EA042505B1 - PROTECTION OF THE DIGITAL FILE FROM FORGERY - Google Patents

Description

The field of technology to which the invention belongs

The invention relates to the field of protection of digital data from forgery or falsification, as well as the possibility of tracking digital files.

State of the art

The problems of forgery and falsification of digital files are well known and serious, and their number is constantly growing. A well-known example is the falsification of data printed on an original digital document, such as a digital identity document or a digital version of a diploma, and the situation is even worse when considering a digital copy of the original (possibly genuine) digital document. Simply keeping track of identifiers such as serial numbers, or even including some digital watermarks, is generally a weak solution, as counterfeiters can easily copy such numbers or digital watermarks.

Another disadvantage of most traditional methods of authenticating digital files or protecting their digital data is that they tend to view files in isolation, even if they are members of a well-defined group, such as a digital document package. This ignores valuable authentication information.

Thus, the aim of the present invention is to protect the printed digital file from forgery and falsification of data associated with it and, in particular, data relating to its belonging to a certain package of digital files. It is also an object of the present invention to enable offline verification of the authenticity of a printed digital file protected according to the present invention and the conformity of the contents of its digital data with the contents of a genuine digital file. The present invention also aims at protecting printable digital files so that it is easy to verify the authenticity of the data content of both printable digital files and their printed versions. In particular, it is an object of the present invention to protect print-ready digital files, where the print-ready digital file is known as a print file that meets the following criteria: all (possible) RGB images are converted to CMYK color, the file is in a proper format such as PSD, EPS, AL, high resolution JPG, PDF or TIF, and the final image is of sufficient resolution (i.e. 300 dpi or higher).

Brief description of the invention

According to one aspect, the present invention relates to a method for protecting a given original digital file belonging to a package of a plurality of original digital files from forgery or falsification, wherein each original digital file includes its own digital data, the method being characterized in that it includes steps for each original digital file of the package, calculating by means of a one-way function the signature of its digital data associated with the digital file;

forming a tree based on a set of calculated signatures of digital files for original digital files of a package containing nodes located according to a given ordering of nodes in the tree, while the specified tree contains levels of nodes, starting from leaf nodes corresponding to a set of signatures of digital files, respectively, associated with a set original digital files in the package, up to the root node of the tree, each node, other than a leaf, of the tree corresponds to a digital signature through a one-way function of concatenation of the corresponding digital signatures of its child nodes according to the order of the concatenation of the tree, the root node corresponds to the root control digital signature, that is, a digital signature through one-way function of concatenation of digital signatures of nodes of the penultimate level of nodes in the tree according to the specified ordering of the concatenation of the tree;

linking with a given original digital file the corresponding digital verification key, which is a sequence of corresponding digital signatures, starting from the level of leaf nodes to the penultimate level of nodes, of each other leaf node that has the same parent node in the tree as the leaf node corresponding to the signature of the given original digital file, and sequentially at each next level in the tree, each node, other than a leaf, having the same parent level in the tree as the previous same parent node considered at the previous level;

providing the user with a control root digital signature of the tree and including in the given original digital file an appropriate digital security marking containing a machine-readable representation of its digital data and its corresponding digital verification key, thereby obtaining a marked original digital file whose digital data is protected from forgery or falsification .

Thus, if a digital security mark included in a digital file is printable as a barcode, the printed document (including the printed barcode) obtained by printing the secure digital file (by means of a conventional printing device) is also protected, i.e. its printed data is protected from forgery or falsification.

- 1 042505

The control root digital signature of the root node of the tree can either be published in an environment open to the user, or stored in a searchable root database, open to the user, or stored on the blockchain, or stored in a blockchain-secured database, open to the user. Thus, the control root digital signature becomes immutable.

Thus, according to the present invention, interweaving the digital signatures of all the original digital files of the package, thanks to the tree structure and the use of reliable one-way functions to calculate the values of the tree nodes, together with the root digital signature of the tree made unchanged, and the inclusion of the digital data and the associated digital verification key in the digital security markings included in the corresponding original digital file, allow the tracking and control of the marked files and their copies, as well as their printed versions, with a very high level of reliability, while preventing data falsification and counterfeiting of the marked files.

The marked original digital file may additionally contain data on access to the root node included in it and containing information sufficient to provide the user with access to the control root digital signature of the root node of the tree corresponding to the package of original digital files, while this information is a link to the access interface , configured to receive from the user a root request containing digital data or a digital file signature obtained from the digital security marking of the marked original digital file, and send back the control root digital signature of the corresponding tree, while the access interface provides access to, respectively, one of next:

the environment in which the control root digital signature is published;

a searchable root database in which the control root digital signature is stored; and a blockchain, or, respectively, a database protected by a blockchain in which a control root digital signature with a timestamp is stored.

According to the present invention, it is also possible that the virtual digital file is considered to belong to a package of original digital files, said virtual digital file including its own virtual digital data and a signature associated with the virtual digital file obtained by means of a virtual digital data one-way function, said virtual digital file the digital file is not real, but is only used to generate a signature associated with the virtual digital file from its virtual digital data; and a control root digital signature associated with said package of original digital files is computed from a tree having all of the package's original digital file signatures, including the virtual digital file signature, as leaf nodes.

In order to obtain shorter signatures, the one-way function may be a hash function, and the digital signature of the original digital file may be a sequence of a given set of bits with lower bit values selected from the hash bits of the corresponding digital data.

In the above method, additional digital data corresponding to the digital data associated with the tagged original digital file can be stored in a searchable information database open to the user through an information database interface configured to receive from the user an information request containing digital data or signature of a digital file, obtained from the digital security marking of the marked original digital file, and sending back the corresponding additional digital data.

The digital data of the tagged original digital file may further include reference characteristic digital data of the corresponding unique physical characteristic of the associated object or person. Moreover, the unique physical characteristic of the associated object or person may be, respectively, a characteristic of a material-based security marking applied to the associated object or an identifying biometric feature of the associated person.

In the above method, the sequence of digital signatures in the digital verification key included in the digital security marking may be arranged according to the ordering of the node sequences, which differs from the ordering of the corresponding nodes determined by the tree concatenation ordering, and the digital security marking may further include an ordering code associated with said ordering of sequences. These features increase the level of security against cryptanalytic attacks.

According to the present invention, in the case of distributing the digital data of the respective original digital files of a packet between given fields common to all digital files

- 2 042505 package, the specific numeric data related to these fields may not be included in the numeric data, but may be grouped into a separate field data block associated with the package, while:

i) the signature of the original digital file is computed by a one-way concatenation function of the corresponding digital data and the field data block; and ii) the control root digital signature is made available to the user along with the associated field data block.

Another aspect of the present invention relates to a method for verifying the authenticity of a digital file protected according to the above protection method, or the correspondence of a copy of such a protected digital file relative to the original file, the method comprising the steps of processing a test file representing said digital file or said copy of the digital file , by means of a processing unit connected to the storage memory in the memory of the test file;

reading a digital data representation and a digital verification key on the digital security marking of the stored test file and extracting corresponding test digital data and a test digital verification key from said read representation, respectively;

storing in memory the control root digital signature of the root node of the original digital file package tree, and programming in the one-way function processing unit to calculate the digital signature of the digital data and concatenate the digital signatures according to the node order in the tree and the tree concatenation order;

verification of the actual correspondence of the extracted test digital data and the associated test digital key of verification of the stored control root digital signature by performing the steps:

calculating, with a one-way test digital signature function, the extracted test digital data, said test digital signature corresponding to a test leaf node in the test tree corresponding to the digital security marking of the test file;

extracting from the sequence of digital signatures in the test digital signature verification key of each other leaf node of the test tree having the same parent node as the test leaf node, and calculating the digital signature of the concatenation of the test digital signature and the extracted digital signature of said each other leaf node, thereby obtaining a digital signature of said same parent node of the test leaf node;

sequentially at each next level in the test tree and up to the penultimate level of nodes, extracting from the sequence of digital signatures in the test digital key verification of the digital signature of each other node, different from the leaf, test tree, which has the same parent node as the previous same parent node , discussed in the previous step, and calculating the digital signature of the concatenation of the digital signature of the specified corresponding each other node other than a leaf, and the resulting digital signature of the specified previous same parent node, thereby obtaining a digital signature of the specified same parent node of the specified previous same parent node ;

computing a digital signature of the concatenation of the obtained digital signatures of the non-leaf nodes corresponding to the penultimate level of the test tree nodes, thereby obtaining a potential root digital signature of the root node of the test tree; and checking that the received candidate root digital signature matches the stored control root digital signature, whereby, if said root digital signatures match, the digital data of the test file is the data of the original digital file.

If the marked original digital file is protected while having the aforementioned separate field data block, the memory of the processing block may additionally store the associated field data block, and the step of calculating the test digital signature corresponding to the test leaf node in the test tree corresponding to the digital security mark on the test file, may involve calculating, with a one-way digital signature function, the concatenation of the extracted test digital data and the stored field data block.

If the digital file has been protected by storing the control root digital signature in a searchable root database open to the user as mentioned above, and the processing unit is further connected to the communication unit configured to send and receive back data via a communication channel, the above method verification may include the preliminary steps of sending a request to the specified root database by the communication channel through the communication channel and receiving back the control root digital signature and storing the received root digital signature in the memory memory.

If the secure digital file contains root access data as disclosed above, and the processing unit is further connected to a communication unit capable of sending and receiving data via a communication channel, the above verification method may include the preliminary steps of reading the data via access to the root node included in the test file;

sending by the communication unit via the communication channel a root request to the specified access interface containing digital data or a digital signature of the specified digital data obtained from the digital security marking on the test file, and receiving back the corresponding control root digital signature of the associated package; and storing the control root digital signature in memory.

If the tagged digital file has associated additional digital data stored in a searchable information database as mentioned above, the imaging device may further be equipped with communication means configured to send an information request containing the digital data to the information database interface. or a signature of the digital file, obtained from the digital security marking of the test file, and receiving back the corresponding additional digital data.

If the protected digital file includes reference characteristic digital data as mentioned above, and the imaging device is further equipped with a sensor capable of detecting a unique physical characteristic of a correspondingly associated object or person, and the processing unit is programmed to extract the corresponding characteristic digital data from the detection signal, received from the sensor, the imaging device stores in memory the CDD reference characteristic digital data corresponding to the specified unique physical characteristic of the corresponding associated object or person, the verification method may include additional steps, when considering the subject, which is the specified associated object or person:

detecting with the sensor a unique physical characteristic of the subject and extracting the corresponding potential characteristic digital data CDD ^c ;

comparing the obtained potential characteristic digital data CDD ^c with the stored reference characteristic digital data CDD; and if the potential characteristic digital data CDD ^c is similar to the stored control characteristic digital data (CDD), with a predetermined tolerance criterion, the subject is considered to correspond, respectively, to an authentic object or person actually associated with an authentic digital file.

Another aspect of the present invention relates to a digital file belonging to a package of a plurality of original digital files and protected according to the above protection method, wherein each original digital file of the package has its own digital data and a corresponding digital verification key, said package has a corresponding control root digital signature, the digital file contains a machine-readable security mark including a representation of its digital data and its verification key. The digital data of the digital file may further include the control characteristic digital data CDD corresponding to the unique physical characteristic of the associated object or person. Moreover, a unique physical characteristic of the associated object may be a characteristic of a material-based security marking applied to the associated object.

Another aspect of the present invention relates to a system for verifying the authenticity of a digital file or the correspondence of a copy of such a digital file with respect to a marked original digital file belonging to a package of original digital files protected according to the above protection method, the system comprising an imaging device having an imaging unit, a memory processing unit and an image processing unit, wherein the memory stores the control root digital signature of the tree corresponding to the original digital file package, and a one-way function for digital signature calculation of digital data and digital signature concatenation according to the tree node order and the tree concatenation order programmed in the block processing, wherein said system is configured to store in memory a test file representing said digital file or said copy of the digital file;

reading a digital data representation and a digital verification key on the digital security marking of the stored test file and extracting corresponding test digital data and a test digital verification key from said read representation, respectively;

verification of the actual correspondence of the extracted test digital data and the test digital key of verification of the stored control root digital signature by performing the programmed operations on the processing unit:

calculating, with a one-way test digital signature function, the extracted test digital data, said test digital signature corresponding to a test leaf node in the test tree corresponding to the digital security marking of the test file;

extracting from the sequence of digital signatures in the test digital signature verification key of each other leaf node of the test tree having the same parent node as the test leaf node, and calculating the digital signature of the concatenation of the test digital signature and the extracted digital signature of said each other leaf node, thereby obtaining a digital signature of said same parent node of the test leaf node;

sequentially at each next level in the test tree and up to the penultimate level of nodes, extracting from the sequence of digital signatures in the test digital key verification of the digital signature of each other node, different from the leaf, test tree, which has the same parent node as the previous same parent node , discussed in the previous step, and calculating the digital signature of the concatenation of the digital signature of the specified corresponding each other node other than a leaf, and the resulting digital signature of the specified previous same parent node, thereby obtaining a digital signature of the specified same parent node of the specified previous same parent node ;

computing a digital signature of the concatenation of the obtained digital signatures of the non-leaf nodes corresponding to the penultimate level of the test tree nodes, thereby obtaining a potential root digital signature of the root node of the test tree; and checking that the received candidate root digital signature matches the stored control root digital signature, whereby, if said root digital signatures match, the system is configured to deliver an indication that the digital data of the test file is the data of a genuine digital file.

In the above system, if the tagged original digital file has an associated field data block as mentioned above, the memory of the processing unit additionally stores the associated field data block, the programmed test digital signature calculation operations corresponding to the test leaf node in the test tree corresponding to the digital security mark of the test file , then include the calculation using a one-way digital signature function of the concatenation of the extracted test digital data and the stored field data block.

If the tagged original digital file belongs to a package of original digital files protected by including control characteristic digital data corresponding to the unique physical characteristic of the associated object or person, as mentioned above, the above system is additionally equipped with a sensor connected to the processing unit and configured to detect the unique physical characteristic of the associated object or person, and the processing unit is programmed to extract the corresponding characteristic digital data from the detection signal received from the sensor, the system stores in memory the control characteristic digital data CDD corresponding to the specified unique physical characteristic of the associated object or person, while the system can additionally be configured to detect, by means of a sensor, a unique physical characteristic of a subject representing said associated object, or human, and extracting the corresponding potential characteristic digital data CDD ^c ;

comparing the received candidate characteristic digital data CDD ^c with the stored control characteristic digital data CDD and in the case of similarity of the potential characteristic digital data CDD ^c with the stored control characteristic digital data CDD, subject to a predetermined tolerance criterion, delivering an indication that the subject is considered genuine.

Hereinafter, the present invention will be described more fully with reference to the accompanying drawings, in which like numerals represent like elements in different figures, and in which the main aspects and features of the present invention are illustrated.

Brief description of the drawings

In FIG. 1 is a schematic view of a general method for protecting a package of original digital files according to the present invention.

In FIG. 2A illustrates a secure digital biometric passport as an example of a digital biometric identity document secured in accordance with the present invention.

In FIG. 2B illustrates a control of a person having a secure digital biometric passport according to FIG. 2A by an authorized employee.

In FIG. 3 illustrates a package of digital documents relating to aircraft components protected in accordance with the present invention.

- 5 042505

Detailed description

The present invention is herein described in detail with reference to the non-limiting embodiments illustrated in the drawings.

In FIG. 1 illustrates a general method according to the present invention relating to the protection of a package of digital files, and to a method for calculating the encoding of verified information that can be associated with each digital file. In FIG. 1 illustrates a group or package of digital files A1...,A ₈ containing a digital representation of a machine-readable security mark 110 (in this case illustrated with a two-dimensional barcode). Hereinafter, the expression digital security marking 110 actually means the digital representation of the machine-readable security marking 110. In FIG. 1 actually illustrates a group or package of digital files and their associated tree, with only eight original digital files shown for simplicity: A1...,A ₈ . Also for simplicity, the tree associated with the file package A1...,A ₈ in this case is a simple binary tree. A digital file may refer to a product or its packaging, a physical document or image, a package containing multiple products (such as a drug blister pack), or a container containing pallets of product cartons, etc. Not only an object, but even a person can be associated with a digital file in the context of embodiments of the present invention; for example, authorized event participants or group members, or herd or flock members may wear some form of identification badge or have a physical marking containing the data recorded in the associated digital file.

A package of digital files may, for example, refer to a normal production cycle, goods delivered by a specific supplier, goods manufactured or shipped over a period of time, a set of related images, a group of people, a herd or flock, or any other user-defined grouping of any objects, for which a digital file Ai (having digital content Di) can be defined.

Any of the products shown in Fig. 1 may be a virtual product A _v , which is an optional piece of software that may be included to provide encoding of the selected data. This is explained next. For example, one of the eight items, for example item A ₈ , may actually be a virtual item A _v that is considered to belong to a package of eight items, and is treated like any of the other seven real items, since it can be processed essentially the same path (although it does not correspond to the real object). Of course, the set of virtual products A _v1 ,A _v2 ,...,A _vk can be used to encode digital data and create more secure digital signatures of the product (see below).

For each product A _b A ₂ ,...,A ₇ ,A ₈ of the package (where possible A ₈ ^ A _v ) the corresponding digital data of the product D1,D ₂ ,...,D7,D ₈ (where possible D ₈ ^ D _v ) are linked or retrieved (or in the case of the Av virtual item, created) using any suitable method. This data may be some measure of physical characteristics, textual data such as a completed form or product information, a serial number or other identifier, content indications, a digital representation of an image, or any other information that the system designer chooses to associate with the product. The digital product data Di can be extracted from human readable data (e.g., alphanumeric data) marked on the associated product (e.g., printed on the product or on a label affixed to the product) by a reader capable of generating the corresponding digital file data. A _i . Additional digital data (eg, a command to use the associated product or a security command, etc.) may be associated with the retrieved data to create digital product data D _i .

For the Av virtual item, the associated digital data may include, for example, a package identification number, the number of items in the package, a (pseudo-) random number to increase security by increasing data entropy, date and/or time information, and so on. Another form of related data can be indications of valid or invalid transaction rules, expiration dates, and so on. In short, the Dv digital data can be anything that can be represented in digital form.

For each package item, its respective digital item data D1,D ₂ ,...,D7,D ₈ are preferably mathematically converted so that they are essentially hidden, although this is not an absolute requirement for any embodiment. This transformation, applied to the digital data Di of the product Ai, serves to create the corresponding digital signature xi. This digital signature is obtained by means of a one-way function, that is, a function that is easy to compute but difficult to invert (see S. Goldwasser and M. Bellare Lecture Notes on Cryptography, MIT, July 2008, http://www-cse.ucsd .edu/users/mihir).

One such advantageous transformation is, for example, applying the hash function H( ) = hash( ) to digital data, which usually has the property of returning an output of known length in bits, regardless of the size of the input: this technical effect is especially useful for

- 6 042505 creating a digital signature of digital data of a digital file (for example, associated with a product) regardless of the size of the digital data and the package size of the corresponding digital files. The hash function is a well-known example of a one-way function. If a cryptographic hash function is used, such as the SHA (Secure Hash Algorithm) function class, such as SHA-256, then there are additional advantages that the function is almost irreversible and collision resistant, i.e. the possibility that two different groups input data will lead to the same output data, is negligible. As will be clear from the description below, this is also not a requirement of the present invention, although it is advantageous for the same reasons as in other applications. As shown in FIG. 1, the values x1,x ₂ ,x ₃ ,...,x ₈ are hash values, that is, digital signatures associated with the products of the respective product data sets, namely Xj = H(Dj), for j = 1,. ..,8 (in the case A ₈ = A _v , then D ₈ = D _v and x ₈ = x _v = H(D _V )).

To shorten the signature, the digital signature Xj of item Aj can even be simply a sequence of a given set of bits with lower bit values selected from the bits of the hash value H(Dj): for example, using the SHA-256 hash function of the SHA-2 family, it is enough to store only 128 bits with the lower bit values of the 256 bits of the signature to still have a strong signature against a cryptanalytic attack.

In FIG. 1 shows a package of eight branded original products A1...,A ₈ , each with a corresponding security marking 110 affixed to it, and illustrates the method of protecting the products and their respective product-related digital data D1,...D ₈ ( symbolically represented on the files Ai in Fig. 1 by a sequence of bits 0 and 1) by means of a tree of digital signatures of digital data. The trees associated with digital signatures are well known (binary hash trees, n-ary hash trees or Merkle trees), they usually have base nodes or leaf nodes that are used to create nodes of the next (intermediate) level by digitally signing the concatenation of digital labels associated with leaf nodes according to a certain ordering of leaf nodes. In the case of a binary tree, the digital signatures associated with the nodes of the first intermediate level are respectively calculated by digitally signing (for example, with a one-way hash function H or a one-way elliptic curve function, etc.) the concatenation of the digital signatures associated with two consecutive leaf nodes . In the case of an n-ary tree, the values of the nodes of the first intermediate level are obtained by concatenating the values of n consecutive leaf nodes. A tree can also have a more complex structure (mixed trees), since the concatenation of leaf nodes can be done by pairs of consecutive nodes for certain leaf nodes, by a triple of nodes for other consecutive leaf nodes, and so on. For reasons of simplicity, a simple binary tree with eight leaf nodes is shown in FIG. 1: the corresponding values of the eight leaf nodes a(1,1),...,a(1,8) of the tree, respectively, correspond to the digital signatures of the product x1 = H(D1),..., x ₈ = H(D ₈ ). The value of the first index, i.e. 1, for all leaf nodes indicates the first level (or base level) of the tree, and the second index, going from 1 to 8, indicates the ordering of the (leaf) nodes of the tree. The values of the next level (non-leaf) nodes, i.e. the four second level nodes a(2,1), a(2,2), a(2,3), and a(2,4), are obtained by digitally signing the concatenation (symbolically represented by the + operator, in this case by means of a hash function, of the values of the pairs of leaf nodes, i.e. the pairs of their child nodes in the tree. This grouping of child nodes to obtain the values of the next level nodes determines the order in which the tree is concatenated. To simplify the notation, the node symbol a(i,j) is used to also represent its associated value (ie, its associated digital signature). In this case, the tree has only two intermediate levels above the level of leaf nodes and a root node at the top level. The root node level is actually the last level of the non-leaf node of the tree. Thus, the values of the four non-leaf nodes of the next intermediate level are a(2,1) = H(a(1,1)+a(1,2)), i.e. a(2,1) = H (H(D1)+ H(H(D ₂ )), (where a(1,1) and a(1,2) are children of node a(2,1)), a(2,2) = H(a(1,3)+a(1,4)), a(2,3) = H(a(1,5)+a(1,6)), a(2,4) = H( a(1,7)+a(1,8)), and for the next, penultimate, node level (in this case, the third level), two node values are presented:

a(3,1) = H(a(2,1)+a(2,2)), a(3,2) = H(a(2,3)+a(2,4)).

Note that for each node other than a leaf node, one can choose a different order of tree concatenation: for example, instead of having a(2,4) = H(a(1,7)+a(1,8)), we define that a(2,4) = H(a(1,8)+a(1,7)), which gives a different node value.

Finally, the value of the root node R of the tree or the control root digital signature is obtained as: R = H(a(3,1)+a(3,2)).

Because of the concatenation cascade involved in the tree, it is almost impossible to get the root value if any bit of digital data changes at the node (specifically, at the leaf node).

Moreover, if some virtual items are included in the package (the digital data of virtual items of which are known only to the system that creates digital signatures of tree leaf nodes), the counterfeiter will not be able to obtain a root digital signature, even knowing the digital data of all produced (and marked) items of the package.

According to the present invention, the control root digital signature R of a package of original digital files becomes immutable and therefore tamper-proof by publishing it in a (public) environment open to the user, who must verify the authenticity of the product (or data associated with it), or its stored in a searchable root database that is open to the user, or preferably stored on a blockchain (or blockchain-secured database) that is open to the user. The user can then save the control value R obtained from these available sources.

For each original digital file Ai of the package, the corresponding digital verification key ki (or verification path) of the linked tree is then computed as a sequence of corresponding digital signatures, starting from the leaf node level to the penultimate node level, of every other leaf node having the same parent node in the tree, as a leaf node corresponding to the digital signature of the original digital file A _i , and sequentially at each next level in the tree, of each node other than a leaf node having the same parent node in the tree as the previous same parent node considered at the previous level . In the example of FIG. 1 shows eight verification keys k ₁ ,...,k ₈ , respectively, corresponding to eight products A1,...,A ₈ of the package and their respective eight leaf nodes a(1,1),...,a(1, 8):

1) for a leaf node a(1,1) = x1 = H(D1) corresponding to product A1, the verification key is k1 = {a(1,2),a(2,2),a(3,2) } from which the value of the root digital signature R can be extracted through the following steps (performed according to the order of the nodes in the tree and the order of the concatenation of the tree):

i) from leaf node a(1,1) = x1 leaf node a(1,2) = x ₂ to k1 (a(1,2) is another leaf node that has the same parent node, i.e. node a( 2.1) that the leaf node corresponding to the digital signature of the product x1, i.e. the node a(1,1)), receive the value of the parent node a(2,1) by means of a(2,1) = H(a(1 ,1)+a(1,2)) (that is, a(2,1) = H(x1 + x ₂ )), ii) from the resulting a(2,1) and the value of the next node in k1, that is, a (2,2) the next level of non-leaf nodes, which is a non-leaf node that has the same parent node in the tree, i.e. node a(3,1), as the previous same parent node discussed in the previous level, i.e. node a(2,1), get the value of the parent node a(3,1) by a(3,1) = H(a(2,1)+a(2,2)), iii) from the resulting a(3,1) and the value of the next node in k1, that is, a(3,2) of the penultimate node level, which is a non-leaf node that has the same parent node l in the tree, i.e. the root node, as the previous same parent node discussed in the previous level, i.e. node a(3,1), get the value of the root node R by R = H(a(3,1)+a (3.2)).

Note: This example shows three steps i), ii) and iii) because the tree is three levels below the root node level and thus the verification key contains three node values.

Thus, the value of the root node of the tree can be obtained as R = H(H(H(a(1,1)+a(1,2))+a(2,2))+a(3,2)).

2) For a leaf node a(1,2) = x ₂ = H(D ₂ ) corresponding to product A2, the verification key is k ₂ = {a(1,1),a(2,2),a(3 ,2)} from which the root value R can be extracted through the following steps (performed according to the order of the nodes in the tree and the order of the concatenation of the tree):

i) from a(1,2) = x ₂ and a(1,1) = x1 to k1 (a(1,1) is another leaf node that has the same parent, i.e. node a(2,1 ) that the leaf node corresponding to the digital signature of item x ₂ , i.e. the node a(1,2)), obtains the value of the parent node a(2,1) by a(2,1) = H(a(1,1 )+a(1,2)), ii) from the resulting a(2,1) and the value of the next node in k ₂ , i.e. a(2,2) of the next level of non-leaf nodes, which is a node other than from a leaf having the same parent node in the tree, i.e. node a(3,1), as the previous same parent node considered in the previous level, i.e. node a(2,1), get the value of the parent node a( 3.1) by a(3,1) = H(a(2,1)+a(2,2)), iii) from the resulting a(3,1) and the value of the next node in k ₂ , i.e. a (3.2) penultimate node level, which is a node other than a leaf node that has the same parent node in the tree, i.e. the root node, as the previous one. Which parent node discussed in the previous level, i.e. the node a(3,1), gets the value of the root node R by R = H(a(3,1)+a(3,2)).

Thus, the value of the root node of the tree can be obtained as R =

- 8 042505

H(H(H(a(1,1)+a(1,2))+a(2,2))+a(3,2)).

3) For a leaf node a(1,3) = x ₃ = H(D ₃ ) corresponding to product A ₃ , the verification key is k ₃ = {а(1,4),a(2,1),a( 3,2)} from which the root value R can be extracted through the following steps (performed according to the order of the nodes in the tree and the order of the concatenation of the tree):

i) from a(1,3) = x ₃ and a(1,4) = x ₄ to k ₃ (a(1,4) is another leaf node that has the same parent, i.e. node a(2 ,2) that the leaf node corresponding to the digital signature of the product x ₃ , i.e. the node a(1,3)), obtain the value of the parent node a(2,2) by a(2,2) = H(a(1 ,3)+a(1,4)), ii) from the resulting a(2,2) and the value of the next node in k3, i.e. a(2,1) of the next level of non-leaf nodes, which is the node, other than a leaf, having the same parent node in the tree, i.e. node a(3,1), as the previous same parent node considered in the previous level, i.e. node a(2,2), get the value of parent node a (3,1) by means of a(3,1) = H(a(2,1)+a(2,2)), iii) from the resulting a(3,1) and the value of the next node in k ₃ , i.e. a(3,2) of the penultimate node level, which is a non-leaf node that has the same parent node in the tree, i.e. the root node, as the previous one. Which parent node discussed in the previous level, i.e. the node a(3,1), gets the value of the root node R by R = H(a(3,1)+a(3,2)).

Thus, the value of the root node of the tree can be obtained as: R = H(H(a(2,1)+H(a(1,3)+a(1,4)))+a(3,2)).

4) For a leaf node a(1,4) = x4 = H(D4) corresponding to product A4, the verification key is k4 = {а(1,3),a(2,1),a(3,2) } from which the root value R can be extracted through the following steps (performed according to the order of the nodes in the tree and the order of the concatenation of the tree):

i) from a(1,4) = x ₄ and a(1,3) = x ₃ to k ₄ get the value of the parent node a(2,2) by a(2,2) = H(a(1,3 )+a(1,4)), ii) from the obtained a(2,2) and the value of the next level in k4, i.e. a(2,1) of the next level of non-leaf nodes, get the value of the parent node a(3 ,1) by a(3,1) = H(a(2,1)+a(2,2)), iii) from the resulting a(3,1) and the value of the next node in k ₄ , i.e. a( 3,2) of the penultimate level of nodes, get the value of the root node R by R = H(a(3,1)+a(3,2)).

Thus, the value of the root node of the tree can be obtained as: R = H(H(a(2,1)+H(a(1,3)+a(1,4)))+a(3,2)).

5) For node a(1,5) = x ₅ = H(D5) corresponding to product A5, the verification key is k ₅ = {a(1.6),a(2.4),a(3.1 )} from which the root value R can be extracted through the following steps (performed according to the ordering of the nodes in the tree and the ordering of the concatenation of the tree):

i) from a(1,5) = x ₅ and a(1,6) = x ₆ in k ₅ get the value of the parent node a(2,3) by a(2,3) = H(a(1,5 )+a(1,6)), ii) from the received a(2,3) and the value of the next node in k ₅ , i.e. a(2,4) of the next level of non-leaf nodes, get the value of the parent node a( 3,2) by a(3,2) = a(3,2) = H(a(2,3)+a(2,4)), iii) from the resulting a(3,2) and the value of the next node in k ₅ , that is, a(3,1) of the penultimate node level, obtain the value of the root node R by R = H(a(3,1)+a(3,2)).

Thus, the value of the root node of the tree can be obtained as: R = H(a(3,1)+H(H(a(1,5)+a(1,6))+a(2,4))).

6) For node a(1,6) = x ₆ = H(D ₆ ) corresponding to item A6, the verification key is k ₆ = {a(1.5),a(2.4),a(3, 1)} from which the root value R can be extracted through the following steps (performed according to the order of the nodes in the tree and the order of the concatenation of the tree):

i) from a(1,6) = x ₆ and a(1,5) = x ₅ to k ₆ get the value of the parent node a(2,3) by a(2,3) = H(a(1,5 )+a(1,6)), ii) from the received a(2,3) and the value of the next node in k6, i.e. a(2,4) of the next level of nodes other than leaf nodes, get the value of the parent node a(3 ,2) by a(3,2) = a(3,2) = H(a(2,3)+a(2,4)), iii) from the resulting a(3,2) and the value of the next node in k ₆ , that is, a(3,1) of the penultimate node level, obtain the value of the root node R by R = H(a(3,1)+a(3,2)).

Thus, the value of the root node of the tree can be obtained as: R = H(a(3,1)+H(H(a(1,5)+a(1,6))+a(2,4))).

7) For node a(1,7) = x ₇ = H(D ₇ ) corresponding to item A ₇ , the verification key is k ₇ = {a(1.8),a(2.3),a(3 ,1)} from which the root value R can be extracted using the following

- 9 042505 steps (performed according to the order of the nodes in the tree and the order of the concatenation of the tree):

i) from a(1,7) = x ₇ and a(1,8) = x ₈ in k ₇ get the value of the parent node a(2,4) by a(2,4) = H(a(1,7 )+a(1,8)), ii) from the received a(2,4) and the value of the next node in k ₇ , i.e. a(2,3) of the next level of nodes other than leaf nodes, the value of the parent node a( 3.2) by a(3,2) = H(a(2,3)+a(2,4)), iii) from the resulting a(3,2) and the value of the next node in k ₇ , i.e. a (3,1) of the penultimate level of nodes, get the value of the root node R by R = H(a(3,1)+a(3,2)).

Thus, the value of the root node of the tree can be obtained as: R = H(a(3,1)+H(a(2,3)+H(a(1,7)+a(1,8)))).

8) For node a(1,8) = x ₈ = H(D ₈ ) corresponding to product A8, the verification key is k ₈ = {a(1,7),α(2,3),α(3, 1)} from which the root value R can be extracted through the following steps (performed according to the order of the nodes in the tree and the order of the concatenation of the tree):

i) from a(1,8) = x ₈ and a(1,7) = x ₇ to k ₈ get the value of the parent node a(2,4) by a(2,4) = H(a(1,7 )+a(1,8)), ii) from the received a(2,4) and the value of the next node in k ₈ , i.e. a(2,3) of the next level of non-leaf nodes, get the value of the parent node a( 3.2) by a(3,2) = H(a(2,3)+a(2,4)), iii) from the resulting a(3,2) and the value of the next node in k ₈ , i.e. a (3,1) of the penultimate level of nodes, get the value of the root node R by R = H(a(3,1)+a(3,2)).

Thus, the value of the root node of the tree can be obtained as: R = H(a(3,1)+H(a(2,3)+H(a(1,7)+a(1,8)))).

Generally, to extract a (potential) root node value, starting from a given leaf node value and the node values defined in the verification key associated with said given leaf node, the following steps are performed:

from the sequence of node values in the key of verifying the value (that is, the digital signature value) of every other leaf node of the tree having the same parent node as the given leaf node, and calculating the digital signature of the concatenation of the given node value and, accordingly, according to the ordering nodes in the tree and the ordering of the concatenation of the tree, the extracted value of said each other leaf node, thereby obtaining a digital signature of said same parent node of the given leaf node;

sequentially at each next level in the tree and up to the penultimate level of nodes:

extracting from the sequence of node values in the verification key the value of each other node, other than a leaf node, of the tree having the same parent node as the previous same parent node considered in the previous step, and calculating the digital signature of the concatenation of the value of the specified corresponding each other node , other than a leaf, and the received digital signature of the specified previous same parent node according to the order of the nodes in the tree and the order of concatenation of the tree, thereby obtaining the value of the specified same parent node of the specified previous same parent node; and computing a digital signature of the concatenation of the obtained non-leaf node values corresponding to the penultimate level of tree nodes according to the node order in the tree and the tree concatenation order, thereby obtaining a root digital signature of the tree root node.

As is clear from the above example, the root node value R can finally be extracted from any given leaf node value by digitally signing the concatenation of that leaf node value with only the node values defined in the corresponding verification key. Thus, the amount of data in the verification information that is needed to extract the value of the root node is clearly much less than the amount of data needed to calculate the control value of the root node (i.e., based only on the values of leaf nodes by calculating all node values other than leafy, intermediate levels of the tree): this is an advantage of the present invention, given the limitation of the limited size available for security markings (for example, a two-dimensional barcode).

According to the present invention, the digital security marking 110 of the digital file Ai of the product package includes verification information Vi, which enables both online and offline verification operations of the authenticity of the marked file, the correspondence of the associated data with respect to the data of the genuine marked file, by providing a unique, an unchanging and tamper-proof link between the digital data Di Ai and the fact that the tagged original digital file Ai belongs to the specified package of genuine products, while maintaining the bit size of the digital representation of this verification information Vi on

- 10 042505 level compatible with the data content of a two-dimensional machine-readable barcode that can be easily read by a conventional reader: this verification information contains the digital product data Di and the corresponding verification key ki, Vi = (Di,ki). The verification operations include extracting the value of the package or control root digital signature R of the tree associated with the package by first reading the digital data D _i and the corresponding digital verification key ki on the machine-readable security mark 110 of the digital file Ai, then calculating the potential digital signature Xi by means of a one-way read function. digital data Di as Xi = H(Di), and computing a potential root digital signature R ^c as described above from the concatenation digital signature Xi and tree node values according to the sequence of node values specified in the digital verification key ki. This security scheme, which has the advantage that there is no need for data encryption and therefore no need for encryption/decryption key management (in particular, the cryptographic key is not included in the digital security marking), is much more secure against a cryptanalytic attack than conventional data encryption using a public encryption key - a private decryption key (for example, the Rivest-Shamir-Adleman RSA system). As a result, the size of the digital data to be represented in the digital security marking of the present invention is compact and allows the conventional representation of two-dimensional barcodes (e.g. QR code) (particularly those used for print-ready digital files) to be used and hence , ordinary barcode readers (or even a simple programmed smartphone with a camera), while providing a very high level of reliability against cryptanalytic attacks. Moreover, this security marking is compatible with both online verification (via a server communicating with the code reader) and offline verification (via a programmed code reader) of the authenticity of the marked digital file and the compliance of its data with the data of the original (original) digital file. . In addition, according to the present invention, the representation of the digital data Di and the representation of the key data ki may be different, the data concatenation scheme and/or the one-way function may depend on the node level in the tree, which provides additional levels of security against cryptanalytic attacks.

Preferably, in order to further reduce the size of the digital data (i.e., verification information V) to be included in the digital security marking, if the digital data Di of the respective original digital files Ai of the package are distributed among predetermined fields that are common to all digital files of the package, the digital data related to these fields is not included in each digital data Di, but is grouped in a separate field data block FDB associated with the package of digital products, and the digital signature xi of the original digital file Ai of the package is then calculated using the one-way function H of the concatenation of the corresponding digital the data Di and the digital data of the field data block FDB, i.e. xi = H(Di+FDB); and the control root digital signature R is made available to the user along with the associated field data block FDB (which also ensures that the field data block is immutable).

In an embodiment of the present invention, the field data block FDB independently provides the user with a control root digital signature.

The above reduction in size is possible in most cases, since most of the data associated with digital package files are classified according to some fields for data structuring: for example, for a pharmaceutical product associated with a protected digital file, the serial number, expiration data etc., Di only includes the data associated with these fields (e.g. 12603, May 2020, etc.), while the common field names are serial number, expiration data, etc. . included in the field data block FDB.

There are many known methods for encoding information. Any such method can be used in implementations of any embodiment of the present invention. One common form of marking is the well-known QR code (in the form of a 2D image representation included in a digital file). As is well known, for a given area, the more data a QR code can encode, the higher the modulus density (roughly speaking, the density of black/white squares) and the greater the resolution required for printing and reading. In addition to density (in the number of modules squared), QR codes are also commonly classified according to what level of error correction they include. There are currently four different standard levels, L, M, Q and H, each representing the degree of damage, i.e. data loss, a QR code image can withstand and recover from. Levels L, M, Q and H can withstand approximately 7%, 15%, 25% and 30% damage respectively.

The following table shows at least approximate values for different versions of the QR code.

- 11 042505

Version modules size) (V Number of encoded bits level ESS L ESS level H BY 57x57 2192 976 25 117x117 10208 4304 40 177x177 23648 10208

However, not all bits can be used to encode the data download, as some modules are used for scan objects, mask pattern, and error correction modules. Thus, there is a trade-off between the amount of information that the QR code (or any other marking 110) can encode and how much information is included in the verification information V and needs to be encoded.

Therefore, for the selected type of digital security marking 110 (e.g., QR code) with limited coding ability, a suitable one-way function H must also be selected: a function whose output is too large in terms of required bits cannot be used at all, and a function whose range which is too small may not be reliable enough. Moreover, in many applications, scalability can be an issue. For example, some data protection schemes include signatures that grow as the number of packet elements increase, and which may unacceptably limit the packet size in terms of how many bits the digital security marking 110 can encode. This is why the following function type is chosen according to the preferred mode of the present invention - one-way hash function of the SHA-2 family.

A calculation module (not shown) is preferably included in the security system for executing code for performing calculations for digitally signing the digital data of the original digital files of the package, for determining digital verification keys for different digital files, and for calculating the control root digital signature of the corresponding tree. The security system may also include suitable modules for inputting (programmed) values corresponding to the digital data D _v of the virtual digital file(s) A _v . It would also be possible to perform the hash calculations associated with the files externally (for example, on a connected remote server), for example, wherever the digital files are produced, to avoid having to transfer the raw digital data Di over the network from this site (or sites) to the system protection if there is a problem. For each digital file Ai, the corresponding verification information Vi is compiled and encoded (provided) in some form of machine-readable digital security marking 110, which is then included in the respective product.

For any virtual digital file A _v its corresponding verification information V _v = (D _v ,k _v ) can be associated with it internally by the security system. The verification information typically at least includes, for any digital file Ai of the digital file package, the corresponding digital data Di and the corresponding digital verification key ki: that is, Vi = (D _i ,k _i ).

The additional digital data may further be associated with the digital file and may include, for example, the value of the package, i.e. the control root digital signature R, or any other information that the system designer (or system administrator) chooses to include, such as the serial number associated with the item. number, package identifier, date/time information, product name, URL that points to other online information associated either with a particular product (for example, an image of a product or its label or packaging, etc.) or with package, or with a supplier/manufacturer, a phone number to call for verification, etc. Additional digital data may be stored in a searchable information database exposed to the user (via the information database interface).

After computing the digital verification ki of the original digital file Ai and including (i.e., by encoding or any chosen data representation) along with the corresponding digital data D _i in a machine-readable digital security mark 110 in the digital file A _i , the resulting tagged original digital file and associated with it, digital data is really protected from forgery and falsification.

The user, the recipient of a digital file such as A1 for example, can then scan (or otherwise read) with an imaging device (reader) the digital security mark A1 and extract the digital data D1 and the digital verification key k1, (and any other information which could be encoded in the marking). To verify the marked digital file Ai, the user must first extract the verification information V ₁ =(D ₁ ,k ₁ ) from the digital security marking 110 A1, and thus calculate the digital signature x1 from the extracted digital data D1: to perform such an operation, the user must know

- 12 042505 a one-way function that is used to calculate the digital signature, in this case it is a one-way function H() (for example, a SHA-256 hash), and then perform the operation x1=H(D1) to get the full data (x1,k1) required to calculate the corresponding potential root digital signature R ^c . The user may, for example, securely accept a one-way function (for example, using a public/private key pair) or by requesting it from a digital file provider or any other entity that has created signatures and keys or has already programmed them into the processing unit of the device to form the user's image.

Then, in order to calculate such a potential root digital signature R ^c , the user needs to additionally know the type of data concatenation scheme (to concatenate node values via H(a(i,j)+a(i,k)) which is used to: the user can accept this information in any way, either securely (for example, using a public/private key pair), or simply by requesting this information from the digital file provider or any other person who created the verification data, or by programming it into the user processing unit.However, the concatenation scheme may actually correspond to a simple conventional end-to-end connection of two blocks of digital data, respectively, corresponding to the values of two nodes: in this case, no particular scheme should be transmitted to the user.In some embodiments, the concatenation scheme may additionally insert a concatenation block, which may contain data specific to the position or level of the concatenated blocks digitally output data in the tree, making a cryptanalytic attack even more difficult.

Knowing the data concatenation scheme, the user can then calculate (for example, by means of a suitably programmed imaging device) a potential root digital signature R ^c , as disclosed above, by stepping digitally signing the digital signature concatenation x ₁ and the node values according to the sequence of nodes defined in digital verification key k1, see point 1 above), related to the node a(1,1), performed according to the ordering of the nodes in the tree and the ordering of the concatenation of the tree. In this case, the potential root digital signature is obtained as

R ^c \u003d H (H (H (a (1.1) + a (1.2)) + a (2.2)) + a (3.2)).

This calculated potential root digital signature R ^c should then be equal to the available (or published) control value R: this value may have been previously obtained by the user and/or already stored in the memory of the processing unit of the imaging device, it may also be a value that the recipient requests and receives from the system administrator in any known manner. By matching the potential R ^c and the available control root digital signatures R, this calculation then verifies the information in the digital security marking 110 and confirms that the digital file A1 belongs to the correct package.

A link to access the control root digital signature R for the package corresponding to the digital file A1 may be included in the digital security marking 110 (eg, a web address if R can be retrieved from the corresponding website), although this is not a preferred option.

The user, the recipient of a digital file such as A1, for example, can then scan (or otherwise read) with a reader the digital security marking on A ₁ and extract the digital data D1 and the digital verification key k1 (and any other information that may have been encoded in digital security markings). An example of a reader is a computer with a display or even a (programmable) smartphone. To verify the marked file A _{1 ,} the user must first extract the verification information V ₁ =(D ₁ ,k ₁ ) from the digital security marking on A ₁ and thus compute the signature of the digital file x ₁ from the extracted digital data D1: to perform such operation, the user must know the one-way function that is used to calculate the digital signature, in this case the hash function H(), and then perform the operation x1=H(D1) to obtain the full data (x1,k1) needed to calculate the corresponding potential root digital signature B ^c .

The user may, for example, securely accept a one-way function (eg, using a public/private key pair) or by requesting it from a digital file provider or any other entity that has generated signatures and keys or has already programmed them into the reader processing unit.

Preferably, the control root digital signature (i.e., packet value) R is stored in a searchable root database that can be accessed (via a communication channel) by the user with his computer equipped with a communication unit, as is the case with the above example of a smartphone. A user who needs to verify an A1 digital file can simply send a root request from their smartphone to the database address through the database access interface, a request containing the digital data D1 read on the digital security mark 110 A1 (or the computed digital signature x1 = H (D1)), which allows extracting the corresponding control value of the package R, and the access interface will return the control root digital signature R to the smartphone. The database can be secured with a blockchain to enhance the immutability of stored root digital signatures. The advantage of the present invention is that

- 13 042505 establish a connection between a physical object, i.e. an original digital file stored in memory, and its attributes, i.e. associated digital data and its belonging to a specific digital file package, almost invariably through the corresponding root digital signature.

The above method of verifying the Ai digital file can also serve to authenticate the human-readable content of the Ai data on the corresponding printed version of the Ai digital file. Indeed, the user can read on the computer display the corresponding digital data Di as decoded from the digital security mark in the digital file Ai by the computer and visually check whether the displayed information matches the printed data on the printed version of the digital file.

In a preferred embodiment, the digital data Di further includes characteristic digital data CDD of the corresponding unique physical characteristic of the object or person associated with the tagged original digital file Ai, which can be used to (tangibly) authenticate the associated object or associated person by comparing the characteristic digital data extracted from a digital security marking, and corresponding unique physical characteristic detection data obtained from a suitable sensor. Thus, with the characteristic digital data corresponding to the unique physical characteristic in the digital file A _i , which is CDD _i , the corresponding unique physical signature data UPSi can be obtained by CDDi encoding (preferably by a one-way function): for example, taking the hash value of the characteristic digital data CDDi, i.e. UPSi = H(CDDi). However, any other known encoding can be used instead: for example, to have a short signature, one can use the elliptic curve digital signature algorithm. As a very simplified illustrative example of characteristic digital data CDDi corresponding to a unique physical characteristic of an object OBJi associated with a digital file Ai, consider a simple digital image obtained by displaying an object OBJ _i (or a particular area on OBJ _i ), for example, through a smartphone camera, when the corresponding unique physical signature data UPSi is, for example, the digital image hash value, UPSi=H(CDDi). The characteristic digital data CDD _i that generated the signature UPS _i is the signature characteristic digital data for A _i , and the resulting signature UPS _i is the corresponding unique physical signature check data for Ai. Preferably, the UPSi, i.e., the unique physical signature control data for the digital file Ai, is stored in a searchable database or on a blockchain (or a blockchain-secured database) open to users (for example, through a request containing digital data Di, readable on the digital security marking in the digital file Ai, or their respective digital file signature xi). Thus, the stored UPSi becomes immutable. A copy of the CDDi can be additionally stored in the memory of the user's smartphone (or reader, or computer). In an embodiment, a copy of the UPSi may also be optionally stored in the memory of the user's smartphone (or reader, or computer) to enable an offline verification operation.

The digital file A _i can be authenticated by extracting the potential CDDic characteristic digital data from the digital data Di read (in this case by a decoding application running on a smartphone) on the digital security marking included in the digital file Ai and comparing it with control characteristic digital data CDDi stored in the memory of the smartphone: if CDDic = CDDi matches, the digital file Ai is considered authentic (its digital content corresponds to the content of the authentic tagged original digital file). If the verification characteristic digital data CDDi is not stored in the memory of the smartphone, but rather the verification data of the unique physical signature UPSi is stored in the memory of the smartphone (with the advantage that it takes up much less memory compared to CDD), then the authenticity of A _i can still be verified. by verifying that the potential unique physical signature data UPSic obtained by computing the hash value of the potential characteristic digital data CDDic extracted from the digital data Di, i.e. UPSic = H(CDDi ^c ), matches the control unique physical signature data UPSi stored in memory .

The user can further verify the authenticity of the received digital file A _i , still through an offline process (self-checking), by detecting said unique physical characteristic on an object or person associated with the digital file Ai, by means of a sensor capable of making such a measurement (in this case smartphone camera) and deriving potential characteristic CDDi ^c digital data from the detected characteristic (in this case, a digital image captured by a smartphone). Thus, the user can ^compare (through the image processing unit of his smartphone, or visually on the display of his smartphone) received CDDi ^c with a copy of the control CDDi (stored in the memory of the smartphone): some

- 14 042505 given rejection or similarity criterion), the digital file Ai is considered to be authentic (that is, its digital content corresponds to the content of the genuine marked original digital file).

Moreover, the user can also additionally calculate the corresponding potential unique physical signature data from a copy of the control CDDi stored in the smartphone memory in the form UPSi ^c = H(CDDi) and compare it with the UPSi physical signature control data stored in the smartphone memory: in the case of matches UPSic = UPSi, the digital file Ai is confirmed to be authentic with a higher degree of certainty (because one bit of difference is enough to cause a mismatch). Moreover, in case of a match, the authenticity of the digital data Di associated with Ai, which has been verified as corresponding to the data of the original digital file as disclosed above, is also established by extracting the corresponding packet value R from the read verification information (Di,ki) stored in digital security markings in Ai.

In an embodiment, verification of the authenticity of the digital file Ai by the user may be performed through an online process. In this case, the control data, i.e. the CDDi characteristic digital data and/or the UPSi unique physical signature control data, is stored in a searchable database open to the user, where the control data related to the digital file Ai is stored in connection with, respectively with the corresponding digital data Di (included in the digital security marking in Ai) or with the corresponding digital file signature xi (which can be computed by the user once the data Di is extracted from the digital security marking through the operation xi=H(Di)): the control data can be query by sending a query to the database containing, respectively, Di or xi.

A common way to protect an object is to apply a material-based (possibly tamper-proof) security marking, i.e. a mark that has a detectable intrinsic physical or chemical property that is very difficult (if not impossible) to reproduce. If a suitable sensor detects this intrinsic property of the mark, the mark is considered genuine with a high degree of certainty, and hence the corresponding marked object. There are many examples of such well-known authenticating intrinsic properties: the marking may include some particles, perhaps randomly distributed, or have a certain layered structure, having intrinsic properties of optical reflection, or transmission, or absorption, or even emission (for example, luminescence, or polarization, or diffraction, or obstruction, etc.), possibly detectable under certain illumination conditions with light of a certain spectral composition. This intrinsic property may be the result of the particular chemical composition of the marking material: for example, luminescent pigments (perhaps not commercially available) may be dispersed in an ink used to print some pattern on an object and used to emit a particular light (for example, in a spectral window in infrared range) when illuminated with a certain light (for example, light in the UV spectral range). This is used, for example, to protect banknotes. Other intrinsic properties can also be used: for example, the luminescent particles in the marking may have a certain decay time of the luminescent emission after illumination with a suitable excitation light pulse. Other types of intrinsic properties are the magnetic property of the particles included, or even the property of the fingerprint of the object itself, such as, for example, the relative position of initially randomly distributed fibers of the paper substrate of a document in a given area on the document, which, when viewed at sufficient resolution, can serve to extract a unique characteristic feature. a signature or some random printed data artifact printed on an object that, when viewed at sufficient magnification, could also result in a unique signature, etc. The main problem associated with the intrinsic property of an object's fingerprint is its resistance to aging or wear. However, material-based security markings may not always also protect the data associated with the marked object: for example, even if a document is marked with a material-based security marking, such as a logo printed with security ink in some area of the document, the data printed on the remainder of the document may be falsified. Moreover, overly complex authentication signatures often require significant storage involving external databases and communication channels for queries against such databases, so that offline authentication of an entity is not possible. According to the present invention, an object marked with a material-based security marking and associated with a (digitally) marked digital file is protected by an interlacing resulting from the fact that the characteristic digital data corresponding to the unique physical characteristic of the marked object, or its corresponding unique physical signature data , are immutable (due to the publication or storage of the aggregated digital signature on the blockchain) and are protected from forgery, are associated with digital data in a digital security marking, which is part of the associated digital file. Thus, the present invention can be used to protect both a package of objects and a corresponding package of associated digital files.

- 15 042505

Of course, any other known intrinsic physical/chemical property can be used to obtain CDDi characteristic digital data relating to the object unique physical characteristic OBJi associated with the digital file Ai and the corresponding unique physical signature data UPSi. As another illustrative example, a two-dimensional barcode forming a material-based security mark can be printed on an object with a security ink containing a luminescent pigment having a characteristic decay time constant, as well as a light excitation wavelength window and a luminescent emission wavelength window: as a result, the ink has a certain reference value of the decay time t, which serves as a fingerprint of the ink material. It suffices to illuminate the barcode with excitation light in an illumination wavelength window encompassing the pigment excitation wavelength window, and to collect the resulting luminescent light from the barcode with a sensor capable of detecting light intensity within the luminescence emission wavelength window to authenticate the barcode, and hence the object. For example, a user reader may be equipped with a flash configured to apply excitation light to a bar code, a photodiode configured to collect an appropriate fluorescent light intensity profile I(t) (during a detection time interval) from the bar code, and a reader CPU , programmed to calculate the decay time value based on the received intensity profile I(t). For example, the excitation wavelength window may be in the UV (ultraviolet) range and the emission wavelength window in the IR (infrared) range. If, during object verification, the intensity of the fluorescent light collected by the user's imaging device shows a characteristic decay over time corresponding to a potential decay time t _s , then the ink and therefore the object are considered authentic if t _c ® τ (within the specified deviation range ). In this case, the characteristic digital data CDDi of the tagged object OBJi includes at least a decay time reference value τ (and possibly data related to the excitation wavelength window and the emission wavelength window). As can be seen from the above examples, the technical result of including control (unique) characteristic digital data in the digital security marking verification information of the associated digital file Ai is to provide a tamper-proof connection between the digital data of the digital file and the authentication data of the associated object.

Another illustrative embodiment of the present invention relates to a package of biometric identification documents, such as biometric digital passports, as shown in FIG. 2A. Each digital passport, like a digital file, is associated with the corresponding person, i.e. the owner of the passport. For clarity, the digital data A ₁ is shown in FIG. 2A as equivalent textual and alphanumeric information (i.e., human-readable), for example, as it can be displayed from a pdf (Portable Document Format) digital file, and the digital security marking is shown as an equivalent conventional 2D QR code pattern. This embodiment of the present invention is particularly useful for creating printable digital files, such as print-ready digital files, to allow a printing device to deliver a printed security document directly from a corresponding secure printable digital file (e.g., a digital file related to an identity document, a diploma). , contract, etc.).

This example still uses the hash function as a one-way function for signing digital passport data, preferably the SHA-256 hash function due to its well-known reliability. Indeed, given a given packet size, the hash function that is chosen (having a known list of segments) to sign the digital passport data is thus an example of a one-way encryption function such that each individual digital passport has a separate digital signature of the passport, which makes unique signature. The domain of a hash function (i.e. the set of possible keys) is larger than its range (i.e. the number of different table indexes), it will map multiple different keys to the same index, which can lead to conflicts: such conflicts can be avoided when the packet size is known, either by looking at the list of segments associated with the hash table of the hash function and keeping only the function that yields zero collisions, or by independently choosing a hash table conflict resolution scheme (such as coalesced hashing, cuckoo hashing, or hopscotch hashing ).

In FIG. 2A shows an example of a digital biometric passport A _b protected by a machine-readable digital security marking 210 (in this case a QR code) encoded in A _b and containing passport digital data 230 containing normal passport data, such as the digital data representing the title of the document 230a ( Passport), Passport Holder Biodata Set 230b: Last Name (Dow), First Name (John), Gender (M), Date of Birth (March 20, 1975), Citizenship (US), Place of Residence (Des Moines), Place of Birth (Auckland), issue date 230c (February 24, 2018) and expiration date 230d (February 23, 2020). This digital passport data may additionally contain some(s) (unique(s)) serial(s) number(s) 235,

- 16 042505 assigned by the passport issuing authority (in this case 12345). The digital passport data further comprises biometric data of the passport holder in the form of characteristic digital data (CDD) corresponding to a unique physical characteristic of the person associated with the digital passport. A machine-readable representation 230e (eg, alphanumeric) of data indicative of said unique physical characteristic (not shown) corresponding to said biometric data is associated with the digital data 230 of the passport. The representation of digital data should be understood in the broadest sense of the term: for this representation of data, it is only necessary to ensure that the original digital data is retrieved. The machine-readable representation 230e of the data, that is, biometric data, of a unique physical characteristic, may correspond to, for example, fingerprint identification or iris identification of a digital passport holder. For example, the biometric data 230e corresponding to a human fingerprint may be the result of an analysis of a set of specific small features of the fingerprint protrusions, such as ridge termination, bifurcation, and short ridges (according to the traditional Henry classification system).

Thus, for a given digital passport L, from the delivered digital biometric passport packet μ, in this case where μ = 1024, the associated digital data Dj includes the aforementioned digital data 230a-230e. In an embodiment, the passport-related digital data Dj may include only field values that are common to all delivered passports, while fields in general, i.e. Passport, Last Name, Gender, Date of Birth, Citizenship, Place of Residence, Place of Birth, Passport Issue Date and Expiry Period are included in a separate FDB field data block as disclosed above: for example, Di only contains a representation of the field values Dow, John, M, March 20, 1975, USA, Des Moines, Oakland, February 24 2018 and February 23, 2020.

Preferably, the additional passport digital data is associated with the aforementioned passport digital data 230 . For example, a digital image of the fingerprint of a passport holder or a digital photo of an identity, etc. In an embodiment, these additional digital passport data are stored in a searchable infobase 250, which can be searched with an information query containing some of the passport data (e.g., the holder's name, or biometric data, or data from a security marking, or unique serial number 235) to extract the corresponding fingerprint pattern data and receive it back. Preferably, a link to the information database 250 is included as the information access data 240 in the digital passport: in this case, this information access data is encoded in a digital representation of a QR code containing a reference index to extract the corresponding additional data in the information database 250 data. However, in a variant of a passport control operation involving access to a remote information database (online operation), the QR code may contain, for example, the URL of an information database accessible via the Internet.

The digital signature of the passport with the one-way hash function of the digital passport data Dj corresponding to the digital data 230a-230e of the digital passport L, is then computed by, for example, the aforementioned reliable SHA-256 hash function to obtain the corresponding (unique) digital signature of the passport Xj= H(Dj). In the same way, the digital signatures of all digital passports in the package for all different holders are calculated.

For all passport signatures in the packet, the control root digital signature R is computed according to the tree ordering and the tree concatenation ordering of the linked (binary) tree, as discussed above. Since there are μ = 1024 passports in the packet, the corresponding binary tree has 1024 leaf nodes a(1,1),...,a(1024) for the first level, 512 non-leaf nodes a(2,1),.. .,a(2,512) for the second level, 256 non-leaf nodes, a(3,1),...,a(3,256) for the third level, and so on, up to the penultimate level of nodes (in this case, the level 10) with non-leaf nodes a(10,1) and a(10,2), and the top node corresponding to the root node R (tree level 11). Leaf node values are a(1,j) = Xj = H(Dj), j=1,...,1024, second level node values are a(2,1) = H(a(1,1) +a(1,2)),...., a(2,512) = H(a(1,1023)+a(1,1024)), etc., and the control root digital signature R is R = H(a(10,1)+a(10,2)). Thus, each digital verification key kj is a sequence of 10 node values. The digital security marking 210 of the digital passport Aj includes the digital data of the passport Dj and the corresponding digital verification key kj (ie, verification information Vj = (Dj,kj)).

For the operation of checking the actual correspondence of the digital data of the passport Dj and the digital verification key kj in the digital security marking 210 of the biometric digital passport l, with the data of a genuine biometric digital passport belonging to the package μ of biometric digital passports having the package value R, it is only necessary to calculate the digital signature of the passport Xj = H(Dj) and verifying that Xj and the digital verification key kj provide the extraction of the available corresponding control root digital signature R by 10 times

- 17 042505 compiling (in this case, the tree is ten levels below the root level) the hash function of concatenating the node value a(1,j) and the node values in kj (according to the ordering of the nodes in the binary tree and the ordering of the concatenation of the tree with the usual concatenation scheme). Thus, a biometric digital passport secured in accordance with the present invention provides both a tamper-resistant link between personal data and its holder's biometric data, and a unique and tamper-resistant link between the holder's individual and the holder's identity.

In FIG. 2B illustrates the control process of the secure biometric digital passport A1 according to FIG. 2A, in which the passport data marking 230 corresponds to a specific John Doe, the passport biometric data 230e corresponds to a John Doe fingerprint, and the additional passport digital data corresponds to a digital photograph of John Doe's identity 255 that is accessible by reference to the information database 250 included in the marking 240. on access to information. The passport data additionally contains a unique serial number 235 assigned by the passport issuing authority. The digital security marking 210 of the passport A1 contains verification information (D1,k1), with the digital data of the passport D1 corresponding to the printed data 230a-230d of the passport, the biometric data 230e and the unique serial number 235, and the verification key k1 corresponding to a sequence of 10 node values {а(1,2),a(2,2),...,a(10,2)}, which are needed to extract the root value R from the node value a(1,1) of the digital passport A1 (where a( 1,1) = x1 = H(D1)). The control root digital signature R can be timestamped and stored on blockchain 260. In this example, the biometric data 230e of the respective package biometric passport holders is also stored on blockchain 260 in association with their respective unique serial numbers, respectively (to ensure that the data is immutable) . The stored biometric data of John Doe can be retrieved by sending a request to blockchain 260 with the unique 235 serial number found on his passport. Authorities responsible for controlling people's identities (e.g., police, customs, etc.) can access the blockchain 260 via a communication channel and in this exemplary embodiment also have local stores to store the (published) root digital signatures of all delivered packets biometric digital passports. In the example shown in FIG. 2B, the infobase 250 is local (i.e., directly available to authorities, without the need for a public communications network). In addition, these organs are equipped with fingerprint scanners 270 for capturing human fingerprints and calculating corresponding machine-readable representations of the data indicative of the captured fingerprints, ie biometric data 230e.

During John Doe's identity verification by, say, a police or customs officer, the officer takes John Doe's secure biometric digital passport A1, reads and decodes the verification information (D1,k1) stored in the digital security marking 210 of the digital passport, through a suitable reader that may be, for example, a suitably programmed computer 290, with the computer connected to local stores 250. After reading the digital data of the passport D1 and the digital verification key k1 and sending them to the computer 290, a certain application (with a programmed hash function H and concatenation node values) running on computer 290 calculates the digital signature of the passport x1 (as x1=H(D1) and the potential packet value R ^c as

H(H(H(H(H(H(H(H(H(H(a(1,1)+a(1,2))+a(2,2))+..)+..) +..)+..)+..)+..)+a(9,2))+a(10,2)), i.e. 10-fold compilation of the hash function of concatenation of the node value a(1,1 ) and node values in ki={a(1,2),a(2,2),...,a(10,2)}. The computer can then, for example, search the local infobase 250 for a control root digital signature R that matches the control value R ^c : if not, the passport is fake and John Doe (i.e., the verifiable person claiming to be John Doe) may be arrested. If R ^c matches some stored control root digital signature, the passport is considered authentic, and the employee can perform additional security checks:

the employee retrieves the digital photo 255 of the person stored in the information database 250 by sending a request through the computer 290 containing the serial number 235 printed on A1, receives it back and displays the received photo 255 of the person on the screen of the computer 290: the employee can then visually compare the displayed face (that is, the face of John Doe) with the face of the person being tested and evaluate whether these two faces are similar or not; and the employee extracts the biometric data 230e on the passport A1 by reading this data on the digital security marking 210 using the computer 290 and scans the person's fingerprint with the fingerprint scanner 270 connected to the computer 290 and obtains the corresponding person's biometric data: the employee then checks through program running on the computer 290, whether the extracted biometric data 230e is similar (within a specified error) to the obtained human biometric data.

If two faces and biometrics are considered similar, everything is fine and the person being checked is indeed the real John Doe, holder of a genuine biometric passport ^A 1-18 042505

In the event that any of the aforementioned additional security checks fails, it is clear that the person in front of the employee is not the true owner of the genuine biometric passport A ₁ . Thus, with the secure biometric digital passport of the present invention, a simple offline check can quickly detect any fraud.

In fact, it is even possible to reduce a digital biometric passport document to a simple digital file with a simple digital representation of a 2D barcode (as in the above QR code example) including verification information V=(D,k): with V containing the holder's biographical data and (unique) biometric data such as the holder's fingerprint (in the digital data D of the passport) and a verification key. In fact, according to the present invention, even this reduced secure digital passport has the full advantage of the aforementioned tamper-proof link created between the personal biographical data and the biometric data of the passport holder and the unique and tamper-proof link between the holder's individual and the holder's identity.

Another exemplary embodiment of the present invention relates to aircraft components as shown in FIG. 3. Due to the very high cost of some critical components, the failure of which may affect the safety of the aircraft, such as some parts of the reactors (for example, turbine blades, pumps, etc.) or landing gear, or batteries, etc., counterfeiters are interested in producing copies of these components, but, of course, without meeting the necessary technical security requirements due to their usually lower quality. Even if an aircraft component is usually marked with an appropriate unique serial number to identify it, this kind of marking can be easily counterfeited. These fake aircraft parts are usually defective and can cause serious damage or even a plane crash. This is a growing security issue today. Moreover, even if the components are genuine, they may not be suitable for certain versions of the same type of aircraft, and there is a serious risk that an unsuitable component will be accidentally used, for example, to repair a given aircraft. Thus, it is important to provide at least critical genuine components that are approved for a given aircraft.

Typically, each component has a corresponding (possibly digital) data sheet, listing, for example, the technical name of the component, the unique serial number of the component, the name of the component manufacturer, the date of manufacture of the component, and certification information. Moreover, for a given aircraft, the corresponding record contains all (digital) technical data sheets of its respective components. However, counterfeit components may have a corresponding counterfeit digital data sheet, and therefore it is not obvious (unless, for example, technical tests are carried out) to detect fraud. For example, how can you be sure that a digital data sheet correctly matches a component installed on a particular aircraft (and vice versa)?

According to an exemplary embodiment of the present invention, authorized parts that will be used to manufacture or repair a given aircraft, or that are installed on an aircraft, are considered to belong to the package of components (or objects) for that particular aircraft.

In the specific illustrative embodiment shown in FIG. 3, each aircraft package component, that is, each aircraft component authorized for installation or repair on a given aircraft, has a corresponding AC-ID aircraft component digital identification document, which contains the same component digital data as in a regular technical data sheet (for example, an identification code aircraft manufacturer name, component technical name, unique component serial number, component manufacturer name and component date of manufacture) together with additional numeric data corresponding to the aircraft identification code, aircraft manufacturer name, date of assembly of the component on the aircraft, name of the person responsible for performing of the conformance check, along with the date of the conformance check and the corresponding (unique) digital signature of the verifier. In addition, each aircraft component AC-ID is protected by a machine-readable digital security marking added to it. For clarity, the digital data of AC-ID:A ₁₂₅ is shown in FIG. 3 as equivalent textual and alphanumeric information (i.e., human-readable), and the digital security marking 310 is shown as an equivalent conventional 2D QR code pattern.

Preferably, each time a component or set of components is replaced on an aircraft, corresponding secure digital AC-ID documents are created, and a corresponding updated version of the aircraft package is also created with the aforementioned corresponding additional digital data (related to new installation operations).

Thus, all (critical) installed components on a particular aircraft (in this case, the given aircraft with the identifier HB-SNO) belong to the corresponding package

- 19 042505 installed components (in this case μ components in total) and are documented in the associated μ digital file bundle, i.e. the AC-ID digital identification document. A digital security mark 310 (in this case in the form of a QR code) is included in each digital aircraft component identification document, for example, AC-ID:A ₁₂₅ , which is associated with the corresponding aircraft component, in this case A ₁₂₅ , installed on the aircraft HB- SNO. In FIG. 3 in particular shows component A ₁₂₅ of the aircraft package, which is a turbine blade adapted to the type of reactor installed on an HB-SNO aircraft and marked with a unique factory serial number (in this case 12781, usually engraved by the manufacturer). The digital data of component D ₁₂₅ in the digital security marking 310 of the digital identification document of the AC-ID:A ₁₂₅ aircraft component associated with component A ₁₂₅ contains the digital data corresponding to the technical data sheet data: aircraft identification code 330a (in this case HBSNO), name 330b aircraft manufacturer (in this case AerABC), technical name 330c of the component (in this case turbine blade - 1st ring), serial number 330d of the component (in this case 12781), name 330e of the component manufacturer (in this case PCX), date of manufacture component 330f (in this case November 13, 2017), the date of assembly of the component at the 330g reactor (in this case February 24, 2018), the name of the person responsible for performing the 330h compliance check (in this case Martin White), along with the date verifier 330i (in this case March 20, 2018) and the (unique) digital signature of the verifier 330j (in this case 2w9s02u).

The digital signature of component x ₁₂₅ of digital data D ₁₂₅ of digital file AC-ID:A ₁₂₅ of component A ₁₂₅ is calculated by means of a one-way hash function H of the form x ₁₂₅ = H(D ₁₂₅ ). In the same way, all digital signatures of the digital data component xi of the digital data Di of the component Ai are computed by means of a one-way hash function H in the form xi = H(D _i ) (here i = 1,...,μ).

According to the present invention, a tree associated with a package of components A ₁ ,...,A _μ (in this case a binary tree), and thus with a corresponding package of digital files ACID:A ₁ ,...,AC-ID:A _μ , is constructed from μ leaf nodes a(1,1),...,a(1,μ), respectively, corresponding to μ digital signatures of the components x ₁ ,...,x _μ of the corresponding digital data of the component D ₁ ,.. .,D _μ of digital identification documents AC-ID:A ₁ ,...,AC-ID:A _μ of components A ₁ ,...,A _μ . In this case, the ordering of the nodes of the binary tree is the usual ordering, that is, the nodes a(i,j) are arranged according to the values of the indices (i,j): the index i indicates the level in the tree, starting from the level of leaf nodes (i=1) to the penultimate level nodes below the root node, and an index j going from 1 to µ for the level of leaf nodes (level 1), from 1 to µ/2 for the next level of nodes (non-leaf) (level 2), and so on. and 1 to 2 for the penultimate node level. A tree containing levels of nodes ranging from leaf nodes to a root node, with each non-leaf node of the tree corresponding to a digital signature by means of a one-way concatenation function H of the corresponding digital signatures of its child nodes according to the tree's concatenation order.

The control root digital signature R for the package μ of aircraft components A ₁ ,...A _μ is calculated by a one-way function of the (conventional) concatenation of the tree roots (as discussed below). The control root digital signature R is then stored in a searchable database (preferably a blockchain) open to those responsible for checking or replacing installed components. The tree thus contains levels of nodes ranging from leaf nodes to the root node of the tree, with each non-leaf node of the tree corresponding to a digital signature by means of a one-way function H of concatenating the corresponding digital signatures of its (two) child nodes according to the concatenation order of the tree (in in this case, the usual one), the root node corresponds to the control root digital signature R, that is, the digital signature by means of a one-way function H of concatenation of digital signatures of the nodes of the penultimate level of nodes in the tree (according to the order of the nodes in the tree and the order of the concatenation of the tree).

For a given package component Ai, the digital verification key ki corresponding to the digital signature of component xi (that is, the leaf node a(1,i)) of the digital data of component Di is calculated as a sequence of corresponding digital signatures, starting from the level of leaf nodes to the penultimate level of tree nodes, every other leaf node that has the same parent node in the tree as the leaf node a(1,i) corresponding to the digital signature xi, and sequentially at each next level in the tree, every node other than a leaf node that has the same parent node in the tree as the previous same parent node discussed at the previous level. For each component Ai installed on an HB-SNO aircraft, component-related digital data Di and a corresponding digital verification key ki are embedded in a digital security marking 310 included in the corresponding digital aircraft component identification document AC-ID:Aj.

For example, in the case of an inspection operation on a component on an HB-SNO aircraft, the technician may send a query to a searchable database containing the serial number 12781 of the component read on the AC-ID:A ₁₂₅ digital file of the component A ₁₂₅ to be inspected, or its digital

- 20 042505 verification key k ₁₂₅ readable on the digital security marking 310 on the corresponding document AC-ID:A ₁₂₅ with a suitable reader, such as a computer programmed to decode the content of the digital security marking, and will receive back the corresponding packet B value. In the preferred embodiment, which provides full offline verification, the specialist's computer has a memory that stores all root digital signatures related to the aircraft to be monitored. In this last variant, the specialist can then check if the component is genuine by reading the digital data of the component D ₁₂₅ on the digital security marking 310 AC-ID:A ₁₂₅ , checking that the unique serial number 330d (in this case 12781) extracted from D ₁₂₅ matches , with the serial number physically stamped on the installed aircraft component A ₁₂₅ , computing the corresponding digital signature of the component x ₁₂₅ (for example, by running a programmed application on the CPU of a computer processing unit that calculates the signature x ₁₂₅ = H(D ₁₂₅ ) from the read digital data D ₁₂₅ ), calculating the potential value of the packet R ^c by means of a one-way function H programmed on the computer CPU in the form of a hash value of the concatenation of the value of the leaf node a(1,125)=x125 and the values of the nodes specified in the corresponding digital verification key k125, and checking the coincidence of the potential value package R ^c with the value of the control root digital signatures, save encoded in computer memory (i.e., the R reference value corresponding to the HB-SNO aircraft). In case of a complete match (i.e. match of serial numbers and R ^c = R), the A125 component is considered authentic and belongs to the (updated) aircraft package of allowed HB-SNO aircraft components, in case of R ^c mismatch with the stored control root digital signature R, or in the event of a serial number mismatch, component A ₁₂₅ is likely to be a counterfeit, or a genuine component not authorized for the HB-SNO aircraft (for example, does not belong to the correct package for this aircraft), and must be replaced.

In the same way, the present invention will detect fraud (or errors) in packages of AC-ID protected spare parts stored in a warehouse by verifying the authenticity of the markings on the stored parts and checking that the serial number of the component from the digital security label matches the number marked on the corresponding component. . In the case of a highly critical component, a material-based tamper-resistant security marking may be additionally applied to the component, while the digital data relating to the corresponding control unique physical characteristic, i.e. CDD characteristic digital data (for example, captured by a suitable sensor at material-based security marking) of that marking is preferably part of the digital data of component D in the digital security marking of the aircraft component's digital identification document for that component, and the corresponding UPS unique physical signature control data is computed (e.g., by taking a hash value of the characteristic digital data CDD, i.e. UPS = H(CDD)) and may also be part of component D's digital data. This additional layer of security enhances the protection provided by the unique serial number stamped on the component by its manufacturer. . Preferably, the control UPCs and UPSs are stored on the blockchain (to ensure they are immutable) and are available to a specialist. Moreover, these control values can also be additionally stored in the memory of a technician's computer to allow for offline authentication of a material-based security marking on a highly critical component.

A further offline authentication operation of this material-based security marking may include measuring a unique physical characteristic on the component by means of a suitable sensor connected to a computer and deriving potential characteristic digital data CDD ^c from the measured characteristic (for example, through a special application programmed into the computer's CPU). Then the specialist (or the CPU of his computer, if he is suitably programmed) compares the resulting CDD ^c with a copy of the control CDD stored in the computer's memory: in the case of a reasonable match CDD ^c ® CDD (that is, within some predetermined criterion of acceptable errors) security marking based on the material and therefore the component are considered genuine.

As mentioned above, a copy of the CDD reference digital signature data, instead of being stored in the technician's computer memory, is part of the digital data D included in the digital security marking in the ACID:A aircraft component digital identification document of component A, and can be obtained by direct reading digital security markings. Then the specialist can read the potential CDD ^c on the digital security marking and check the match of the UPS signature stored in the computer memory with the potential signature UPS ^c calculated from the read potential CDD ^c by calculating UPS ^c = H(CDD ^c ): in case of a match UPS ^c = UPS, the security marking based on the material and thus the component is verified to be genuine.

In an embodiment, verification of the authenticity of a component by a specialist may alternatively be performed through an online process in a manner similar to that already disclosed in the first detailed

-

Claims (18)

embodiment of the present invention, and will not be repeated here. According to the present invention it is possible to further verify the authenticity of a copy of the digital identification document of an AC-ID:A ₁₂₅ aircraft component, for example against the original secure digital file. In fact, if the person responsible for the control (or repair) operations has access to the digital file AC-ID:A ₁₂₅ on his computer (which can be, for example, a smart phone programmed in a suitable way), he can verify that the digital data of the component data of the original document by performing the following operations: reading the digital data of the component D ₁₂₅ and the digital verification key k ₁₂₅ on the digital security marking 310 of the digital identification document of the component AC-ID:A ₁₂₅ ; obtaining the control value R of the package corresponding to the document AC-ID:A ₁₂₅ ; this reference value may already be in the computer's memory, or it may be obtained via a communication link from a database storing the reference values of the aircraft component digital identification document package, if the computer is equipped with a communication unit, by sending a request containing, for example, the (unique) serial number of the component or simply the key k ₁₂₅ read on the digital security marking 310 and receiving back the corresponding check value of the packet R; calculating (using the programmed one-way function H) the digital signature of component x ₁₂₅ from the read digital data of component D ₁₂₅ , with x ₁₂₅ = H(D ₁₂₅ ); calculation of the potential value of the packet R ^c (by means of the programmed one-way hash function H and the digital signature of the concatenation of digital signatures) in the form of a digital signature by the hash function H of the concatenation of the value of the leaf node x ₁₂₅ and the values of the nodes specified in the digital verification key k ₁₂₅ (according to the ordering nodes in the tree and the ordering of the concatenation of the tree); and verifying that the potential value of the packet R ^c matches the control value of the packet R. As described above, the present invention is clearly compatible with offline and local verification operations for verifying the authenticity of a secure digital file or the correspondence of the data of a copy of a secure digital file to data associated with the original secure digital file. However, the present invention is also compatible with an online verification process, such as by receiving (via a communication channel) a packet check value (or root digital signature) from an external source (e.g., a server or blockchain) or by performing some or all of the calculation steps involving a one-way function or concatenation of digital signatures via external computing tools (eg, running on a server), or even verifying that a potential root digital signature matches a control root digital signature (and simply getting the result). The foregoing subject matter is to be considered illustrative and not restrictive and serves to better understand the present invention as defined by the independent claims. CLAIM 1. A method for protecting a given original digital file belonging to a package of a plurality of original digital files from forgery or falsification, wherein each original digital file includes its own digital data, characterized in that the method includes steps for each original digital file of the calculation package by means of a one-way functions associated with a digital file signature of its digital data; forming a tree based on a set of calculated signatures of digital files for original digital files of a package containing nodes located according to a given ordering of nodes in the tree, while the specified tree contains levels of nodes, starting from leaf nodes corresponding to a set of signatures of digital files, respectively, associated with a set original digital files in the package, up to the root node of the tree, each node, other than a leaf, of the tree corresponds to a digital signature through a one-way function of concatenation of the corresponding digital signatures of its child nodes according to the order of the concatenation of the tree, the root node corresponds to the root control digital signature, that is, a digital signature through one-way function of concatenation of digital signatures of nodes of the penultimate level of nodes in the tree according to the specified ordering of the concatenation of the tree; linking with a given original digital file the corresponding digital verification key, which is a sequence of corresponding digital signatures, starting from the level of leaf nodes to the penultimate level of nodes, of each other leaf node that has the same parent node in the tree as the leaf node corresponding to the signature of the given original digital file, and sequentially at each next level in the tree, of each node, other than a leaf, having the same parent level in the tree as the previous one. - 22 042505 the parent node discussed in the previous level; providing the user with a control root digital signature of the tree and including in a given original digital file a corresponding machine-readable digital security mark containing a representation of his digital data and his corresponding digital verification key, while the machine-readable digital security mark is presented in the form of a two-dimensional barcode, thereby receiving a marked original digital file, the digital data of which is protected from forgery or falsification. 2. The method according to claim 1, characterized in that the control root digital signature of the root node of the tree is either published in an environment open to the user, or stored in a searchable root database open to the user, or stored in the blockchain, or stored in blockchain-protected database open to the user. 3. The method according to claim 2, characterized in that the tagged original digital file additionally contains data on access to the root node included in it and containing information sufficient to provide the user with access to the control root digital signature of the root node of the tree corresponding to the package of original digital files, wherein the specified information is a link to the access interface, configured to receive from the user a root request containing digital data or a digital file signature obtained from the digital security marking of the marked original digital file, and send back the control root digital signature of the corresponding tree, when This access interface provides access, respectively, to one of the following: the environment in which the control root digital signature is published; a searchable root database in which the control root digital signature is stored; and a blockchain, or, respectively, a database protected by a blockchain in which a control root digital signature with a timestamp is stored. 4. The method according to any one of claims 1 to 3, characterized in that the virtual digital file is considered to belong to a package of original digital files, while said virtual digital file includes its own virtual digital data and a signature associated with the virtual digital file, obtained by means of a one-way virtual digital data functions, wherein said virtual digital file is not real, but is only used to generate a signature associated with the virtual digital file from its virtual digital data; and a control root digital signature associated with said package of original digital files is computed from a tree having all of the package's original digital file signatures, including the virtual digital file signature, as leaf nodes. 5. The method according to any one of claims 1 to 4, characterized in that the additional digital data corresponding to the digital data associated with the tagged original digital file is stored in a searchable information database open to the user through an information database interface, configured to receive from the user a request for information containing digital data or a signature of a digital file obtained from the digital security marking of the marked original digital file, and send back the corresponding additional digital data. 6. The method according to any one of claims 1 to 5, characterized in that the digital data of the marked original digital file includes control characteristic digital data of the corresponding unique physical characteristic of the associated object or person. 7. The method according to claim 6, characterized in that the unique physical characteristic of the associated object or person is, respectively, a characteristic of a material-based security marking applied to the associated object or identifying a biometric feature of the associated person. 8. The method according to any one of claims 1 to 7, characterized in that in the case of distributing the digital data of the respective original digital files of the package between given fields common to all digital files of the package, and specific digital data related to these fields are not included in digital data, but grouped into a separate field data block associated with the package, and in doing so: i) the signature of the original digital file is computed using a one-way concatenation function of the corresponding digital data and the field data block; and ii) the control root digital signature is made available to the user along with the associated field data block. 9. A method for verifying the authenticity of a digital file protected according to the method according to any one of paragraphs. 1-7, or correspondence of a copy of such a protected digital file with respect to the original file, characterized in that the method includes the steps, when processing a test file, which is a specified digital file or a specified copy of a digital file, by means of a processing unit - 23 042505 botki, connected to the memory of saving in the memory of the test file; reading a digital data representation and a digital verification key on the digital security marking of the stored test file and extracting corresponding test digital data and a test digital verification key from said read representation, respectively; storing in memory the control root digital signature of the root node of the original digital file package tree, and programming in the one-way function processing unit to calculate the digital signature of the digital data and concatenate the digital signatures according to the node order in the tree and the tree concatenation order; verifying the actual correspondence of the extracted test digital data and the associated test digital key of verifying the stored control root digital signature by performing the calculation steps using the one-way function of the test digital signature of the extracted test digital data, wherein the specified test digital signature corresponds to a test leaf node in the test tree corresponding to the digital protective marking of the test file; extracting from the sequence of digital signatures in the test digital signature verification key of each other leaf node of the test tree having the same parent node as the test leaf node, and calculating the digital signature of the concatenation of the test digital signature and the extracted digital signature of said each other leaf node, thereby obtaining a digital signature of said same parent node of the test leaf node; sequentially at each next level in the test tree and up to the penultimate level of extraction nodes from the sequence of digital signatures in the test digital key for verifying the digital signature of each other node, different from the leaf, test tree, which has the same parent node as the previous same parent node, discussed in the previous step, and calculating the digital signature of the concatenation of the digital signature of said respective each other node other than a leaf node and the resulting digital signature of said previous same parent node, thereby obtaining a digital signature of said same parent node of said previous same parent node; computing a digital signature of the concatenation of the obtained digital signatures of the non-leaf nodes corresponding to the penultimate level of the test tree nodes, thereby obtaining a potential root digital signature of the root node of the test tree; and checking that the received candidate root digital signature matches the stored control root digital signature, whereby, if said root digital signatures match, the digital data of the test file is the data of the original digital file. 10. The method according to claim 9, characterized in that the tagged original digital file is protected according to the method according to claim 8, the memory of the processing unit additionally stores the associated field data block, and at the same time the step of calculating the test digital signature corresponding to the test leaf node in the test tree , corresponding to the digital security mark on the test file, includes the calculation using the one-way digital signature function of the concatenation of the extracted test digital data and the stored field data block. 11. The method according to any one of claims 9 and 10, characterized in that the digital file is protected by storing the control root digital signature in a searchable root database open to the user according to the method according to claim 2, and the processing unit is additionally connected to a communication unit configured to send and receive data back via a communication channel, wherein the method includes the preliminary steps of sending a request by the communication unit via a communication channel to the specified root database and receiving back the control root digital signature and storing the received root digital signature in the memory memory. 12. The method according to any of claims 9 and 10, characterized in that the digital file is protected according to the method according to claim 3, the processing unit is additionally connected to the communication unit, configured to send and receive data via a communication channel, while the method includes preliminary steps for reading the root node access data included in the test file; sending by the communication unit via the communication channel a root request to the specified access interface containing digital data or a digital signature of the specified digital data obtained from the digital security marking on the test file, and receiving back the corresponding control root digital signature of the associated package; and storing the control root digital signature in memory. 13. The method according to any one of claims 9-12, characterized in that the digital file is protected according to the method according to claim 5 and the image forming device is additionally equipped with communication means configured to send a request for information to the information database interface. - 24 042505 containing digital data or a signature of a digital file obtained from the digital security marking of the test file, and receiving back the corresponding additional digital data. 14. The method according to any one of claims 9 to 13, characterized in that the digital file is protected according to the method according to any one of claims 6 and 7 and the imaging device is further equipped with a sensor configured to detect a unique physical characteristic of a correspondingly associated object or person , and the processing unit is programmed to extract the corresponding characteristic digital data from the detection signal received from the sensor, the imaging device stores in the memory the control characteristic digital data CDD corresponding to the specified unique physical characteristic, respectively, of the associated object or person, while the method includes additional the steps in considering a subject that is a specified related object or person: detecting with the sensor a unique physical characteristic of the subject and extracting the corresponding potential characteristic digital data CDD ^c ; comparison of the received potential characteristic digital data CDD ^c with the stored control characteristic digital data CDD and in the case of similarity of the potential characteristic digital data CDD ^c with the stored control characteristic digital data (CDD), with a given criterion of tolerance, the subject is considered to correspond, respectively, to a genuine object or a person actually connected to the original digital file. 15. A digital file belonging to a package of a plurality of original digital files and protected according to the method of any one of claims 1 to 8, wherein each original digital file of the package has its own digital data and a corresponding digital verification key, said package has a corresponding control root digital a signature, wherein the file contains a machine-readable security marking including a representation of its digital data and its verification key. 16. The digital file of claim 15, wherein the digital data includes CDD reference characteristic digital data of the corresponding unique physical characteristic of the associated object or person. 17. The digital file of claim 16, wherein the unique physical characteristic of the associated object is a characteristic of a material-based security marking applied to the associated object. 18. A system for verifying the authenticity of a digital file or the correspondence of a copy of such a digital file with respect to the marked original digital file belonging to the package of original digital files protected according to the method according to any one of paragraphs. 1 to 7, wherein the system comprises an imaging apparatus having an imaging unit, a processing unit with a memory, and an image processing unit, wherein the memory stores a control root digital signature of a tree corresponding to a package of original digital files, and a one-way function for calculating a digital signature digital data and concatenation of digital signatures according to the tree node order and the tree concatenation order programmed in the processing unit, said system being configured to store in memory a test file representing said digital file or said copy of the digital file; reading a digital data representation and a digital verification key on the digital security marking of the stored test file and extracting corresponding test digital data and a test digital verification key from said read representation, respectively; verifying the actual correspondence of the extracted test digital data and the test digital key of verifying the stored control root digital signature by performing a calculation on the processing unit of programmed operations using the one-way function of the test digital signature of the extracted test digital data, while the specified test digital signature corresponds to the test leaf node in the test tree corresponding to the digital security marking of the test file; extracting from the sequence of digital signatures in the test digital signature verification key of each other leaf node of the test tree having the same parent node as the test leaf node, and calculating the digital signature of the concatenation of the test digital signature and the extracted digital signature of said each other leaf node, thereby obtaining a digital signature of said same parent node of the test leaf node; sequentially at each next level in the test tree and up to the penultimate level of extraction nodes from the sequence of digital signatures in the test digital key for verifying the digital signature of each other node, different from the leaf, test tree, which has the same parent node as the previous same parent node, considered in the previous step, and calculating the digital signature of the concatenation of the digital signature of the specified corresponding -