user, according to the method according to claim 2, and a device for image forming is additionally equipped with a communication unit configured to send and receive data back via a communication channel, the method comprising the steps of: sending by the communication unit via a communication channel a request to the specified database of aggregated signatures and receiving back a control aggregated digital signature associated with a batch of original products; and storing the received aggregated digital signature in the memory of the imaging device, which precedes the steps of claim 10. 12. The method according to claim 10, characterized in that the product is protected according to the method according to claim 3, and the image forming device is additionally equipped with a communication unit configured to send and receive back data via a communication channel, the method including the steps: reading the aggregated signature access data tagged on the test object with the imaging device; sending by the communication unit via a communication channel a request for an aggregated signature to a specified interface for collecting aggregated signatures containing product data or a digital signature of said product data obtained from a security mark on the test object, and receiving back the corresponding control aggregated digital signature of the associated batch; and storing the received aggregated digital signature in the memory of the imaging device, which precedes the steps of claim 10. 13. The method according to any one of claims 10-12, characterized in that the product is protected according to the method according to claim 6, and the image forming device is additionally equipped with communication means configured to send an information request containing data to the information database interface product or the corresponding digital signature data obtained from the security marking on the test product, and receiving back the corresponding additional digital product data. 14. The method according to any one of claims 10-13, characterized in that the product is protected according to the method according to claim 7, while the method includes additional steps: reading the product data marked on the product data marking on the test object with the imaging apparatus; and verifying that the product data read from the product data marking matches the digital product data extracted from the security marking on the test object. 15. The method according to any one of claims 10 to 14, characterized in that the product is protected according to the method according to any one of claims 8 and 9, and the imaging device is additionally equipped with a sensor configured to detect a unique physical characteristic of the marked original product or associated object or person, and the CPU is programmed to extract the corresponding unique physical characteristic digital data from the detection signal received from the sensor, the imaging device stores in memory the reference UPC physical characteristic digital data corresponding to the specified unique physical characteristic of the marked original product or associated object or person , wherein the method includes additional steps, when considering a subject that is the specified product or the specified associated object or person: detecting with the sensor a unique physical characteristic of the subject and extracting corresponding potential digital data of the unique physical characteristic UPC ^c ; comparing the obtained UPC unique physical characteristic ^c potential digital data with the stored reference UPC physical characteristic digital data; and if the potential digital data of the UPC unique physical characteristic ^c is similar to the stored control physical characteristic digital data of the UPC, subject to a predetermined tolerance criterion, the subject is considered genuine. 16. A branded product belonging to a batch of a plurality of original products and protected from forgery or falsification according to the method according to any one of claims 1 to 9, while each original product of the batch has its own product data associated with it and the corresponding digital product data, the specified batch has the corresponding control aggregated digital signature, while the product contains: a machine-readable security marking applied to it and including the presentation of digital data associated with the product and the corresponding product verification key. 17. A branded product according to claim 16, wherein the digital data of the labeled product includes a reference UPC physical characteristic digital data of the corresponding unique physical characteristic of the labeled product or associated object or person. 18. Marked product according to claim 17, characterized in that the unique physical characteristic - 24 040711 marked product is a characteristic of a material-based security marking applied to a marked product. 19. A system for verifying the authenticity of a marked original product protected according to the method according to any one of claims 1 to 9, or the correspondence of a copy of such an product with respect to the original product, while the system contains an image forming device having an image forming unit, a CPU with memory and a processing unit image, while the memory stores the control aggregated digital signature of the corresponding batch of products and one-way function and one-way adder programmed in the CPU, while the system is configured to: obtaining a digital image of the security marking on the test object, which is the specified product or the specified copy of the product; reading an article digital data representation and an article-related verification key in the obtained digital image of the security marking on the test object, and extracting corresponding article digital data and the article verification key from said read representation, respectively; verification of the actual correspondence of the extracted digital product data and the associated verification key of the stored control aggregated digital signature by performing additional programmed steps on the CPU: calculating a digital signature of the extracted digital product data using a one-way function; calculating a potential aggregated digital signature from the calculated digital signature of the extracted product digital data and the extracted verification key using a one-way adder; and checking that the received potential aggregated digital signature matches the stored control aggregated digital signature, whereby, if said aggregated digital signatures match, the system is configured to deliver an indication that the product data in the test object is genuine original product data. 20. The system according to claim 19 for verifying an article protected according to the method according to any one of claims 8 and 9, characterized in that the imaging device is additionally equipped with a sensor configured to detect a unique physical characteristic of the marked original article or associated object or person , and the CPU is programmed to extract the corresponding unique physical characteristic digital data from the detection signal received from the sensor, wherein the imaging device stores in memory the UPC control physical characteristic digital data corresponding to the specified unique physical characteristic of the marked original product or associated object or person, wherein the system is additionally configured to: detecting with the sensor a unique physical characteristic of a subject that is said article or said associated object or person, and extracting corresponding potential digital data of the unique physical characteristic UPC ^c ; comparing the obtained UPC unique physical characteristic ^c potential digital data with the stored reference UPC physical characteristic digital data; and if the UPC unique physical characteristic ^c potential digital data is similar to the stored UPC control physical characteristic digital data, subject to a predetermined tolerance criterion, delivering an indication that the subject is considered genuine.