EA040918B1 - PROTECTION OF THE PRODUCT FROM FORGERY - Google Patents

Description

The field of technology to which the invention belongs

The present invention relates to the protection of products and data marked on such products from forgery or falsification, as well as the correspondence of digital images of such marked products to original products and the possibility of traceability of products.

State of the art

With regard to mechanical parts, electronic components, pharmaceutical products and a host of other products, the problems of counterfeiting and counterfeiting are well known and serious, and their number is constantly growing. Moreover, the falsification of data associated with the product is also a serious problem. A well-known example is the falsification of data marked on an original printed document, such as an identity document or diploma (product), and the situation is even worse when considering a digital copy or photocopy of the original (possibly genuine) document. Simply keeping track of identifiers such as serial numbers is generally not an adequate solution, as counterfeiters can easily copy such numbers.

There are many other protection schemes for manufacturing products, but they generally do not provide a sufficient level of protection, they have too high administrative overhead in terms of the information that needs to be stored and accessed, they are often impractical to use, except as in well-controlled environments, or they simply cannot be implemented physically. For example, many schemes for digitally securing documents in a verifiable manner are not suitable for use in contexts that involve many physical goods that are impractical or otherwise undesirable to be marked with appropriate signatures.

Another disadvantage of most traditional methods for ensuring the authenticity of products or protecting data associated with them is that they tend to view products in isolation, even if they are members of a well-defined group, such as a production batch. This ignores valuable authentication information.

A common way to protect a product is to apply a material-based (possibly tamper-proof) security marking to it, i.e. a mark that has a detectable intrinsic physical or chemical property that is very difficult (if not impossible) to reproduce. If a suitable sensor detects this intrinsic property of the mark, the mark is considered genuine with a high degree of certainty, and hence the corresponding marked product. There are many examples of such well-known authenticating intrinsic properties: the marking may include some particles, perhaps randomly distributed, or have a certain layered structure, having intrinsic properties of optical reflection, or transmission, or absorption, or even emission (for example, luminescence, or polarization, or diffraction, or obstruction, etc.), possibly detectable under certain illumination conditions with light of a certain spectral composition. This intrinsic property may be the result of the special chemical composition of the marking material, for example, luminescent pigments (perhaps not commercially available) may be dispersed in the ink used to print some pattern on the product and used to emit a certain light (for example, in a spectral window in infrared range) when illuminated with a certain light (for example, light in the UV spectral range). This is used, for example, to protect banknotes. Other intrinsic properties may also be used, for example, the luminescent particles in the marking may have a certain decay time of the luminescent emission after illumination with a suitable excitation light pulse. Other types of intrinsic properties are the magnetic property of the particles included, or even the fingerprint property of the product itself, such as, for example, the relative position of initially randomly distributed fibers of the paper backing of a document in a predetermined area on the document, which, when viewed at sufficient resolution, can serve to extract a unique characteristic feature. signature or some random printed data artifacts printed on the product which, when viewed at sufficient magnification, could also result in a unique signature, etc. The main problem associated with the intrinsic fingerprint property of a product is its resistance to aging or wear. However, material-based security markings may not always also protect the data associated with the marked product, for example, even if a document is marked with a material-based security marking, such as a logo printed with security ink in some area of the document, the data printed on the remainder of the document, may be falsified. Moreover, overly complex authentication signatures often require significant storage involving external databases and communication channels for queries against such databases, so that offline authentication of the product is not possible.

Thus, the purpose of the present invention is to protect the product from counterfeiting and falsification of data associated with it and, in particular, data relating to its belonging to a certain batch of products. It is also an object of the present invention to enable offline verification of the authenticity of an object protected according to the present invention and the correspondence of data associated with it to that of a genuine protected object.

Brief description of the invention

According to one aspect, the present invention relates to a method for protecting a given original product belonging to a batch of a plurality of original products from forgery or falsification, wherein each original product has its own product data associated with it and the corresponding digital product data, and the method includes the steps of:

for each original product of the batch, calculation by means of a one-way function of the digital signature associated with the product of its corresponding digital product data;

formation of a tree based on the set of calculated digital signatures of products for the original products of the batch, containing nodes located according to the specified ordering of nodes in the tree, while the specified tree contains levels of nodes, starting from leaf nodes corresponding to the set of digital signatures of products, respectively, associated with the set of original of products in the batch, up to the root node of the tree, each node, other than a leaf node, of the tree corresponds to a digital signature by means of a one-way concatenation function of the corresponding digital signatures of its child nodes according to the order of concatenation of the tree, the root node corresponds to the control root digital signature, i.e. digitally signing by means of a one-way digital signature concatenation function of nodes of the penultimate level of nodes in the tree according to the specified tree concatenation order;

linking with a given original product the corresponding verification key, which is a sequence of corresponding digital signatures, starting from the level of leaf nodes to the penultimate level of nodes, of each other leaf node that has the same parent node in the tree as the leaf node corresponding to the digital signature of the given original product , and sequentially at each next level in the tree, each node other than a leaf having the same parent node in the tree as the previous same parent node considered at the previous level;

providing the user with a control root digital signature of the tree; and applying to a given original product a machine-readable security marking, including the presentation of its corresponding digital product data and its corresponding verification key, thereby obtaining a marked original product, the product data of which is protected from counterfeiting or falsification.

The control root digital signature of the root node of the tree can either be published in an environment open to the user, or stored in a searchable root database, open to the user, or stored on the blockchain, or stored in a blockchain-secured database, open to the user.

Thus, according to the present invention, the interweaving of digital signatures of all items in a batch, thanks to the tree structure and the use of reliable one-way functions to calculate node values, together with the root digital signature of the tree made unchanged, and the inclusion of the digital data of the item and the associated verification key in the security marking , printed on the respective product, allow the tracking and control of tagged products with a very high level of reliability, while preventing data falsification and counterfeiting of tagged products.

The marked original product may additionally contain data on access to the root node, marked on it and containing information sufficient to provide the user with access to the control root digital signature of the root node of the tree corresponding to the batch of original products, while this information is a link to the access interface, made with the ability to receive from the user a root request containing product digital data or a digital signature of product digital data obtained from the security marking of the marked original product, and send back the control root digital signature of the corresponding tree, while the access interface provides access, respectively, to one of the following :

the environment in which the control root digital signature is published;

a searchable root database in which the control root digital signature is stored; and a blockchain or, respectively, a database protected by a blockchain in which a control root digital signature with a timestamp is stored.

According to the present invention, it is also possible that a virtual item is considered to belong to a batch of original items, wherein said virtual item has data associated with the virtual item and its corresponding virtual item digital data, as well as a digital signature associated with the virtual item, obtained through a one-way digital data function virtual item, the specified virtual item is not created, but only used to generate the associated virtual item.

- 2 040918 digital signature product; and the control root digital signature associated with the specified batch of original products is calculated from a tree having all digital signatures of the original products of the batch, including the digital signature of the virtual product, in the form of leaf nodes.

In order to obtain shorter signatures, the one-way function may be a hash function, and the digital signature of the original product may be a sequence of a given set of bits with lower bit values selected from the bits of the hash value of the corresponding digital data of the product.

In the above method, additional digital product data corresponding to the product data associated with the branded original product can be stored in a searchable information database open to the user through an information database interface configured to receive from the user an information request containing digital product data or a digital signature of digital product data obtained from the security marking of the marked original product, and sending back the corresponding additional digital product data. The additional product digital data corresponding to the product digital data associated with the marked original product can optionally be concatenated with said product digital data, whereby the additional product digital data is also protected from forgery or falsification.

Moreover, the branded original product may further comprise a corresponding product data marking applied to it, said product data marking including the corresponding product data associated with said branded original product.

The aforementioned digital data of the marked original product may include the corresponding control characteristic digital data of the unique physical characteristic of the marked original product or an associated object or person. Moreover, the unique physical characteristic of the marked original product may be the characteristic of a material-based security marking applied to the original product or to a related object.

In the above method, the sequence of digital signatures of the verification key included in the security marking of the product may be arranged according to the ordering of the sequence of nodes, which is different from the ordering of the corresponding nodes determined by the ordering of the concatenation of the tree, and the security marking of the product may further include an ordering code associated with the specified ordering of the sequence. .

According to the present invention, in the case of distributing the digital data of the respective original items of a batch between given fields common to all items of the batch, the digital data related to these fields may not be included in the digital data of the item, but may be grouped into a separate field data block associated with the party, and at the same time

i) the digital signature of the original product is calculated using a one-way concatenation function of the corresponding digital data of the product and the digital data of the field data block; and ii) the control root digital signature is made available to the user along with the associated field data block.

Another aspect of the present invention relates to a method for verifying the authenticity of a product or the conformity of a copy of such a product with respect to a marked original product belonging to a batch of original products protected according to the above protection method, the method includes the steps of considering a test object that is a specified product or a specified copy products:

obtaining a digital image of the security mark on the test object by means of an imaging apparatus having an imaging unit, a memory processing unit, and an image processing unit;

reading a digital product data representation and an associated verification key in the received digital image of the security marking on the test object and extracting, respectively, the respective test digital product data and the test verification key from said read representation;

storing in memory the control root digital signature of the root node of the tree of the batch of original products and programming in the one-way function processing unit to calculate the digital signature of the digital data and concatenate the digital signatures according to the order of the nodes in the tree and the order of the concatenation of the tree;

verification of the actual correspondence of the extracted test digital data of the product and the associated test key of verification of the stored control root digital signature by performing the following steps:

calculation using the one-way function of the test digital signature of the extracted test digital data of the product, while the specified test digital signature corresponds to the test

- 3 040918 leaf node in the test tree corresponding to the security marking on the test object;

extracting from the sequence of digital signatures in the test digital signature verification key of each other leaf node of the test tree having the same parent node as the test leaf node, and calculating the digital signature of the concatenation of the test digital signature and the extracted digital signature of said each other leaf node, thereby thereby obtaining a digital signature of said same parent node of the test leaf node;

sequentially at each next level in the test tree and up to the penultimate level of nodes, extracting from the sequence of digital signatures in the test key of verifying the digital signature of each other node, different from the leaf, test tree, which has the same parent node as the previous same parent node, discussed in the previous step, and calculating the digital signature of the concatenation of the digital signature of said respective each other node other than a leaf node and the resulting digital signature of said previous same parent node, thereby obtaining a digital signature of said same parent node of said previous same parent node;

computing a digital signature of the concatenation of the obtained digital signatures of the non-leaf nodes corresponding to the penultimate level of the test tree nodes, thereby obtaining a potential root digital signature of the root node of the test tree; and checking that the received candidate root digital signature matches the stored control root digital signature, whereby, if said root digital signatures match, the product data on the test object is genuine product data.

If the marked original product is protected while having the above separate field data block, the memory of the processing block may additionally store said associated field data block, and the step of calculating the test digital signature corresponding to the test leaf node in the test tree corresponding to the security marking on the test object may include the calculation, using a one-way digital signature function, of the concatenation of the extracted product test digital data and the digital data of the stored field data block.

If the product has been protected by storing the control root digital signature in a searchable root database open to the user, the imaging device is further equipped with a communication unit configured to send and receive back data via a communication channel, the above verification method may include preliminary steps sending by the communication unit through the communication channel a request to the specified root database and receiving back the control root digital signature and storing the received root digital signature in the memory of the image forming device.

If the secure product contains the root access data as disclosed above, and the imaging device is further equipped with a communication unit configured to send and receive data via a communication channel, the above verification method may include the preliminary steps of reading the root access data , marked on the test object, using an imaging device;

sending by the communication unit via the communication channel a root request to the specified access interface containing digital product data or a digital signature of said digital product data obtained from the security marking on the test object, and receiving back the corresponding control root digital signature of the associated batch; and storing the received control root digital signature in the memory of the imaging device.

The secure product may contain additional digital product data as disclosed above, and the imaging device may further be equipped with communication means configured to send to the information database interface a request for information containing the digital product data or the corresponding digital signature data of the product received. from the security marking on the test object, and receiving back the corresponding additional digital product data.

If the secure article contains an article data mark as disclosed above, the method may include the additional steps of reading the article data marked on the article data mark on the test object with an imaging device; and verifying that the product data read from the product data marking matches the digital product data extracted from the security marking on the test object.

Moreover, if the protected product includes characteristic digital control data as disclosed above, and the imaging device is further equipped with a sensor capable of detecting a unique physical characteristic of a suitably marked original product or associated object or person, and the processing unit is programmed in order to extract the corresponding characteristic digital data from the detection signal received from the sensor, the imaging device stores in memory the control characteristic digital data CDD corresponding to the specified unique physical characteristic of the suitably marked original product or associated object or person, the above method may include additional steps, when considering a subject that is a specified article or a specified associated object or person:

detecting with the sensor a unique physical characteristic of the subject and extracting the corresponding potential characteristic digital data CDD ^c ;

comparing the obtained potential characteristic digital data CDD ^c with the stored control characteristic digital data CDD; and if the potential CDD characteristic numeric data ^c is similar to the stored control CDD characteristic numeric data, with the specified tolerance criterion, the subject is considered to correspond, respectively, to a genuine product or an object or person actually associated with a genuine product.

A further aspect of the present invention relates to a method for verifying the conformity of a digital image of a product with respect to a branded original product belonging to a batch of original products protected according to the aforementioned security method, the method comprising the steps of obtaining a digital image of the product showing a security mark on the product by means of an imaging device having an imaging unit, a memory processing unit, and an image processing unit;

reading a product digital data representation and an associated verification key in the received security marking digital image and extracting corresponding product test digital data and an associated test verification key from said read representation, respectively;

storing in memory the control root digital signature of the root node of the tree of the batch of original products and programming in the one-way function processing unit to calculate the digital signature of the digital data and concatenate the digital signatures according to the order of the nodes in the tree and the order of the concatenation of the tree;

verification of the actual correspondence of the extracted test digital data of the product and the test key of verification of the stored control root digital signature by performing the steps of calculating using the one-way function of the test digital signature of the extracted test digital data of the product, while the specified test digital signature corresponds to a test leaf node in the test tree corresponding to the security marking on the test object;

extracting from the sequence of digital signatures in the test digital signature verification key of each other leaf node of the test tree having the same parent node as the test leaf node, and calculating the digital signature of the concatenation of the test digital signature and the extracted digital signature of said each other leaf node, thereby thereby obtaining a digital signature of said same parent node of the test leaf node;

sequentially at each next level in the test tree and up to the penultimate level of nodes, extracting from the sequence of digital signatures in the test key of verifying the digital signature of each other node, different from the leaf, test tree, which has the same parent node as the previous same parent node, discussed in the previous step, and calculating the digital signature of the concatenation of the digital signature of said respective each other node other than a leaf node and the resulting digital signature of said previous same parent node, thereby obtaining a digital signature of said same parent node of said previous same parent node;

computing a digital signature of the concatenation of the obtained digital signatures of the non-leaf nodes corresponding to the penultimate level of the test tree nodes, thereby obtaining a potential root digital signature of the root node of the test tree; and checking that the obtained potential root digital signature matches the stored control root digital signature, whereby, if said root digital signatures match, the digital image of the product is an image of a genuine branded original product.

If a lot of security marked original product has an associated field data block as disclosed above, the memory of the processing unit additionally stores the associated field data block, the step of calculating the test digital signature corresponding to the test leaf node in the test tree corresponding to the security marking on the test object may include calculating

- 5 040918 using a one-way digital signature function of concatenating the extracted product test digital data and the digital data of the stored field data block.

If the original product has been protected by storing a control root digital signature in a searchable root database opened as mentioned above, and the imaging device is further equipped with a communication unit configured to send and receive back data via a communication channel, the method may include the preliminary steps of sending by the communication unit via the communication channel a request to the specified root database and receiving back the control root digital signature; and storing the received root digital signature in the memory of the imaging device.

If the original product contains the root access data as mentioned above, and the imaging device is further equipped with a communication unit configured to send and receive data via a communication channel, the method may include the preliminary steps of reading the root access data marked on a digital image of the product, using an imaging device;

sending by the communication unit via the communication channel a root request to the access interface containing the extracted test digital product data or the calculated test digital signature, and receiving back the control root digital signature of the root node of the batch tree of the original products; and storing the received control root digital signature in the memory of the imaging device.

If the branded original product has additional digital data associated with the product stored in a searchable information database as mentioned above, the imaging device may additionally be equipped with communication means configured to send to the information database interface an information request containing product test digital data or product digital signature test data, and receiving back corresponding additional product digital data.

If the protected original product includes reference characteristic digital data as mentioned above, and the imaging device is additionally equipped with a sensor capable of detecting a unique physical characteristic, respectively, of an object or person associated with the marked original product, and the processing unit is programmed to extract the corresponding characteristic digital data from the detection signal received from the sensor, the imaging device stores in memory the CDD reference characteristic digital data corresponding to said unique physical characteristic of the corresponding associated object or person, the method may include additional steps when considering a subject that is said associated object or person:

detecting with the sensor a unique physical characteristic of the subject and extracting the corresponding potential characteristic digital data CDD ^c ;

comparing the obtained potential characteristic digital data CDD ^c with the stored reference characteristic digital data CDD; and if the potential CDD characteristic numeric data ^c is similar to the stored control CDD characteristic numeric data, with the specified tolerance criterion, the subject is considered to correspond, respectively, to the object or person actually associated with the genuine marked original product.

Another aspect of the present invention relates to a product belonging to a batch of a plurality of original products and protected from forgery or falsification according to the above protection method, while each original product of the batch has its own digital product data and a corresponding verification key, said batch has a corresponding control root digital signature , wherein the product contains a machine-readable security marking applied to the product and including the representation of its digital data of the product and its verification key.

The digital data of the aforementioned product may include CDD control characteristic digital data of the corresponding unique physical characteristic of the product or associated object or person. Moreover, the unique physical characteristic of the article may be the characteristic of a material-based security marking applied to the article.

Another aspect of the present invention relates to a system for verifying the authenticity of a product or the conformity of a copy of such a product with respect to a marked original product belonging to a batch of original products protected by double material and digital protection against counterfeiting or falsification according to the above protection method, while the system contains

- 6 040918 an imaging device having an imaging unit, a processing unit with a memory, and an image processing unit, wherein the memory stores a control root digital signature of a tree corresponding to a batch of original products, and a one-way function for calculating a digital signature of digital data and concatenating digital signatures according to the ordering of the nodes in the tree and the ordering of the concatenation of the tree programmed in the processing unit, said system being capable of obtaining, using the imaging device, a digital image of the security mark on the test object, which is the specified product or the specified copy of the product;

reading, with the imaging apparatus, a representation of the article digital data and the associated verification key in the received digital image of the security mark on the test object, and extracting, respectively, the respective test article digital data and the test verification key from said read representation;

verification of the actual correspondence of the extracted test digital data of the product and the associated verification key of the stored control root digital signature by performing on the processing unit additional programmed calculation steps using the one-way function of the test digital signature from the calculated test digital signature of the extracted test digital data of the product, while the specified test digital signature corresponds to a test leaf node in the test tree corresponding to a security marking on the test object;

extracting from the sequence of digital signatures in the test digital signature verification key of each other leaf node of the test tree having the same parent node as the test leaf node, and calculating the digital signature of the concatenation of the test digital signature and the extracted digital signature of said each other leaf node, thereby thereby obtaining a digital signature of said same parent node of the test leaf node;

sequentially at each next level in the test tree and up to the penultimate level of nodes, extracting from the sequence of digital signatures in the test key of verifying the digital signature of each other node, different from the leaf, test tree, which has the same parent node as the previous same parent node, discussed in the previous step, and calculating the digital signature of the concatenation of the digital signature of said respective each other node other than a leaf node and the resulting digital signature of said previous same parent node, thereby obtaining a digital signature of said same parent node of said previous same parent node;

computing a digital signature of the concatenation of the obtained digital signatures of the non-leaf nodes corresponding to the penultimate level of the test tree nodes, thereby obtaining a potential root digital signature of the root node of the test tree; and checking that the received candidate root digital signature matches the stored control root digital signature, whereby, if said root digital signatures match, the system is configured to deliver an indication that the item data on the test object is genuine item data.

If the marked original product has an associated field data block as mentioned above, the memory of the processing unit further stores the associated field data block, the step of calculating the test digital signature corresponding to the test leaf node in the test tree corresponding to the security marking on the test object, then includes the calculation with a one-way digital signature function of concatenating the extracted product test digital data and the digital data of the stored field data block.

Another aspect of the present invention relates to a system for verifying the conformity of a digital image of a product with respect to a marked original product belonging to a batch of original products protected according to the aforementioned protection method, the system comprising an imaging device having an imaging unit, a memory processing unit, and a processing unit image, while the memory stores the control root digital signature of the tree corresponding to the batch of original products, and a one-way function for calculating the digital signature of digital data and concatenating digital signatures according to the order of nodes in the tree and the order of concatenation of the tree programmed in the processing unit, while the specified system is executed with the possibility of obtaining a digital image of the product, showing a security mark on the product, by means of an image forming device;

reading, with an imaging device, a product digital data representation and an associated verification key in the received security marking digital image, and extracting, respectively, the corresponding product test digital data and the associated test verification key from said read representation;

- 7 040918 verifying the actual correspondence of the extracted test digital data of the product and the test key of verification of the stored control root digital signature by performing on the processing unit additional programmed calculation steps using the one-way function of the test digital signature of the extracted test digital data of the product, while the specified test digital signature corresponds to the test a leaf node in the test tree corresponding to the security marking on the test object;

extracting from the sequence of digital signatures in the test digital signature verification key of each other leaf node of the test tree having the same parent node as the test leaf node, and calculating the digital signature of the concatenation of the test digital signature and the extracted digital signature of said each other leaf node, thereby thereby obtaining a digital signature of said same parent node of the test leaf node;

sequentially at each next level in the test tree and up to the penultimate level of nodes, extracting from the sequence of digital signatures in the test key of verifying the digital signature of each other node, different from the leaf, test tree, which has the same parent node as the previous same parent node, discussed in the previous step, and calculating the digital signature of the concatenation of the digital signature of said respective each other node other than a leaf node and the resulting digital signature of said previous same parent node, thereby obtaining a digital signature of said same parent node of said previous same parent node;

computing a digital signature of the concatenation of the obtained digital signatures of the non-leaf nodes corresponding to the penultimate level of the test tree nodes, thereby obtaining a potential root digital signature of the root node of the test tree; and checking that the obtained potential root digital signature matches the stored control root digital signature, whereby, if said root digital signatures match, the system is configured to deliver an indication that the digital image of the product is an image of a genuine branded original product.

If the marked original product has an associated field data block as mentioned above, the memory of the processing unit further stores the associated field data block, the step of calculating the test digital signature corresponding to the test leaf node in the test tree corresponding to the security marking on the test object may include calculating with a one-way digital signature function of concatenating the extracted product test digital data and the digital data of the stored field data block.

Hereinafter, the present invention will be described more fully with reference to the accompanying drawings, in which like numerals represent like elements in different figures, and in which the main aspects and features of the present invention are illustrated.

Brief description of the drawings

In FIG. 1 is a schematic view of a general batch protection method according to the present invention, FIG. 2A shows a secure biometric passport as an example of a biometric identity document secured in accordance with the present invention, FIG. 2B is a control of a person having a secure biometric passport according to FIG. 2A by an authorized employee, in FIG. 3 shows a batch of aircraft components protected according to the present invention, FIG. 4 is a batch of pharmaceutical products protected according to the present invention.

Detailed description

The present invention is herein described in detail with reference to the non-limiting embodiments illustrated in the drawings.

In FIG. 1 illustrates a general method according to the present invention relating to the protection of a batch of products and to a method for calculating the encoding of verified information that can be associated with each product. In FIG. 1 illustrates a group or batch of products and their associated tree, with only eight products shown for simplicity: A1, ..., A ₈ , which can be anything capable of carrying or containing a physical machine-readable security mark 110 (in this case illustrated by a two-dimensional barcode, but could be a one-dimensional barcode or RFID tag, etc.), or carry something that in turn bears or contains a physical security mark. An article may be a manufactured product or its packaging, a physical document or image, a package containing multiple products (eg, a drug blister pack), or a container containing pallets of product cartons, etc. Even a human or animal can be an article in the context of embodiments of the present invention; for example, authorized participants in an event, or members of a group, or members of a herd or flock may carry some form of identification badge or (especially in the case of animals) be physically marked.

- 8 040918

A batch may, for example, refer to a normal production cycle, goods delivered by a particular supplier, goods manufactured or shipped within a certain time period, a set of related images, a group of people, a herd or flock, or any other user-defined grouping of any objects for which data Ai be determined. Any of the products shown in Fig. 1 may be a virtual product A _v , which is an optional piece of software that may be included to provide encoding of the selected data. This is explained next. For example, one of eight items, such as item A ₈ , may actually be a virtual item A _v that is considered to belong to a batch of eight items, and is treated like any of the other seven real items A ₁ , A2, A ₃ , ... , because it can be processed in essentially the same way (although it doesn't correspond to a real object). Of course, the set of virtual products A _v1 , A _v 2, ..., A _vk can be used to encode digital data and create more secure digital signatures of the product (see below).

For each product A ₁ , A2, ..., A7, A _v A ₁ , A2, A ₃ , ..., A _v batch (where A ₈ =A _v ) the corresponding digital product data D1, D2, ... , D7, D _v (where D ₈ =D _v ) are linked or extracted (or, in the case of the Av virtual item, created) using any suitable method. This data may be some measure of physical characteristics, textual data such as a completed form or product information, a serial number or other identifier, content indications, a digital representation of an image, or any other information that the system designer chooses to associate with the product. The product digital data Di can be extracted from human readable data (eg alphanumeric data) marked on the product (eg printed on the product or on a label affixed to the product) by a reader capable of generating a corresponding digital data file. Additional digital data (eg, command to use the product or security commands, etc.) may be associated with the extracted data to create digital data of the DiDi product.

For an AvAv virtual item, the associated digital data may include, for example, a batch identification number, number of items in a batch, a (pseudo-)random number to increase security by increasing data entropy, date and/or time information, and so on. Another form of related data can be indications of valid or invalid transaction rules, expiration dates, and so on. In short, the digital data D _v can be anything that can be represented in digital form.

For each item in the batch, its respective digital item data D1, D2, ..., D7, D _v D1, D2, D ₃ , ..., D _v are preferably converted mathematically so that they are essentially hidden, although this is not an absolute requirement for any embodiment. This transformation, applied to the digital data Di of the product Ai, serves to create the corresponding digital signature xi. This digital signature is obtained through a one-way function, i.e. a function that is easy to compute but hard to invert (see S. Goldwasser and M. Bellare Lecture Notes on Cryptography, MIT, July 2008, http://www-cse.ucsd.edu/users/mihir).

One such advantageous transformation is, for example, the application of the hash function H( ) = hash( ) to the digital data of a product, which usually tends to return an output of a known length in bits, regardless of the size of the input: this technical effect is especially useful for generating a digital digital data signatures associated with a product, regardless of the size of the associated digital product data and lot size. The hash function is a well-known example of a one-way function. If a cryptographic hash function is used, such as the SHA (Secure Hash Algorithm) function class, such as SHA-256, then there are additional advantages that the function is almost irreversible and collision resistant, i.e. the probability that two different sets of inputs will produce the same output is negligible. As will be clear from the description below, this is also not a requirement of the present invention, although it is advantageous for the same reasons as in other applications. As shown in FIG. 1, x1, _x2 , _x3 , ..., _x8 are hash values, i.e. digital signatures associated with the products of the corresponding product data sets, namely x, = H(Dj), for j=1, ..., 8 (in the case of A ₈ ^ A _v , then D ₈ ^ D _v and x8 = xv = H(Dv)).

To shorten the signature, the digital signature x, of item A, may even be simply a sequence of a given set of lower bits selected from the bits of the hash value H(Dj), for example, using the SHA-256 hash function of the SHA-2 family, it is sufficient to keep only the lower 128 bits of the 256 bits of the signature to still have a strong signature against a cryptanalytic attack.

In FIG. 1 shows a batch of eight branded original products A ₁ , ..., A ₈ , each of which has a corresponding security marking 110 applied to it, and illustrates the method of protecting the products and the corresponding digital data associated with the product D1, ..., D8 through a tree of digital signatures of products. Trees associated with digital signatures are well known

- 9 040918 (binary hash trees, n-ary hash trees or Merkle trees), they usually have base nodes or leaf nodes that are used to create nodes of the next (intermediate) level by digitally signing the concatenation of digital signatures associated with leaf nodes according to a certain ordering of leaf nodes. In the case of a binary tree, the digital signatures associated with the nodes of the first intermediate level are respectively computed by digitally signing (for example, with a one-way hash function H or a one-way elliptic curve function, etc.) the concatenation of the digital signatures associated with two consecutive leaf nodes . In the case of an n-ary tree, the values of the nodes of the first intermediate level are obtained by concatenating the values of n consecutive leaf nodes. A tree can also have a more complex structure (mixed trees), since the concatenation of leaf nodes can be done by pairs of consecutive nodes for certain leaf nodes, by a triple of nodes for other consecutive leaf nodes, and so on. For reasons of simplicity, a simple binary tree with eight leaf nodes is shown in FIG. 1: the corresponding values of the eight leaf nodes a(1,1), ..., a(1,8) of the tree, respectively, correspond to the digital signatures of the product x1 = H(D1), ..., x ₈ = H(D ₈ ). The value of the first index, i.e. 1, for all leaf nodes, indicates the first level (or base level) of the tree, and the second index, going from 1 to 8, indicates the ordering of the (leaf) nodes of the tree. Values of nodes (not leaf) of the next level, i.e. four second-level nodes a(2,1), a(2,2), a(2,3), and a(2,4) are obtained by digitally signing the concatenation (symbolically represented by the + operator), in this case by means of a hash functions, values of pairs of leaf nodes, i.e. pairs of their child nodes in the tree. This grouping of child nodes to obtain the values of the next level nodes determines the order in which the tree is concatenated. To simplify the notation, the node symbol a(i,j) is used to also represent its associated value (ie, its associated digital signature). In this case, the tree has only two intermediate levels above the level of leaf nodes and a root node at the top level. The root node level is actually the last level of the non-leaf node of the tree. Thus, the values of the four non-leaf nodes of the next intermediate level are a(2,1) = H(a(1,1)+a(1,2)), i.e. a(2,1) = H(H(D1)+ H(H(D2)), (where a(1,1) and a(1,2) are children of node a(2,1)), a(2.2) = H(a(1.3)+a(1.4)), a(2.3) = H(a(1.5)+a(1.6)), a( 2,4) = H(a(1,7)+a(1,8)) and for the next, penultimate, level of nodes (in this case, the third level), two node values a(3,1) = H(a (2.1)+a(2.2)), a(3.2) = H(a(2.3)+a(2.4)).

Note that for each node other than a leaf node, we can choose a different order of tree concatenation, for example, instead of having a(2,4) = H(a(1,7)+a(1,8)), we define that a(2,4) = H(a(1,8)+a(1,7)), which gives a different node value.

Finally, the value of the root node R of the tree or the control root digital signature is obtained as R = H(a(3,1)+a(3,2)).

Due to the cascade of concatenations involved in the tree, it is almost impossible to get the root value if any bit of digital data changes at a node (specifically, a leaf node). Moreover, if some virtual items are included in the batch (the digital data of virtual items of which is known only to the system that creates digital signatures of tree leaf nodes), the counterfeiter will not be able to obtain a root digital signature, even knowing the digital data of all produced (and marked) items of the batch.

According to the present invention, the control root digital signature R of a batch of products becomes immutable and therefore tamper-proof by publishing it in a (public) environment open to the user who must verify the authenticity of the product (or data associated with it), or by storing it in a searchable root database that is open to the user, or preferably stored on a blockchain (or a blockchain-secured database) that is open to the user. The user can then save the control value R obtained from these available sources.

For each batch item Ai, the corresponding item verification key ki (or verification path) of the linked tree is then computed as a sequence of respective digital signatures, from the leaf node level to the penultimate node level, of every other leaf node having the same parent node in the tree as leaf node corresponding to the digital signature of the product, and sequentially at each next level in the tree, of each node other than a leaf node having the same parent node in the tree as the previous same parent node considered at the previous level. In the example of FIG. 1 shows eight verification keys k1, ..., k ₈ , respectively, corresponding to eight batch products A1, ..., A8 and their respective eight leaf nodes a(1,1), ..., a(1,8) :

- 10 040918

1) for a leaf node a(1,1)=x1 = H(D1) corresponding to product A1, the verification key is kl={a(1,2),a(2,2),a(3,2) } from which the value of the root digital signature R can be extracted through the following steps (performed according to the order of the nodes in the tree and the order of the concatenation of the tree):

i) from a leaf node a(1,1)=x1 and a leaf node a(1,2)= _x2 to k1 (a(1,2) is another leaf node having the same parent node, i.e. node a(2,1) as well as the leaf node corresponding to the digital signature of the product x1, i.e. node a(1,1)), get the value of the parent node a(2,1) by a(2,1) = H(a(1,1)+a(1,2)) (i.e. a(2,1) = H(xj+x2)), ii) from the resulting a(2,1) and the value of the next node in k1, i.e. a(2,2) of the next level of non-leaf nodes, which is a non-leaf node that has the same parent node in the tree, i.e. node a(3,1) as the previous same parent node considered at the previous level, i.e. node a(2,1), get the value of the parent node a(3,1) by a(3,1) = H(a(2,1)+a(2,2)), iii) from the resulting a(3 ,1) and the value of the next node in k1, i.e. a(3,2) of the penultimate level of nodes, which is a non-leaf node that has the same parent node in the tree, i.e. root node, as the previous same parent node, considered at the previous level, i.e. node a(3,1), get the value of the root node R by R = H(a(3,1)+a(3,2)).

Note: This example shows three steps i), ii) and iii) because the tree is three levels below the root node level and thus the verification key contains three node values.

Thus, the value of the root node of the tree can be obtained as

R = H(H(H(a(1.1)+a(1.2))+a(2.2))+a(3.2)).

2) for a leaf node a(1,2)=x ₂ =H(D ₂ ) corresponding to product A ₂ , the verification key is k ₂ ={a(1,1),a(2,2),a( 3,2)} from which the root value R can be extracted through the following steps (performed according to the order of the nodes in the tree and the order of the concatenation of the tree):

i) from a(1,2)= _x2 and a(1,1)=x1 to k1 (a(1,1) is another leaf node that has the same parent node, i.e. node a(2 ,1) as the leaf node corresponding to the digital signature of the product x ₂ , i.e. node a(1,2)), receive the value of the parent node a(2,1) by a(2,1) = H(a (1,1)+a(1,2)), ii) from the resulting a(2,1) and the value of the next node in k ₂ , i.e. a(2,2) of the next level of non-leaf nodes, which is a non-leaf node that has the same parent node in the tree, i.e. node a(3,1) as the previous same parent node considered at the previous level, i.e. node a(2,1), get the value of the parent node a(3,1) by a(3,1) = H(a(2,1)+a(2,2)), iii) from the resulting a(3 ,1) and the value of the next node in k ₂ , i.e. a(3,2) of the penultimate level of nodes, which is a non-leaf node that has the same parent node in the tree, i.e. root node, as the previous same parent node, considered at the previous level, i.e. node a(3,1), get the value of the root node R by R = H(a(3,1)+a(3,2)).

Thus, the value of the root node of the tree can be obtained as

R = H(H(H(a(1.1)+a(1.2))+a(2.2))+a(3.2)).

3) for a leaf node a(1,3)=x ₃ =H(D ₃ ) corresponding to product A ₃ , the verification key is k ₃ ={a(1,4),a(2,1),a( 3,2)} from which the root value R can be extracted through the following steps (performed according to the order of the nodes in the tree and the order of the concatenation of the tree):

i) from a(1,3)= _x3 and a(1,4)= _x4 to _k3 (a(1,4) is another leaf node that has the same parent node, i.e. node a (2,2) that the leaf node corresponding to the digital signature of the product x ₃ , i.e. node a(1,3)), receive the value of the parent node a(2,2) by a(2,2) = H (a(1,3)+a(1,4)), ii) from the resulting a(2,2) and the value of the next node in k ₃ , i.e. a(2,1) of the next level of non-leaf nodes, which is a non-leaf node that has the same parent node in the tree, i.e. node a(3,1) as the previous same parent node considered at the previous level, i.e. node a(2,2), get the value of the parent node a(3,1) by a(3,1) = H(a(2,1)+a(2,2)), iii) from the resulting a(3 ,1) and the value of the next node in k ₃ , i.e. a(3,2) of the penultimate level of nodes, which is a non-leaf node that has the same parent node in the tree, i.e. root node, as the previous same parent node, considered at the previous level, i.e. node a(3,1), get the value of the root node R by R = H(a(3,1)+a(3,2)).

Thus, the value of the root node of the tree can be obtained as

R = H(H(a(2.1)+H(a(1.3)+a(1.4)))+a(3.2)).

4) for a leaf node a(1,4) = x4 = H(D ₄ ), corresponding to product A ₄ , the verification key is k4 = {a(1,3),a(2,1),a(3, 2)} from which the root value R can be extracted through the following steps (performed according to the order of the nodes in the tree and the order of the concatenation of the tree):

i) from a(1,4) = x ₄ and a(1,3) = x ₃ to k ₄ get the value of the parent node a(2,2) by a(2,2) =

- 11 040918

H(a(1,3)+a(1,4)), ii) from the obtained a(2,2) and the value of the next node in k ₄ , i.e. a(2,1) of the next level of non-leaf nodes get the value of the parent node a(3,1) by a(3,1) = H(a(2,1)+a(2,2)), iii ) from the obtained a(3,1) and the value of the next node in k ₄ , i.e. a(3,2) of the penultimate level of nodes, get the value of the root node R by R = H(a(3,1)+a(3,2)).

Thus, the value of the root node of the tree can be obtained as

R = H(H(a(2.1)+H(a(1.3)+a(1.4)))+a(3.2)).

5) for node a(1.5) = x ₅ = H(D ₅ ) corresponding to product A ₅ , the verification key is k ₅ = {a(1.6),a(2.4),a(3 ,1)} from which the root value R can be extracted by the following steps (performed according to the order of the nodes in the tree and the order of the concatenation of the tree):

i) from a(1,5) = x ₅ and a(1,6) = x ₆ in k ₅ get the value of the parent node a(2,3) by a(2,3) = H(a(1,5 )+a(1,6)), ii) from the obtained a(2,3) and the value of the next node in k ₅ , i.e. a(2,4) of the next level of non-leaf nodes get the value of the parent node a(3,2) by a(3,2) = a(3,2) = H(a(2,3)+a( 2,4)), iii) from the resulting a(3,2) and the value of the next node in k ₅ , i.e. a(3,1) of the penultimate level of nodes, get the value of the root node R by R = H(a(3,1)+a(3,2)).

Thus, the value of the root node of the tree can be obtained as

R = H(a(3.1)+H(H(a(1.5)+a(1.6))+a(2.4))).

6) for node a(1,6) = x ₆ = H(D ₆ ) corresponding to product A6, the verification key is k ₆ = {a(1.5),a(2.4),a(3, 1)} from which the root value R can be extracted through the following steps (performed according to the order of the nodes in the tree and the order of the concatenation of the tree):

i) from a(1,6) = x ₆ and a(1,5) = x ₅ to k ₆ get the value of the parent node a(2,3) by a(2,3) = H(a(1,5 )+a(1,6)), ii) from the resulting a(2,3) and the value of the next node in k ₆ , i.e. a(2,4) of the next level of non-leaf nodes get the value of the parent node a(3,2) by a(3,2) = a(3,2) = H(a(2,3)+a( 2,4)), iii) from the resulting a(3,2) and the value of the next node in k6, i.e. a(3,1) of the penultimate level of nodes, get the value of the root node R by R = H(a(3,1)+a(3,2)).

Thus, the value of the root node of the tree can be obtained as

R = H(a(3.1)+H(H(a(1.5)+a(1.6))+a(2.4))).

7) for node a(1,7) = x ₇ = H(D ₇ ) corresponding to product A ₇ , the verification key is k ₇ = {a(1.8),a(2.3),a(3 ,1)} from which the root value R can be extracted by the following steps (performed according to the order of the nodes in the tree and the order of the concatenation of the tree):

i) from a(1,7) = x ₇ and a(1,8) = x ₈ in k ₇ get the value of the parent node a(2,4) by a(2,4) = H(a(1,7 )+a(1,8)), ii) from the resulting a(2,4) and the value of the next node in k ₇ , i.e. a(2,3) of the next level of non-leaf nodes get the value of the parent node a(3,2) by a(3,2) = H(a(2,3)+a(2,4)), iii ) from the resulting a(3,2) and the value of the next node in k ₇ , i.e. a(3,1) of the penultimate level of nodes, get the value of the root node R by R = H(a(3,1)+a(3,2)).

Thus, the value of the root node of the tree can be obtained as

R = H(a(3.1)+H(a(2.3)+H(a(1.7)+a(1.8)))).

8) for node a(1,8) = x ₈ = H(D ₈ ) corresponding to product A8, the verification key is k ₈ = {a(1.7),a(2.3),a(3, 1)} from which the root value R can be extracted through the following steps (performed according to the order of the nodes in the tree and the order of the concatenation of the tree):

i) from a(1,8) = x ₈ and a(1,7) = x ₇ to k ₈ get the value of the parent node a(2,4) by a(2,4) = H(a(1,7 )+a(1,8)), ii) from the resulting a(2,4) and the value of the next node in k ₈ , i.e. a(2,3) of the next level of non-leaf nodes get the value of the parent node a(3,2) by a(3,2) = H(a(2,3)+a(2,4)), iii ) from the resulting a(3,2) and the value of the next node in k ₈ , i.e. a(3,1) of the penultimate level of nodes, get the value of the root node R by R = H(a(3,1)+a(3,2)).

Thus, the value of the root node of the tree can be obtained as

R = H(a(3.1)+H(a(2.3)+H(a(1.7)+a(1.8)))).

Generally, to extract a (potential) root node value, starting from a given leaf node value and the node values defined in the verification key associated with said given leaf node, the following steps are performed:

extracting from the sequence of node values in the verification key the value (i.e. digital signature value) of every other leaf node of the tree that has the same parent node as

- 12 040918 and at the given leaf node, and computing the digital signature of the concatenation of the given value of the node and, respectively, according to the ordering of nodes in the tree and the ordering of the concatenation of the tree, the extracted value of the specified each other leaf node, thereby obtaining a digital signature of the specified same parent node of the given leaf node;

sequentially at each next level in the tree and up to the penultimate level of nodes to extract from the sequence of node values in the verification key of the value of each other node, other than a leaf node, of the tree that has the same parent node as the previous same parent node considered in the previous step , and calculating the digital signature of the concatenation of the value of said corresponding each other node other than a leaf, and the obtained digital signature of said previous same parent node according to the node ordering in the tree and the tree concatenation ordering, thereby obtaining the value of said same parent node of said previous same parent node; and computing a digital signature of the concatenation of the obtained non-leaf node values corresponding to the penultimate level of tree nodes according to the node order in the tree and the tree concatenation order, thereby obtaining a root digital signature of the tree root node.

As is clear from the above example, the root node value R can finally be extracted from any given leaf node value by digitally signing the concatenation of that leaf node value with only the node values defined in the corresponding verification key. Thus, the amount of data in the verification information that is needed to extract the value of the root node is clearly much less than the amount of data needed to calculate the control value of the root node (i.e., based on only the values of leaf nodes by calculating all node values, other than the leafy, intermediate levels of the tree): this is an advantage of the present invention given the limitation of the limited size available for security markings (eg 2D barcode).

According to the present invention, a security mark 110 (possibly tamper-proof) applied to a product Ai of a batch of products includes verification information Vi, which allows both online and offline verification operations to verify the authenticity of the marked product, the conformity of the data associated with it relative to the data of the genuine branded product, or even the correspondence of the image of the product to the image of the genuine branded product, by providing a unique, immutable and tamper-proof relationship between the product data Di and the belonging of the branded product Ai to a given batch of genuine products, while maintaining the size in bits of the digital representation this verification information Vi at a level compatible with the data content of a two-dimensional machine-readable barcode that can be easily read by a conventional reader: this verification information contains digital product data Di and the corresponding th verification key ki, Vi = (Di,ki). The verification operations include extracting the value of the batch or control root digital signature R of the tree associated with the batch by first reading the digital data of the item D _i and the corresponding verification key k _i on the machine-readable security mark 110 (or on the image of the security mark) on the item A _i (respectively , in the image A _i ), then calculating the potential digital signature of the product Xi by means of a one-way function of the read digital data of the product Di as Xi = H(Di), and calculating the potential root digital signature R ^c , as disclosed above, from the digital signature of the concatenation of Xi and the values tree nodes according to the sequence of node values specified in the verification key ki. This security scheme, which has the advantage that there is no need for data encryption and therefore no need for encryption/decryption key management (in particular, the cryptographic key is not included in the security marking), is much more secure against a cryptanalytic attack than conventional data encryption using a public encryption key - a private decryption key (for example, the Rivest-Shamir-Adleman RSA system). As a result, the size of the digital data to be represented in the security markings of the present invention is compact and allows the use of conventional 2D barcodes (e.g. QR code) and hence conventional barcode readers (or even a simple programmed smart phone, having a camera) while providing a very high level of security against cryptanalytic attacks. Moreover, this security marking is compatible with both online verification (via a server that communicates with the code reader) and offline verification (via a programmed code reader) of the authenticity of the marked product and the compliance of its data with that of the genuine product. In addition, according to the present invention, the representation of the digital data Di and the representation of the key data ki may be different, the data concatenation scheme and/or the one-way function may depend on the node level in the tree, which provides additional levels of security against cryptanalytic attacks.

Preferably, in order to further reduce the size of digital data (i.e., information about

- 13 040918 verification V), which must be included in the security marking, if the digital data Di of the respective original products Ai of the batch are distributed between given fields that are common to all products of the batch, the digital data related to these fields are not included in each digital product data Di, but grouped in a separate FDB field data block associated with the production batch, and the digital signature xi of the original product Ai of the batch is then calculated using a one-way function H of the concatenation of the corresponding digital product data Di and the digital data of the FDB field data block, i.e. . xi = H(Di+FDB); and the control root digital signature R is made available to the user along with the associated field data block FDB (which also ensures that the field data block is immutable).

In an embodiment of the present invention, the field data block FDB independently provides the user with a control root digital signature.

The above reduction in size is possible in most cases, since most of the data associated with batch items are classified according to some fields for data structuring, for example, for a pharmaceutical product designation, serial number, expiration data, etc., Di includes only the data associated with these fields (for example, 12603, May 2020, etc.), while the common field names are serial number, expiration data, etc. included in the field data block FDB.

There are various types of physical (security) markings that can be used to encode the verification key and digital product data (or any other data). However, many marking systems that can be used in practice on small goods or services that cannot accept high-resolution physical markings cannot encode a large amount of data.

One way to solve this problem would be to include several markings, each of which includes one or more elements of the verification vector. In many cases this is impractical due to lack of physical space or unsuitable sign surface, or simply because it would be aesthetically unacceptable.

There are many well-known methods for encoding information that can be applied to physical surfaces. Any such method can be used in implementations of any embodiment of the present invention. One common form of physical marking is the well-known QR code. As is well known for a given area, the more data a QR code can encode, the higher the modulus density (roughly speaking, the density of black/white squares) and the higher the resolution required for printing and reading. In addition to density (in the number of modules squared), QR codes are also commonly classified according to what level of error correction they include. There are currently four different standard levels, L, M, Q and H, each representing a degree of damage, i.e. data loss, the QR code image can withstand and from which can recover. Levels L, M, Q and H can withstand approximately 7%, 15%, 25% and 30% damage respectively.

The following table shows at least approximate values for different versions of the QR code.

Version Size (in modules) Number of bits encoded level L ESS ESS level H BY 57x57 2192 976 25 117x117 10208 4304 40 177x177 23648 10208

However, not all bits can be used to encode the data download, as some modules are used for scan objects, mask pattern, and error correction modules. Thus, there is a trade-off between the amount of information that the QR code (or any other marking 110) can encode and how much information is included in the verification information V and needs to be encoded.

Therefore, for the selected type of security marking 110 (e.g., QR code) with limited encoding capability, a suitable one-way function H must also be selected: a function whose output is too large in terms of required bits cannot be used at all, and a function whose range too small, may not be reliable enough. Moreover, in many applications, scalability can be an issue. For example, some data protection schemes include signatures that grow as the number of elements of a batch increases, and which may unacceptably limit the size of the batch in terms of how many bits the security marking 110 can encode. That is why, according to the preferred mode of the present invention, the next type of function is a one-way hash function of the SHA-2 family.

A calculation module (not shown) is preferably included in the security system for executing code for performing calculations for digitally signing the digital data of batch products, for determining verification keys for different products, and for calculating the control root digital signature of the corresponding tree. The security system may also include suitable modules for inputting (programmed) values corresponding to digital data D _v of the virtual item(s) A _v . It would also be possible to carry out the hash calculations associated with the products externally (e.g. on a connected remote server), for example, wherever the products are manufactured, to avoid having to transfer the raw data of the product Di over the network from this site (or sites) to the protection system if there is a problem.

For each item Ai, the corresponding verification information Vi is compiled and encoded (provided) in some form of machine-readable security marking 110, which is then physically applied or otherwise associated with the respective item. For example, Vi can be encoded on an optically or magnetically readable label, RFID tag, etc., which is attached to the product or printed directly on the product or its packaging. Alternatively, the marking may be on the inside of the product or on its packaging, if necessary, either by direct application or, for example, by inclusion in some form of documentation that is inside the packaging.

For any virtual item A _v its corresponding verification information V _v = (D _v ,k _v ) can be associated with it internally by the security system. The verification information typically at least includes, for any article Ai of a batch of articles, the corresponding article digital data Di and the corresponding verification key ki: i.e. Vi = (Di,ki).

Additional item data may further be associated with the item and may include, for example, a lot value, i. e. R control root digital signature, or any other information that the system designer (or system administrator) chooses to include, such as the serial number associated with the item, lot ID, date/time information, product name, URL that points to other online information associated either with an individual product (for example, an image of a product or its label or packaging, etc.), or with a batch, or with a supplier/manufacturer, a phone number that can be called for verification, etc. d. Additional product data may be stored in a searchable information database that is open to the user (via the information database interface).

After computing the verification ki of the original product Ai and including (i.e., by coding or any chosen representation of data) along with the corresponding digital product data Di in the machine-readable product security marking 110 applied to the product Ai, the resulting marked original product and associated with it, these products are really protected from counterfeiting and falsification.

The user, the recipient of an article such as A1, for example, can then scan (or otherwise read) with an imaging device the security marking on A1 and extract the digital data of the article D1 and the verification key k1 (and any other information that may have been encoded in the label). To verify the marked item A1, the user must first extract the verification information V ₁ =(D ₁ ,k ₁ ) from the security mark 110 on A1 and thus calculate the digital signature x ₁ from the extracted digital data of the item D1: to perform such an operation, the user must know the one-way function that is used to calculate the digital signature of the product, in this case it is the one-way function H() (for example, the SHA-256 hash), and then perform the operation x1=H(D1) to get the full data (x1,k1 ) needed to calculate the corresponding potential root digital signature R ^c . The user may, for example, securely accept a one-way function (for example, using a public/private key pair) or by requesting it from the product supplier or any other entity that has generated signatures and keys or has already programmed them into the processing unit of the device to form the user's image.

Then, in order to calculate such a potential root digital signature R ^c , the user needs to additionally know the type of data concatenation scheme (to concatenate node values via H(a(i,j)+a(i,k)) which is used to: the user can receive this information in any way, either securely (for example, using a public/private key pair), or simply by requesting this information from the product supplier or any other person who created the verification data, or by programming it into the user processing unit.However, the concatenation scheme may actually correspond to a simple conventional end-to-end connection of two blocks of digital data, respectively, corresponding to the values of the two nodes: in this case, no particular scheme should be transmitted to the user.In some embodiments, the concatenation scheme may optionally insert a concatenation block, which may contain data specific to the or the level of concatenated blocks digital data in the tree, making a cryptanalytic attack even more difficult.

Knowing the data concatenation scheme, the user can then compute (for example, by means of a suitably programmed imaging device) a potential root digital signature R ^c as disclosed above by stepping digitally signing the product digital signature concatenation x1 and the node values according to the sequence of nodes defined in verification key k1, see item 1 above) related to the node a(1,1), performed according to the ordering of the nodes in the tree and the ordering of the tree concatenation. In this case, the potential root digital signature is obtained as

R ^c \u003d H (H (H (a (1.1) + a (1.2)) + a (2.2)) + a (3.2)).

This computed potential root digital signature R ^c must then be equal to the available (or published) reference value R: this value may have been previously obtained by the user and/or already stored in the memory of the processing unit of the imaging device, it may also be a value that the recipient requests and receives from the system administrator in any known way. By matching the potential R ^c and the available control root digital signatures R, this calculation then verifies the information in the security marking 110 and confirms that the product A1 belongs to the correct batch. Security markings are preferably provided and/or applied to the product in any manner that is difficult to copy and/or difficult to remove (tamper-proof). In this case, matching root digital signatures can indicate to the user that the item is likely to be authentic. This is of particular interest because, in order to authenticate the item A1, it is not necessary to authenticate its material, i.e. through an intrinsic physical characteristic of A1 or through a specific material-based security marking applied to A1.

A link to access the control root digital signature R for the batch corresponding to product A1 may be included in the security marking 110 (eg, a web address if R can be retrieved from the corresponding website), although this is not the preferred option.

In some implementations, recipients of item Ai may be able to visually retrieve item data corresponding to digital item data Di directly from the item. For example, product data may be textual, such as a serial number or text in a descriptive letter, or be some alphanumeric encoding elsewhere on the product or its packaging and be human-readable from the products themselves or anything attached to them or included in them. Recipients of the articles may also be provided with suitable software, such as a module in an imaging device such as a smartphone, which either inputs data or reads the data optically through the phone's camera and then calculates xj=H(Dj) for the current article. For example, with the security mark 110 on the product A1, which is a standard QR code, the user can easily obtain digital data by scanning the QR code with an imaging device using a standard QR code reader application running on the imaging device. D1 and k1, the verification application on the user's imaging device will then be able to calculate x ₁ and R ^c , and compare this value with the available batch reference R, as discussed above.

Preferably, the control root digital signature (i.e. batch value) R is stored in a searchable root database that can be accessed (via a communication channel) by the user with his imaging device equipped with a communication unit, as is the case with the above smartphone example. The user who needs to verify product A1 can simply send a root request from his smartphone to the database address through the database access interface, a request containing the data of product D1 read on the security mark 110 to A1 (or the calculated digital signature x1 = H (D1)), which allows to extract the corresponding control value of the batch R, and the access interface will return the control root digital signature R to the smartphone. The database can be secured with a blockchain to enhance the immutability of stored root digital signatures. The advantage of the present invention is to establish a relationship between a physical object, i.e. original product and its attributes, i.e. data associated with the product and its affiliation to a particular batch of products, almost invariably through the corresponding root digital signature.

The aforementioned Ai product verification method can also serve to authenticate human-readable product data additionally marked with Ai on the corresponding product data marking affixed to the Ai or printed on the Ai packaging or brochure. Indeed, the user can read, for example, on the display of the imaging device, the corresponding digital product data Di as read on the security marking on the product Ai and decoded by the imaging device, and visually check whether the displayed information corresponds to the product data on the marking. product data.

In a preferred embodiment, the product data or its corresponding product digital data Di further includes a (unique) characteristic digital data (CDD) of a unique physical characteristic of the marked original product Ai, which can be used for (tangible) authentication of Ai. Thus, with characteristic digital data corresponding to the physical characteristic of the product A _i , which is CDD _i , the corresponding unique physical signature data UPSi can be obtained by encoding the CDDi (preferably by a one-way function): for example, taking the hash value of the digital data CDDi, t .e. UPSi = H(CDDi). However, any other known encoding can be used instead: for example, to have a short signature, one can use the elliptic curve digital signature algorithm. As a very simplified illustrative example of characteristic digital data CDDi corresponding to the unique physical characteristic of the product Ai, consider a simple digital image obtained by mapping the product Ai (or a specific area to Ai), with the corresponding unique physical signature data UPSi being, for example, a hash digital image value, UPSi = H(CDDi). The characteristic digital data CDD _i that generated the signature UPS _i is the signature characteristic digital data for A _i , and the resulting signature UPS _i is the corresponding physical signature check data for Ai. Preferably UPSi, i.e. the physical signature control data for item A _i are stored in a searchable database or on a blockchain (or a blockchain-secured database) open to users (for example, through a request containing the digital data of item Di read on the security mark Ai, or their respective digital signature xi). Thus, the saved UPSi becomes immutable. A copy of the CDDi may be further stored in the memory of the user's imaging device. In an embodiment, a copy of the UPSi may also be optionally stored in the memory of the user imaging device (to enable an offline verification operation).

Authenticity verification of the product A _i can be performed by extracting the potential characteristic digital data CDDi ^c from the digital data Di read (in this case by a decoding application running on an imaging device, which may be, for example, a smartphone)) on a protective marking on the product Ai, and comparing them with the control characteristic digital data CDDi stored in the memory of the imaging device: if CDDi = CDDi ^c matches, the product Ai is considered genuine (its digital content corresponds to the content of the genuine marked original product). If the signature characteristic digital data CDDi is not stored in the memory of the imaging device, but rather the unique physical signature verification data UPSi is stored in the memory of the imaging device (with the advantage that it takes up much less memory than CDDi), then the authenticity Ai can still be verified by verifying that the potential unique physical signature data UPSi ^c obtained by computing the hash value of the potential digital unique physical characteristic data CDDic UPCi ^c extracted from the digital data Di, i.e. UPSic = H(CDDi ^c ) matches the unique physical signature control data UPS _i stored in memory.

The user can further verify the authenticity of the received item A _i , still by an off-line process (self-checking), by detecting said unique physical characteristic on Ai, by means of a sensor capable of making such a measurement (in this case, the imaging unit of the imaging device), and deriving potential characteristic digital CDDi ^c data from the detected characteristic (in this case, a digital image captured by the imaging device). Thus, the user can compare (through the image processing unit of his imaging device, or visually on the display of the imaging device) received CDDic with a copy of reference CDDi (stored in the memory of the imaging device): in the case of a valid match CDDic ® CDDi ( i.e. two digital data are consistent with some predetermined criterion of deviation or similarity), the product A _i is considered to be genuine.

Moreover, the user can also further calculate the corresponding candidate physical signature data from the copy of the check CDD _i stored in the memory of the imaging device as UPSic = H(CDDi) and compare it with the check physical signature data UPSi stored in the memory of the device for imaging: if UPSi ^c = UPSi matches, the product Ai is confirmed to be genuine with a higher degree of certainty.

Moreover, in the case of a match, the digital product data Di associated with Ai, which has been verified as corresponding to the genuine product data as disclosed above, is also authenticated by extracting the corresponding batch reference value R from the read verification information (Di,ki) on the security card. marking on Ai. In the preferred mode, a copy of the control characteristic digital data (CDD) _i , instead of being stored in the device memory

- 17 040918 The user's image forming part is part of the product digital data Di included in the security marking on the product Ai and can be obtained by reading it on the security marking (using an imaging device). However, in a variant (still compatible with offline verification), a copy of the CDDi reference characteristic digital data may instead be included in the product data marking applied to the product Ai (and read by the user's imaging device).

In an embodiment, verification of the authenticity of the product Ai by the user can be performed through an online process: in this case, the control data CDDi and/or UPSi are stored in a searchable database open to the user, while the control data related to the product Ai is stored in relation, respectively, to the corresponding digital product data Di (included in the security marking on Ai) or to the corresponding digital signature of the product xi (which can be calculated by the user when extracting the data Di from the security marking through the operation xi=H(Di) and can be requested by sending a query to the database containing, respectively, Di or xi.

Of course, any other known intrinsic physical/chemical property can be used to derive the characteristic digital CDD _i data of article A _i and the corresponding unique physical signature data UPSi. As another illustrative example, a two-dimensional barcode can be printed forming a security mark 110 on an original product using a security ink containing a luminescent pigment having a characteristic decay time constant, as well as a light excitation wavelength window and a luminescent emission wavelength window: as a result the ink has a certain reference decay time τ, which serves as a fingerprint of the ink material. It suffices to illuminate the security mark 110 with excitation light in an illumination wavelength window encompassing the pigment excitation wavelength window, and to collect the resulting luminescent light from the security mark with a sensor capable of detecting light intensity within the luminescence emission wavelength window to authenticate security marking. For example, the user imaging apparatus may be equipped with a flash capable of delivering excitation light to a security mark, a photodiode capable of collecting an appropriate luminescent light intensity profile I(t)(during a detection time interval) from the security mark, and a unit processing device for imaging, programmed to calculate the value of the decay time based on the received intensity profile I(t). For example, the excitation wavelength window may be in the UV (ultraviolet) range and the emission wavelength window in the IR (infrared) range. If, during product verification, the intensity of the fluorescent light collected by the user's imaging device shows a characteristic decay over time corresponding to the potential decay time t _s , then the ink, and hence the security marking, is considered authentic if t _s ® τ (within the given range deviations). In this case, the digital data CDD _i of the marked article A _i includes. at least a decay time reference value τ (and possibly data related to the excitation wavelength window and the emission wavelength window). As can be seen from the above examples, the technical result of including the control characteristic digital data in the security marking verification information is to provide a tamper-proof connection between the digital data of the product and the (tangible) authentication data of this particular product.

Another exemplary embodiment of the present invention relates to a batch of biometric identification documents, such as biometric passports, as shown in FIG. 2A.

This example still uses the hash function as a one-way function for signing the passport data, preferably the SHA-256 hash function due to its well-known reliability. Indeed, given a given batch size, the hash function that is chosen (having a known list of segments) to sign the passport data is thus an example of a one-way encryption function such that each individual passport has a separate passport signature, making the signature unique. The domain of a hash function (i.e. the set of possible keys) is larger than its range (i.e. the number of different table indexes), it will map multiple different keys to the same index, which can lead to conflicts: such conflicts can be avoided when the batch size is known by looking at the bucket list associated with the hash table of the hash function and keeping only the function giving zero collisions, or by independently choosing a hash table conflict resolution scheme (such as coalesced hashing, cuckoo hashing, or hopscotch hashing).

In FIG. 2A shows an example of a biometric passport A1 protected by a machine-readable security marking 210 (in this case a QR code) and containing a passport data marking 230 containing the normal passport data, i.e. visible printed data such as the title of a document

- 18 040918 menta 230a (Passport), passport holder biographical data set 230b: last name (Daw), first name (John), gender (M), date of birth (March 20, 1975), nationality (USA), place of residence (Des Moines) ), place of birth (Auckland), issue date 230c (February 24, 2018) and expiration date 230d (February 23, 2020). This passport data may additionally contain some(s) (unique(s)) serial number(s) 235 assigned by the passport issuing authority (in this case 12345). The passport data further comprises the passport holder's biometric data in the form of data corresponding to a unique physical characteristic of the person associated with the passport. A machine-readable representation 230e (eg, alphanumeric) of data characterizing said unique physical characteristic (not shown) corresponding to said biometric data is associated with passport data 230. The representation of digital data should be understood in the broadest sense of the term: for this representation of data, it is only necessary to ensure that the original digital data is retrieved. The machine readable representation 230e of the data, i. e. biometric data, a unique physical characteristic, may correspond, for example, to the identification data of a fingerprint or the identification data of the iris of the eye of the passport holder. For example, the biometric data 230e corresponding to a human fingerprint may be the result of analysis of a set of specific small features of the fingerprint protrusions, such as ridge termination, bifurcation, and short ridges (according to the traditional Henry classification system).

Thus, for a given passport Aj from a batch µ of delivered biometric passports (in this case µ = 1024), the associated digital data Dj of the passport includes the digital data corresponding to the above data 230a-230e.

In an embodiment, the passport-related digital data Dj may include only field values that are common to all delivered passports, while the fields as a whole, ie. Passport, Last Name, Gender, Date of Birth, Citizenship, Place of Residence, Place of Birth, Passport Issue Date, and Expiry Period are included in a separate FDB field data block as disclosed above: for example, D1 only contains a representation of the values of the fields Dow, John, M , March 20, 1975, USA, Des Moines, Oakland, February 24, 2018 and February 23, 2020.

Preferably, the additional digital data of the passport is associated with the above data 230 of the passport. For example, a digital image of a fingerprint of a passport holder or a digital photo of an identity, etc. In an embodiment, this additional digital passport data is stored in a searchable infobase 250, which can be searched with an information query containing some of the passport data (e.g., the holder's name, or biometric data, or data from a security marking, or unique serial number 235) to extract the corresponding fingerprint pattern data and receive it back. Preferably, a link to the infobase 250 is included in the information access marking 240 on the passport: in this case, it is a QR code containing a reference index to retrieve the corresponding additional data in the infobase 250. However, in a variant of a passport control operation involving access to a remote information database (online operation), the QR code may contain, for example, the URL of an information database accessible via the Internet.

The digital signature with the one-way hash function of the digital data of the passport Dj corresponding to the data 230a-230e of the passport Aj is then calculated by, for example, the above-mentioned SHA-256 reliable hash function to obtain the corresponding (unique) digital signature of the passport Xj=H(Dj) . In the same way, the digital signatures of all passports in a batch for all different holders are calculated.

For all passport signatures in a batch, the control root digital signature R is computed according to the tree ordering and the tree concatenation ordering of the linked (binary) tree, as disclosed above. Since there are μ = 1024 passports in the batch, the corresponding binary tree has 1024 leaf nodes a(1,1) ,..., a(1024) for the first level, 512 non-leaf nodes, a(2,1), .. ., a(2,512) for the second level, 256 non-leaf nodes, a(3,1), ..., a(3,256) for the third level, etc., up to the penultimate node level (in this case level 10) with non-leaf nodes a(10,1) and a(10,2), and a top node corresponding to the root node R (tree level 11). Leaf node values are a(1,j) = Xj = H(Dj), j=1, ..., 1024, second level node values are a(2,1) = H(a(1,1) +a(1,2)), ..., a(2.512) = H(a(1.1023)+a(1.1024)), etc., and the control root digital signature R is R = H(a(10,1)+a(10,2)). Thus, each verification key kj is a sequence of 10 node values. The security marking 210 applied to the ticket Aj includes the digital data of the ticket Dj and the corresponding verification key kj (ie, verification information Vj = (Dj,kj)).

For the operation of checking the actual correspondence of the digital data of the passport Dj and the verification key kj in the security marking 210 of the biometric passport Aj to the data of the genuine biometric

- 19 040918 of a biometric passport belonging to a batch μ of biometric passports having a value of batch R, it is only necessary to calculate the digital signature of the passport Xj = H(Dj) and verify that Xj and the verification key k provide the extraction of the available corresponding control root digital signature R by composing 10 times (in this case, the tree is ten levels below the root level) the hash function of concatenating the node value a(1,j) and the node values in k, (according to the ordering of the nodes in the binary tree and the ordering of the concatenation of the tree with the usual concatenation scheme ). Thus, a biometric passport secured according to the present invention provides both a tamper-resistant link between personal data and the biometric data of its holder, and a unique and tamper-resistant link between the holder's individual and the holder's identity.

In FIG. 2B illustrates the control process of the secure biometric passport A1 according to FIG. 2A, in which the passport data marking 230 corresponds to a specific John Doe, the passport biometric data 230e corresponds to John Doe's fingerprint, and the additional passport digital data corresponds to a digital photograph of John Doe's identity 255 that is accessible by reference to the information database 250 included in the marking 240. on access to information. The passport data additionally contains a unique serial number 235 assigned by the passport issuing authority. The security marking 210 applied to the passport A1 contains verification information (D1,k1), with the digital data of the passport D1 corresponding to the printed data 230a-230d of the passport, the biometric data 230e and the unique serial number 235, and the verification key k1 corresponding to the sequence from 10 node values {a(1,2),a(2,2),...,a(10,2)} that are needed to extract the root value R from the node value a(1,1) of passport A1 (where a(1,1) = x1 = H(D1)). The control root digital signature R can be timestamped and stored on blockchain 260. In this example, the biometric data 230e of the respective batch biometric passport holders is also stored on blockchain 260 in association with their respective unique serial numbers, respectively (to ensure that this data is immutable). . The stored biometric data of John Doe can be retrieved by sending a request to blockchain 260 with the unique 235 serial number found on his passport. Authorities responsible for controlling people's identities (e.g., police, customs, etc.) can access blockchain 260 via a communication channel and in this exemplary embodiment also have local repositories to store the (published) root digital signatures of all delivered shipments biometric passports. In the example shown in FIG. 2B, the infobase 250 is local (i.e., directly available to authorities, without the need for a public communications network). In addition, these organs are equipped with fingerprint scanners 270 for capturing human fingerprints and calculating corresponding machine-readable representations of the fingerprint data, i.e. biometric data 230e.

During the verification of the identity of John Doe by, say, a police or customs officer, the officer takes John Doe's secure biometric passport A1, reads and decodes the verification information (D1,k1) stored in the security marking 210 on the passport, through a suitable portable reader 280 connected to a computer 290 (forming an imaging device), with the computer connected to local storages 250. After reading the digital data of the passport D1 and the verification key k1 and sending them to the computer 290, a certain application (with a programmed hash function H and concatenation of node values ) running on computer 290 calculates the digital signature of the passport x1 (as x1=H(D1) and the potential lot value R ^c as

H(H(H(H(H(H(H(H(H(H(a(1,1)+a(1,2))+a(2,2))+..)+..) +..)+..)+..)+..)+a(9,2))+a(10,2)),

those. Compiling a 10-fold hash function of concatenating the node value a(1,1) and the node values in k1={a(1,2),a(2,2),...,a(10,2)}. The computer can then, for example, search the local infobase 250 for a control root digital signature R that matches the control value R ^c : if not, the passport is fake and John Doe Doe) can be arrested. If R ^c matches some stored control root digital signature, the passport is considered authentic, and the employee can perform additional security checks:

the employee retrieves the digital photo 255 of the person stored in the information database 250 by sending a request through the computer 290 containing the serial number 235 printed on A1, receives it back and displays the received photo 255 of the person on the screen of the computer 290: the employee can then visually compare the displayed face (i.e. John Doe's face) with the face of the person being tested and assess whether the two faces are similar or not; and the employee extracts the biometric data 230e on the passport A1 by reading the data on the security marking 210 with the portable reader 280 connected to the computer 290 and scans the person's fingerprint with the fingerprint scanner 270 connected to the computer 290 and obtains the corresponding biometric data of a person: the employee then checks, through a program running on computer 290, whether the extracted biometric data 230e is similar (within a given error) to the obtained human biometric data.

If the two faces and biometrics are considered similar, everything is fine and the person being checked is indeed the real John Doe, the owner of a genuine A1 biometric passport.

Should any of the above additional security checks fail, it is clear that the person in front of the employee is not the true owner of a genuine A1 biometric passport and has likely stolen the passport of one John Doe. Thus, with the secure biometric passport of the present invention, a simple offline check can quickly detect any fraud.

In fact, it is even possible to reduce a biometric passport document to a simple piece of paper with a simply printed 2D barcode (as in the above QR code example) including verification information V = (D,k): with V containing the holder's biographical data and ( unique) biometric data such as the holder's fingerprint (in the digital data D of the passport) and the verification key k. In fact, according to the present invention, even this reduced security passport has the full advantage of the aforementioned tamper-proof link created between the personal biographical data and biometric data of the passport holder and the unique and tamper-proof link between the holder's individual and the holder's identity.

Another exemplary embodiment of the present invention relates to aircraft components as shown in FIG. 3. Due to the very high cost of some critical components, the failure of which may affect the safety of the aircraft, such as some parts of the reactors (for example, turbine blades, pumps, etc.) or landing gear, or batteries, etc., counterfeiters are interested in producing copies of these components, but, of course, without meeting the necessary technical security requirements due to their usually lower quality. Even if an aircraft component is usually marked with an appropriate unique serial number to identify it, this kind of marking can be easily counterfeited. These fake aircraft parts are usually defective and can cause serious damage or even a plane crash. This is a growing security issue today. Moreover, even if the components are genuine, they may not be suitable for certain versions of the same type of aircraft, and there is a serious risk that an unsuitable component will be accidentally used, for example, to repair a given aircraft. Thus, it is important to provide at least critical genuine components that are authorized for a given aircraft.

As a rule, each component has an associated data sheet with, for example, the technical name of the component, a unique serial number of the component, the name of the component manufacturer, the date of manufacture of the component, and certification information. Moreover, for a given aircraft, the corresponding record contains all data sheets of its respective components. However, counterfeit components may have a corresponding counterfeit data sheet, and therefore it is not obvious (unless, for example, technical tests are carried out) to detect fraud. For example, how can you be sure that the technical data sheet correctly matches the component installed on a particular aircraft (and vice versa)?

According to an exemplary embodiment of the present invention, authorized parts that will be used for the manufacture or repair of a given aircraft or that are installed on an aircraft are considered to belong to the batch of products for that particular aircraft.

In the specific illustrative embodiment shown in FIG. 3, each product of the aircraft batch, i.e. each authorized aircraft component for installation or repair on that aircraft has a corresponding AC-ID aircraft component identification document that contains the same component data as in a regular data sheet (e.g. aircraft identification code, aircraft manufacturer name, component technical name, unique serial number of the component, name of the component manufacturer and date of manufacture of the component) together with additional numeric data corresponding to the aircraft identification code, the name of the aircraft manufacturer, the date the component was assembled on the aircraft, the name of the person responsible for performing the conformance check, together with the date of the conformance check and the corresponding ( unique) digital signature of the verifier. In addition, each aircraft component's AC-ID is protected by a machine-readable security marking applied to it (preferably tamper-proof). Preferably, each time a component or set of components is replaced on an aircraft, appropriate AC-ID security documents are created, and a corresponding updated version of the aircraft batch is also created with the aforementioned corresponding additional digital data (related to new installation operations).

Thus, all (critical) installed components on a particular aircraft (in this case, the given aircraft with the identifier HB-SNO) belong to the corresponding lot

- 21 040918 installed components (in this case µ components in total). A security mark 310 (in this case a QR code) is printed on each aircraft component identification document, eg AC-ID:A ₁₂₅ , that is associated with the corresponding aircraft component, in this case A ₁₂₅ , installed on the HB-SNO aircraft. In FIG. 3 in particular shows component A ₁₂₅ of the aircraft batch, which is a turbine blade adapted to the type of reactor installed on an HB-SNO aircraft and marked with a unique factory serial number (in this case 12781, usually engraved by the manufacturer). Component D ₁₂₅ digital data (or product digital data) associated with component A ₁₂₅ includes the digital data corresponding to the data of the data marking 330 printed on AC-ID:A ₁₂₅ : aircraft identification code 330a (in this case HBSNO), title 330b aircraft manufacturer (in this case AeroABC), technical name 330c of the component (in this case turbine blade - ^1st ring), serial number 330d of the component (in this case 12781), name 330e of the component manufacturer (in this case PCX), date of manufacture of the component 330f (in this case November 13, 2017), the date the component was assembled at the 330g reactor (in this case February 24, 2018), the name of the person responsible for performing the 330h conformance check (in this case Martin White), along with the date verifier 330i (in this case March 20, 2018) and the (unique) digital signature of the verifier 330j (in this case 2w9s02u).

The digital signature of component x ₁₂₅ of digital data D ₁₂₅ AC-ID:A ₁₂₅ of component A ₁₂₅ is calculated by a one-way hash function H of the form x ₁₂₅ = H(D ₁₂₅ )x ₁₂₅ = H(D ₁₂₅ ). In the same way, all digital signatures of the digital data component xi of the digital data Di of the component Ai are calculated by means of a one-way hash function H in the form xi = H(D;) (in this case, i = 1, ..., μ). According to the present invention, a tree associated with a batch of components (in this case a binary tree) is constructed from μ leaf nodes a(1,1), ..., a(1,μ), respectively, corresponding to μ digital signatures of the components x1, . .., x _μ of the respective digital data of the component D1, ..., D _μ of the identification documents AC-ID:A1, ..., AC-ID:A _μ of the components Ai, ..., Α _μ . In this case, the ordering of the nodes of the binary tree is the usual ordering, i.e. nodes a(i,j) are arranged according to the index values (i,j): index i indicates the level in the tree, starting from the level of leaf nodes (i=1) to the penultimate level of nodes below the root node, and index j, going from 1 to µ for the level of leaf nodes (level 1), from 1 to µ/2 for the next level of nodes (non-leaf) (level 2), etc. and 1 to 2 for the penultimate node level. A tree containing node levels ranging from leaf nodes to a root node, with each non-leaf node of the tree corresponding to a digital signature by means of a one-way concatenation function H of the corresponding digital signatures of its child nodes according to the order of the tree's concatenation.

A control root digital signature R for a batch μ of aircraft components A1, ..., A _μ is computed by a one-way function of the (conventional) concatenation of the tree roots (as discussed below). The control root digital signature R is then stored in a searchable database (preferably a blockchain) open to those responsible for checking or replacing installed components. The tree thus contains levels of nodes ranging from leaf nodes to the root node of the tree, with each non-leaf node of the tree corresponding to a digital signature by means of a one-way function H of concatenating the respective digital signatures of its (two) child nodes according to the tree concatenation order (in in this case, the usual one), the root node corresponds to the control root digital signature R, i.e. digital signature by means of a one-way function H of concatenation of digital signatures of nodes of the penultimate level of nodes in the tree (according to the ordering of the nodes in the tree and the ordering of the concatenation of the tree).

For a given batch component Ai, the verification key ki corresponding to the digital signature of the component xi (i.e., the leaf node a(1,i)) of the digital data of the component Di is calculated as a sequence of corresponding digital signatures, starting from the leaf node level to the penultimate node level of the tree , each other leaf node that has the same parent node in the tree as the leaf node a(1,i) corresponding to the digital signature of the product xi, and sequentially at each next level in the tree, each node other than a leaf node that has the same the parent node in the tree as the previous same parent node discussed in the previous level. For each Ai component installed on the HB-SNO aircraft, the associated D component digital data; and the corresponding verification key ki are embedded in the security marking affixed to the corresponding aircraft component identification document AC-ID:Aj.

For example, in the case of a component inspection operation on an HB-SNO aircraft, the skilled person may send a query to a searchable database containing the component serial number 12781 read on the AC-ID:A ₁₂₅ of the component A ₁₂₅ to be inspected, or its verification key k ₁₂₅ , readable at the security mark 310 on the corresponding AC-ID:A ₁₂₅ document with a suitable reader, and will return the corresponding batch R value. aircraft-related digital signatures,

- 22 040918 subject to control. In this last variant, the specialist can then check if the component is genuine by reading the digital data of the component D ₁₂₅ on the security marking 310, checking that the unique serial number 330d (in this case 12781) extracted from D ₁₂₅ matches with the serial number physically applied on the installed aircraft component A ₁₂₅ , calculating the corresponding digital signature of the x ₁₂₅ component (for example, by running a programmed application on the computer processing unit that calculates the signature x ₁₂₅ =H(D ₁₂₅ ) from the read digital data D ₁₂₅ ), calculating the potential batch value R ^c by means of a one-way function H programmed on the computer processing unit in the form of a hash value of the concatenation of the value of the leaf node a(1,125)=x125 and the values of the nodes specified in the corresponding verification key k125, and checking that the potential value of the batch R ^c matches the value of the control root digital signatures stored in computer memory yuthera (i.e. R corresponding to the aircraft HB-SNO). In the event of a complete match (i.e. matching serial numbers and R ^c = RB ^c = B), the A125 component is considered genuine and belongs to the (updated) aircraft batch of authorized HB-SNO aircraft components, in the case of a mismatch between R ^c and the saved control root digitally signed R, or if the serial numbers do not match, the A125 component is likely to be a counterfeit, or is a genuine component not authorized for the HB-SNO aircraft (for example, does not belong to the correct batch for this aircraft), and must be replaced.

In the same way, the present invention will detect fraud (or errors) in lots of stocked AC-ID protected spare parts by verifying the authenticity of the security markings on the stored parts and by verifying that the component serial number from the security marking matches the number marked on the corresponding component. . In the case of a highly critical component, a material-based tamper-resistant security marking may additionally be applied to the component, while the digital data relating to the corresponding control unique physical characteristic, i.e. characteristic digital CDD data (e.g. captured by a suitable sensor when applying a material-based security mark) of that mark is preferably part of the component D digital data in that component's security mark, and the corresponding UPS unique physical signature check data is computed (e.g., by taking a hash of CDD characteristic digital data values, i.e. UPS = H(CDD)UPS = H(UPC)) and may also be part of the component digital data. This added layer of security enhances the protection provided by the unique serial number stamped on the component by its manufacturer. Preferably, the control UPCs and UPSs are stored on the blockchain (to ensure they are immutable) and are available to a specialist. Moreover, these control values can also be additionally stored in the memory of a technician's computer to allow for offline authentication of a material-based security marking on a highly critical component.

A further off-line authentication operation of this material-based security marking may involve measuring a unique physical characteristic on the component by means of a suitable sensor connected to a computer and deriving potential characteristic digital data CDD ^c from the measured characteristic (for example, through a special application programmed in the processing unit of his computer ). The technician (or his computer's processing unit, if he is suitably programmed) then compares the resulting ^CDDs with a copy of the reference CDDs stored in the computer's memory: in the event of a reasonable match between CDDs ^c ® CDDs (i.e., within some predetermined error tolerance criterion, ) security markings based on the material and therefore the component is considered genuine.

As mentioned above, a copy of the control characteristic digital data CDD, instead of being stored in the memory of a specialist's computer, is part of the digital product data D included in the security marking applied to the component, and can be obtained by directly reading the security marking (using reader). Then the specialist can read the potential CDD ^c on the security mark and check the match of the UPS signature stored in the computer memory with the potential signature UPS ^c calculated from the read potential CDD ^c by calculating UPS ^c = H(CDD ^c ): in case of a match, UPS ^c = UPS certifies that the security marking based on the material and thus the component is genuine.

In an embodiment, verification of the authenticity of a component by a specialist may alternatively be performed via an online process similar to that already disclosed in the first detailed embodiment of the present invention and will not be repeated here.

According to the present invention, it is further possible to verify that a digital image of a security document, such as an aircraft component identification document AC-ID:A ₁₂₅ , matches, for example, with respect to the original security document. In fact, if the specialist responsible for the control (or repair) operations only has access to a digital image of the security document, for example, by receiving the image AC-III:A ₁₂₅ on his reader (which can be, for example, a smartphone programmed in a suitable 23 040918 ), it can still verify that the component data printed on the received document image matches the original document data by performing the following operations:

reading the digital data of the component D ₁₂₅ and the verification key k ₁₂₅ in the security marking image 310 in the digital image of the document AC-ID:A ₁₂₅ ;

obtaining the control value R of the batch corresponding to the document AC-ID:A ₁₂₅ ; this control value may already be in the memory of the reader (or a computer connected to the reader) or it can be obtained via a communication channel from a database storing control values of a batch of aircraft components, if the reader is equipped with a communication unit, by sending a request containing, for example, ( unique) the serial number of the component or simply the key k ₁₂₅ read on the image of the security mark 310, and receiving back the corresponding control value of the batch R;

calculating (using the programmed one-way function H) the digital signature of component x ₁₂₅ from the read digital data of component D ₁₂₅ , with x ₁₂₅ = H(D ₁₂₅ );

calculating the potential batch value R ^c (via a programmed one-way hash function H) as a digital signature using the hash function H concatenating the leaf node value x ₁₂₅ and the node values specified in the verification key k ₁₂₅ (according to the order of the nodes in the tree and the order of the tree concatenation ); and verifying that the potential value of the lot R ^c matches the control value of the lot R.

The aforementioned conformity verification operations can also be carried out on a plain photocopy of the original AC-ID:A ₁₂₅ document. Indeed, even if a copy protection feature were on the security marking of the original document, which would show that the specialist had only a photocopy, he would nevertheless be able to read the data on the security marking on the photocopy and perform the above operations of verifying the conformity of the data read on copies, relative to the original data.

Another exemplary embodiment of the present invention relates to the self-secure serialization of pharmaceutical products such as drug packages as shown in FIG. 4. This embodiment refers to a production batch of drug packages of this type of drug containing mm boxes (or products) Αβ ..., Α _μ . In this illustrative example of a typical box Ai shown in FIG. 4, patient tablets are packaged in a set of serial blister packs 401 (only one shown) contained in box A _b Each blister pack 401 is marked with a unique serial number 435 (in this case 12345, applied by the manufacturer), and the usual information is printed on box A ₁ , such as drug name 430a, logo 430b, unique box serial number (box ID) 430c, expiration date 430d. In this example, additional usual data may be printed on the box (or alternatively on the package insert included in the AD box: suggested retail price 430e, market country 430f and indication of 430g sales restriction (for example, sold only in a pharmacy) Box A ₁ is protected by a machine-readable security marking 410 in the form of a printed 2D bar code (or data matrix) and is further protected by a material-based security marking in the form of a separate tamper-resistant copy protection adhesive stamp 415, including randomly dispersed particles, which is printed on the box A1. It is known that the (random and therefore unique) positions of the particles on the stamp constitute a unique physical characteristic of the stamp 415 applied to the box A1, and thus in this case also a unique physical characteristic of the box _A itself. position of the dispersed particles on the die 415 is commonly used Used to calculate the corresponding reference characteristic digital data CDD-A1 of the Ai box. Typically, the detection of dispersed particles and their positions is carried out by processing a digital image of the stamp. In this case, the particles can be detected when the stamp is illuminated with a simple white flash (for example, a white LED), such as a smartphone flash. Preferably, a dedicated image processing application can be downloaded to a smartphone so that it can display the stamp 415, detect the positions of the dispersed particles, and calculate the corresponding CDD characteristic digital data from these positions.

According to the present invention, the barcode 410 of the box Ai (i e {1,...,μ}) of the batch contains the digital data of the box D _i corresponding to the digital representation of the above-mentioned conventional data 430a-430g of the box Ai, the corresponding serial numbers 435 of the blister packs 401, contained in the box Ai, and control digital data of the unique physical characteristic CDD-Ai of the box Ai. For each batch box Ai, the box-associated digital signature xi of its box digital data Di is computed by means of a one-way hash function H of the form xi = H(Di), i = 1, ..., μ.

The tree associated with a batch of boxes (in this case, a binary tree) is constructed from μ leaf nodes a(1,1), ..., a(1,μ), respectively, corresponding to μ digital signatures of the box x1, ..., x _μ of the corresponding digital data D _b ..., D _μ boxes A _b ..., Α _μ . In this case, the order of the nodes

- 24 040918 binary tree is the usual ordering, i.e. nodes a(i,j) are arranged according to the index values (i,j): index i indicates the level in the tree, starting from the level of leaf nodes (i=1) to the penultimate level of nodes below the root node, and index j, going from 1 to µ for the level of leaf nodes (level 1), from 1 to µ/2 for the next level of nodes (non-leaf) (level 2), etc. and finally from 1 to 2 for the penultimate node level. The tree contains node levels ranging from leaf nodes, a(1,1), ..., a(1, μ), to the root node, with each node other than a leaf node of the tree corresponding to a digital signature via a one-way hash function H concatenate the respective digital signatures of its child nodes according to the order of the nodes in the tree and the order of the concatenation of the tree (the root node corresponds to the control root digital signature).

The control root digital signature R for all boxes of the batch is then computed by a one-way hash function H as a digital signature of the concatenation of the digital signatures of the nodes of the penultimate level of nodes in the tree (according to the order of the nodes in the tree and the order of the concatenation of the tree).

The obtained control root digital signature R is then either published in an environment open to the user who needs to verify the validity of the secure drug package Ai, or stored in a searchable root database open to the user, or stored in the blockchain (or in the database , protected by the blockchain), open to the user. For example, a user can send a request containing the serial number 430c read on the security marking 410 on the specified box Ai to a searchable root database or blockchain and receive back the corresponding control value of batch R. Link to access the searchable root database (via the Internet, for example) or blockchain can be included in the box data marking 440 (shown as a QR code in FIG. 4) printed on the box Ai. Preferably, the control root digital signature R is made available to the user locally, so that the user can perform verification operations offline (i.e. without having access to remote storage facilities to obtain R): for example, the user has a reader, such as a smartphone, performed with the ability to read and decode the data in the security marking 410 on the box Ai (via a programmed application running on the processing unit of a smartphone) and whose memory stores the control root digital signature R.

For each box Ai of a batch of μ packages of medicines, there is a corresponding verification key ki associated with the digital signature of the box xi, i.e. with node a(1,i), it is computed as a sequence of corresponding box digital signatures from the level of leaf nodes to the penultimate level of tree nodes, every other leaf node having the same parent node in the tree as leaf node a(1,i) , corresponding to the digital signature of the product xi, and sequentially at each next level in the tree, of each node, other than a leaf node, having the same parent node in the tree as the previous same parent node considered at the previous level.

The digital data of the box Di and its corresponding box verification key ki (together constituting the verification information Vi of the box Ai) are part of the digital data included in the security marking 410 applied to the box i.

To verify the authenticity of the secure box A1 according to FIG. 4 belonging to a batch of boxes having a control root digital signature R, it is only necessary to read and decode the digital data of the box D1 on the security marking 410 on the box A1 (using a suitable reader, for example, using the aforementioned smartphone having an additionally programmed application for calculating the signature using the one-way hash function H and extracting the value of the root node from the verification information V ₁ =(D ₁ ,k ₁ )), calculating the corresponding digital signature of the box x1 using the one-way function H as x1 = H(D1), obtaining the control root digital signature (batch value) R (in this example, the batch reference value R is stored in the reader's memory), and checking that the received control root digital signature R matches the potential root digital signature R ^c obtained from the read verification information (D1,k1) as digital signature through a one-way hash function H concatenation, according to the ordering the values of the nodes in the tree and the ordering of the concatenation of the tree, the values of the leaf node x1 (the leaf node a(1,1)) and the values of the nodes specified in the verification key k1. If R ^c HR then box A1 is fake. If R ^c = R, then the security marking 410 corresponds to that of the genuine box. In this case, you can perform a few additional security checks. For example, using a reader equipped with a display (such as the aforementioned smart phone), it is possible to extract any of the information 430a430d from the read digital data of the box D1, display the extracted information, and visually check that it matches the corresponding information printed on the box A1. If the displayed information does not match what is printed, the box is fake.

Additional verification of the authenticity of the A1 box is possible by verifying the authenticity

- 25 040918 security marking 415 based on material. It is sufficient to determine the positions of the dispersed particles by displaying the stamp 415 (for example, using the aforementioned smartphone capable of image processing) and calculate, based on these positions, the corresponding potential characteristic digital data CDD ^c -A1, and then check the actual similarity of these CDD ^c -A1 ( within a specified error) with the control characteristic digital data CDD-A1 extracted from the digital data of box D1: if they are similar, then stamp 415, and thus box A1, is authentic, if they are not similar, then stamp 415, and , so box A1 (the stamp is tamper-proof) is fake.

However, in the case of a verified match of the root digital signatures (i.e., R ^c = RB ^c = B), and even if the information 430a-430d has been verified and/or the material-based security marking 415 is genuine, it can be additionally checked whether whether the blister packs 401 contained in box A ₁ are correct: it is enough to check that the unique serial numbers 435 marked on the blister packs match the numbers indicated by the digital data of the box D1 read from the security marking 410. If these data do not match, this is counterfeit evidence: the blister packs of the genuine A1 box have been replaced by others (possibly counterfeit, or a different brand, or corresponding to a different drug). Moreover, still in the case of a genuine box A1 (i.e. with R ^c = R), even if the blister packs 401 are correct, in case any additional information extracted from the digital data of the box D1: MSRP 430e, country 430f of the market and the indication 430g of the restriction of sale does not correspond to the existing conditions of sale (for example, if the package of drug A1 is sold in a country other than the one indicated by data 430f), a corresponding fraud can be detected.

It is also a strong warning that the party itself, or at least part of it, has been redirected.

Thus, both the full traceability and control operations and the verification of the authenticity of secure drug packages are possible due to the tamper-proof communication provided according to the present invention through a root digital signature between the box data, the data of the contained blister packs, the unique characterizing physical properties of the box and the blister. packaging, as well as the belonging of the box to this lot.

As described above, the present invention is explicitly compatible with offline and local verification operations for verifying the authenticity of a security item or the consistency of data in an image (or copy) of a security item with respect to data associated with the original security item. However, the present invention is also compatible with an online verification process, such as by receiving (via a communication channel) a batch reference value from an external source (such as a server or blockchain), or performing some or all of the calculation steps involving a one-way function or a one-way adder through external computing means (for example, running on a server), or even verifying that the potential root digital signature matches the control root digital signature (and simply getting the result).

The foregoing subject matter is to be considered illustrative and not restrictive and serves to better understand the present invention as defined by the independent claims.

Claims (26)

CLAIM 1. A method for protecting a given original product belonging to a batch of a plurality of original products from counterfeiting or falsification, wherein each original product has its own product data associated with it and the corresponding digital product data, characterized in that the method includes steps for each original product of the batch calculating, by means of a one-way function, an article-associated digital signature of its corresponding article digital data; formation of a tree based on the set of calculated digital signatures of products for the original products of the batch, containing nodes located according to the specified ordering of nodes in the tree, while the specified tree contains levels of nodes, starting from leaf nodes corresponding to the set of digital signatures of products, respectively, associated with the set of original of products in the batch, up to the root node of the tree, each node, other than a leaf node, of the tree corresponds to a digital signature by means of a one-way concatenation function of the corresponding digital signatures of its child nodes according to the order of concatenation of the tree, the root node corresponds to the control root digital signature, i.e. digital signature by means of a one-way function of concatenation of digital signatures of nodes of the penultimate level of nodes in the tree according to the - 26 040918 given ordering of tree concatenation; linking with a given original product the corresponding verification key, which is a sequence of corresponding digital signatures, starting from the level of leaf nodes to the penultimate level of nodes, of each other leaf node that has the same parent node in the tree as the leaf node corresponding to the digital signature of the given original product , and sequentially at each next level in the tree, each node other than a leaf having the same parent node in the tree as the previous same parent node considered at the previous level; providing the user with a control root digital signature of the tree; and applying a machine-readable security marking to the predetermined original product, including the presentation of its corresponding digital product data and its corresponding verification key, thereby obtaining a marked original product, the product data of which is protected from forgery or falsification. 2. The method according to claim 1, characterized in that the control root digital signature of the root node of the tree is either published in an environment open to the user, or stored in a searchable root database open to the user, or stored in the blockchain, or stored in blockchain-protected database open to the user. 3. The method according to claim 2, characterized in that the marked original product additionally contains data on access to the root node marked on it and containing information sufficient to provide the user with access to the control root digital signature of the root node of the tree corresponding to the batch of original products, wherein said information is a link to the access interface, configured to receive from the user a root request containing product digital data or a digital signature of product digital data obtained from the security marking of the marked original product, and send back the control root digital signature of the corresponding tree, while The access interface provides access, respectively, to one of the following: the environment in which the control root digital signature is published; a searchable root database in which the control root digital signature is stored; and a blockchain or, respectively, a database protected by a blockchain in which a control root digital signature with a timestamp is stored. 4. The method according to any one of claims 1 to 3, characterized in that the virtual product is considered to belong to a batch of original products, while the specified virtual product has data associated with the virtual product and its corresponding digital data of the virtual product, as well as associated with the virtual product a digital signature obtained through a one-way digital data function of a virtual item, said virtual item is not created, but only used to generate a digital signature associated with the virtual item; and the control root digital signature associated with the specified batch of original products is calculated from a tree having all digital signatures of the original products of the batch, including the digital signature of the virtual product, in the form of leaf nodes. 5. The method according to any one of claims 1 to 4, characterized in that the additional digital product data corresponding to the digital product data associated with the marked original product is stored in a searchable information database open to the user through the information database interface , configured to receive from the user a request for information containing digital product data or a digital signature of digital product data obtained from the security marking of the marked original product, and send back the corresponding additional digital product data. 6. The method according to claim 5, characterized in that additional digital product data corresponding to digital product data associated with the marked original product are concatenated with said digital product data. 7. The method according to any one of claims 1 to 6, characterized in that the digital data of the marked original product includes the corresponding control characteristic digital data of a unique physical characteristic of the marked original product or an associated object or person. 8. The method of claim 7, wherein the unique physical characteristic of the marked original product is a characteristic of a material-based security marking applied to the original product or to a related object. 9. The method according to any one of claims 1 to 8, characterized in that in the case of the distribution of digital data of the corresponding original products of the batch between given fields common to all products - 27 040918 batches, and the numeric data related to these fields are not included in the product numeric data, but are grouped in a separate field data block associated with the batch, and at the same time i) the digital signature of the original product is calculated using a one-way concatenation function of the corresponding digital data of the product and the digital data of the field data block; and ii) the control root digital signature is made available to the user along with the associated field data block. 10. A method for verifying the authenticity of a product or the conformity of a copy of such a product with respect to a branded original product belonging to a batch of original products protected according to the method according to any one of claims 1 to 8, wherein the method includes the steps of considering a test object that is a specified product or a specified a copy of the article, obtaining a digital image of the security mark on the test object by means of an image forming apparatus having an imaging unit, a memory processing unit, and an image processing unit; reading a digital product data representation and an associated verification key in the received digital image of the security marking on the test object, and extracting, respectively, the respective test digital product data and the test verification key from said read representation; storing in memory the control root digital signature of the root node of the tree of the batch of original products and programming in the one-way function processing unit to calculate the digital signature of the digital data and concatenate the digital signatures according to the order of the nodes in the tree and the order of the concatenation of the tree; verifying that the extracted product test digital data actually matches the associated test key of verifying the stored control root digital signature by performing the calculation steps using the one-way test digital signature function of the extracted product test digital data, wherein said test digital signature corresponds to a test leaf node in the test tree corresponding to protective marking on the test object; extracting from the sequence of digital signatures in the test digital signature verification key of each other leaf node of the test tree having the same parent node as the test leaf node, and calculating the digital signature of the concatenation of the test digital signature and the extracted digital signature of said each other leaf node, thereby thereby obtaining a digital signature of said same parent node of the test leaf node; sequentially at each next level in the test tree and up to the penultimate level of extraction nodes from the sequence of digital signatures in the test key for verifying the digital signature of each other node, different from the leaf, test tree, which has the same parent node as the previous same parent node considered in the preceding step, and calculating a digital signature concatenating the digital signature of said respective each other node other than a leaf node and the obtained digital signature of said previous same parent node, thereby obtaining a digital signature of said same parent node of said previous same parent node; computing a digital signature of a concatenation of the obtained digital signatures of nodes other than leaf nodes corresponding to the penultimate level of nodes of the test tree, thereby obtaining a potential root digital signature of the root node of the test tree; and checking that the obtained candidate root digital signature matches the stored control root digital signature, whereby, if said root digital signatures match, the product data on the test object is genuine product data. 11. The method according to claim 10, characterized in that the marked original product is protected according to the method according to claim 9, the memory of the processing unit additionally stores the associated field data block, and at the same time, the step of calculating the test digital signature corresponding to the test leaf node in the test tree, corresponding to the security marking on the test object involves calculating, using the one-way digital signature function, the concatenation of the extracted product test digital data and the digital data of the stored field data block. 12. The method according to any one of claims 10 and 11, characterized in that the product is protected by storing the control root digital signature in a searchable root database open to the user according to the method according to claim 2, and the imaging device is additionally equipped with a communication unit configured to send and receive back data via a communication channel, the method including the preliminary steps of sending a request to the specified root database by the communication unit via the communication channel and receiving back the control root digital signature; and storing the received root digital signature in the memory of the imaging device. 13. The method according to any one of claims 10 and 11, characterized in that the product is protected according to the method according to claim 3, the image forming device is additionally equipped with a communication unit configured to send and receive data via a communication channel, while the method includes preliminary the steps of reading the root access data tagged on the test object with the imaging apparatus; sending by the communication unit via the communication channel a root request to the specified access interface containing digital product data or a digital signature of said digital product data obtained from the security marking on the test object, and receiving back the corresponding control root digital signature of the associated batch; and storing the received control root digital signature in the memory of the imaging device. 14. The method according to any one of claims 10-13, characterized in that the product is protected according to the method according to any one of claims 5 and 6, and the image forming device is additionally equipped with communication means configured to send a request to the information database interface for information containing digital product data or the corresponding product digital signature data obtained from the security marking on the test object, and receiving back the corresponding additional digital product data. 15. The method according to any one of claims 10 to 14, characterized in that the product is protected according to the method according to any one of claims 7 and 8, and the imaging device is additionally equipped with a sensor configured to detect a unique physical characteristic of a respectively marked original product or of the associated object or person, and the processing unit is programmed to extract the corresponding characteristic digital data from the detection signal received from the sensor, the imaging device stores in memory the control characteristic digital data CDD corresponding to the specified unique physical characteristic of the appropriately marked original product or associated object or person wherein the method includes the additional steps of viewing a subject that is said article or said associated object or person, detecting with a sensor a unique physical characteristic of the subject, and extracting the corresponding potential characteristic digital data CDD ^c ; comparing the obtained potential characteristic digital data CDD ^c with the stored control characteristic digital data CDD; and if the potential CDD characteristic numeric data ^c is similar to the stored control CDD characteristic numeric data, with the specified tolerance criterion, the subject is considered to correspond, respectively, to a genuine product or an object or person actually associated with a genuine product. 16. A method for verifying the conformity of a digital image of a product with respect to a marked original product belonging to a batch of original products protected according to the method according to any one of claims 1 to 8, the method includes the steps of obtaining a digital image of the product showing a security marking on the product, by means of a device for forming an image having an image forming unit, a memory processing unit, and an image processing unit; reading a product digital data representation and an associated verification key in the received security marking digital image and extracting corresponding product test digital data and an associated test verification key from said read representation, respectively; storing in memory the control root digital signature of the root node of the tree of the batch of original products and programming in the one-way function processing unit to calculate the digital signature of the digital data and concatenate the digital signatures according to the order of the nodes in the tree and the order of the concatenation of the tree; verification of the actual correspondence of the extracted test digital data of the product and the test key of verification of the stored control root digital signature by performing the steps of calculating using the one-way function of the test digital signature of the extracted test digital data of the product, while the specified test digital signature corresponds to a test leaf node in the test tree corresponding to the security marking on the test object; extracting from the sequence of digital signatures in the test digital signature verification key of each other leaf node of the test tree having the same parent node as the test leaf node, and calculating the digital signature of the concatenation of the test digital signature and the extracted digital signature of said each other leaf node, thereby thereby obtaining a digital signature of said same parent node of the test leaf node; - 29 040918 sequentially at each next level in the test tree and up to the penultimate level of extraction nodes from the sequence of digital signatures in the test digital signature verification key of each other node, other than a leaf, test tree, which has the same parent node as the previous same parent the node discussed in the previous step, and computing the digital signature of the concatenation of the digital signature of the digital signature of the specified corresponding each other node other than the leaf, and the resulting digital signature of the specified previous same parent node, thereby obtaining a digital signature of the specified same parent node of the specified previous same parent node; computing a digital signature of a concatenation of the obtained digital signatures of nodes other than leaf nodes corresponding to the penultimate level of nodes of the test tree, thereby obtaining a potential root digital signature of the root node of the test tree; and checking that the obtained potential root digital signature matches the stored control root digital signature, whereby, if said root digital signatures match, the digital image of the product is an image of a genuine branded original product. 17. The method according to claim 16, characterized in that the marked original product is protected according to the method according to claim 9, the memory of the processing unit additionally stores the associated field data block, and at the same time, the step of calculating the test digital signature corresponding to the test leaf node in the test tree, corresponding to the security marking on the test object involves calculating, using the one-way digital signature function, the concatenation of the extracted product test digital data and the digital data of the stored field data block. 18. The method according to any one of claims 16 and 17, characterized in that the original product is protected by storing a control root digital signature in a searchable root database open to the user according to the method according to claim 2, and the imaging device additionally equipped with a communication unit configured to send and receive back data via a communication channel, the method including the preliminary steps of sending a request to the specified root database via the communication channel and receiving back the control root digital signature; and storing the received root digital signature in the memory of the imaging device. 19. The method according to any one of claims 16-18, characterized in that the original product is protected according to the method according to any one of claims 7 and 8, and the imaging device is additionally equipped with a sensor configured to detect a unique physical characteristic, respectively, of an object or a person associated with the marked original product, and the processing unit is programmed to extract the corresponding characteristic digital data from the detection signal received from the sensor, the imaging device stores in memory the control characteristic digital data CDD corresponding to the specified unique physical characteristic, respectively, of the associated object or a person, wherein the method includes additional steps, when considering a subject representing the specified associated object or person: detecting with the sensor a unique physical characteristic of the subject and extracting the corresponding potential characteristic digital data CDD ^c ; comparing the obtained potential characteristic digital data CDD ^c with the stored control characteristic digital data CDD; and if the potential CDD characteristic numeric data ^c is similar to the stored control CDD characteristic numeric data, with the specified tolerance criterion, the subject is considered to correspond, respectively, to the object or person actually associated with the genuine marked original product. 20. A product belonging to a batch of a plurality of original products and protected from forgery or falsification according to the method according to any one of claims 1 to 9, while each original product of the batch has its own digital product data and the corresponding verification key, the specified batch has a corresponding control root digital a signature, wherein the product contains a machine-readable security marking applied to the product and including the representation of its digital data of the product and its verification key. 21. The product according to claim 20, wherein the digital product data includes CDD control characteristic digital data of the corresponding unique physical characteristic of the product or associated object or person. 22. The product according to claim 21, characterized in that the unique physical characteristic of the product is a characteristic of a material-based security marking applied to the product. 23. A system for verifying the authenticity of a product or the conformity of a copy of such a product with respect to - 30 040918 a clearly marked original product belonging to a batch of original products protected according to the method according to any one of claims 1 to 8, while the system contains an image forming device having an image forming unit, a memory processing unit and an image processing unit, with in this case, the memory stores the control root digital signature of the tree corresponding to the batch of original products, and a one-way function for calculating the digital signature of digital data and concatenating digital signatures according to the order of nodes in the tree and the order of concatenation of the tree programmed in the processing unit, while this system is configured to obtain using a device for forming an image of a digital image of a security marking on a test object, which is a specified product or a specified copy of the product; reading, with the imaging apparatus, a representation of the article digital data and the associated verification key in the received digital image of the security marking on the test object, and extracting, respectively, the respective test article digital data and the test verification key from said read representation; verification of the actual correspondence of the extracted test digital data of the product and the associated verification key of the stored control root digital signature by performing on the processing unit additional programmed calculation steps using the one-way function of the test digital signature from the calculated test digital signature of the extracted test digital data of the product, while the specified test digital signature corresponds to a test leaf node in the test tree corresponding to a security marking on the test object; extracting from the sequence of digital signatures in the test digital signature verification key of each other leaf node of the test tree having the same parent node as the test leaf node, and calculating the digital signature of the concatenation of the test digital signature and the extracted digital signature of said each other leaf node, thereby thereby obtaining a digital signature of said same parent node of the test leaf node; sequentially at each next level in the test tree and up to the penultimate level of extraction nodes from the sequence of digital signatures in the test key for verifying the digital signature of each other node, different from the leaf, test tree, which has the same parent node as the previous same parent node considered in the preceding step, and calculating a digital signature concatenating the digital signature of said respective each other node other than a leaf node and the obtained digital signature of said previous same parent node, thereby obtaining a digital signature of said same parent node of said previous same parent node; computing a digital signature of the concatenation of the obtained digital signatures of the non-leaf nodes corresponding to the penultimate level of the test tree nodes, thereby obtaining a potential root digital signature of the root node of the test tree; and checking that the obtained candidate root digital signature matches the stored control root digital signature, whereby, if said root digital signatures match, the system is configured to deliver an indication that the item data on the test object is genuine item data. 24. The system according to claim 23, characterized in that the marked original product is protected according to the method according to claim 9, the memory of the processing unit additionally stores the associated field data block, and at the same time, the step of calculating the test digital signature corresponding to the test leaf node in the test tree, corresponding to the security marking on the test object involves calculating, using the one-way digital signature function, the concatenation of the extracted product test digital data and the digital data of the stored field data block. 25. The system for verifying the conformity of the digital image of the product with respect to the marked original product belonging to the batch of original products protected according to the method according to any one of claims 1-8, while the system contains an image forming device having an image forming unit, a processing unit with memory and an image processing unit, wherein the memory stores a control root digital signature of the tree corresponding to the batch of original products, and a one-way function for calculating the digital signature of digital data and concatenating digital signatures according to the order of nodes in the tree and the order of concatenation of the tree programmed in the processing unit, while specified the system is configured to obtain a digital image of the product, showing a security mark on the product, by means of a display device; reading, with an imaging device, a product digital data representation and an associated verification key in the received security marking digital image, and extracting, respectively, the corresponding product test digital data and the associated test verification key from said read representation; verification of the actual correspondence of the extracted test digital data of the product and the test key of verification of the stored control root digital signature by performing additional programmed calculation steps on the processing unit using the one-way function of the test digital signature of the extracted test digital data of the product, while the specified test digital signature corresponds to the test leaf node in a test tree corresponding to the security marking on the test object; extracting from the sequence of digital signatures in the test digital signature verification key of each other leaf node of the test tree having the same parent node as the test leaf node, and calculating the digital signature of the concatenation of the test digital signature and the extracted digital signature of said each other leaf node, thereby thereby obtaining a digital signature of said same parent node of the test leaf node; sequentially at each next level in the test tree and up to the penultimate level of extraction nodes from the sequence of digital signatures in the test key for verifying the digital signature of each other node, different from the leaf, test tree, which has the same parent node as the previous same parent node considered in the preceding step, and calculating a digital signature concatenating the digital signature of said respective each other node other than a leaf node and the obtained digital signature of said previous same parent node, thereby obtaining a digital signature of said same parent node of said previous same parent node; computing a digital signature of the concatenation of the obtained digital signatures of the non-leaf nodes corresponding to the penultimate level of the test tree nodes, thereby obtaining a potential root digital signature of the root node of the test tree; and checking that the obtained potential root digital signature matches the stored control root digital signature, whereby, if said root digital signatures match, the system is configured to deliver an indication that the digital image of the product is an image of a genuine branded original product. 26. The system according to claim 25, characterized in that the marked original product is protected according to the method according to claim 9, the memory of the processing unit additionally stores the associated field data block, and at the same time, the step of calculating the test digital signature corresponding to the test leaf node in the test tree, corresponding to the security marking on the test object involves calculating, using the one-way digital signature function, the concatenation of the extracted product test digital data and the digital data of the stored field data block.