EP1380017B1 - Method for producing a data carrier and data carrier - Google Patents

Description

The invention relates to a method for producing a data carrier according to claim 1 or 4 as well as a data carrier produced according to the method according to claim 7 or 8.

The above data carriers are value or security documents, in particular identity cards or credit cards, which, in addition to general information, have individual information such as user name, user portrait, serial number or the like personal, card or document-specific information. This individual or specific information is preferably the subject of counterfeiting and manipulation and must be secured accordingly.
A method according to the preamble of claim 1 is known from US 4,641,347 known. This document discloses a system for generating postage indicia having encrypted postage, dispatch station and receiving station information with a device for printing such markings and with a device for reading such markers. Among other things, the data is encrypted for printed text by moving individual pressure points of the matrix that builds up the letters and numbers, and is recorded by a visually working reader during the test. In this case, a part of a series of these letters and characters is used as encrypted material for verification of the message, while the remaining portions and a portion of a bar code are used purely for communicating the message. document DE 19706008 discloses a value or security document having alphanumeric characters which are provided with microscopic colored structures, the color being linked to a code with data to be protected from falsification of the document.
Another genus-like process is from the EP 0 730 243 known. This document shows a data carrier on which information, namely an image, is visually visible. This image is also suitable as an image of a person to customize the disk. This information of the image is encrypted by removing individual reference points. In the prior art, individual elements of the image are encrypted as reference points and this information is stored and deposited elsewhere on the volume.
From the US 4,995,081 For example, there is known a system for determining the identity of a person using a data carrier in which non-secret information of the user is stored in encrypted form on the card, the system then providing features for increasing security in connection with a payment terminal.
From the US 5,337,361 For example, a data carrier is known in which graphical information, such as the identity of a cardholder, is interwoven with written information in order to increase security. It is emphasized that the graphical information can lead to a deterioration of the machine readability of the text information, which can be counteracted by an appropriate coding.
From the EP 0 466 146 For example, a system having an encryption table for selecting characters for printing in encrypted form is known.

From the EP 0 906 834 A2 a data carrier with at least one individual information is known, wherein the individual information comprises a serial number, which consists of a first part and a second part. The first part and the second part of the serial number may have a different color and are applied to the data carrier so that the complete serial number is reproduced. By dividing the serial number and by register-accurate printing of the two parts of forgery and tamper protection should be increased.
However, the division of the serial number and the colored marking of the two parts are arbitrarily determined and applied to a variety of data carriers, such as banknotes, in a consistent form and in a consistent color design, so that counterfeiting and manipulation can not be excluded.

The invention is therefore based on the object to provide a method for producing a data carrier and a data carrier, which has an improved counterfeit or tamper protection.

This object is solved by the features of the independent claims. Advantageous developments are described in the subclaims.

A central idea of the method according to the invention is that a first piece of information representing individual information, such as the name of the authorized user of the data carrier, is encrypted by means of an algorithm and the result of the encryption is stored on the data carrier. The result of the encryption represents additional information that can not be decrypted by the general public. Only authorized persons who have the algorithm will be able to decrypt the additional information and determine from the additional information whether forgeries or tampering has taken place. At least one character of the first information is marked as a function of the result of the encryption. Markings according to the invention are colored or other visually visible markings of the signs of the first information in order to facilitate the checkability. Additionally or alternatively, the marking of the first information can be effected by other suitable markings, whereby suitable markings are those markings which, if they are not visually recognizable, can be detected with appropriate aids, such as detectors or similar devices. For example, fluorescent or magnetic markings of the characters of the first information may be provided.

The algorithm underlying the encryption can not be designed in accordance with the invention such that only a single piece of information, for example the first piece of information, is included in the algorithm and, as a result, a marked first piece of information results. In order to achieve a more complex encryption, according to the invention one or more second information, such as serial numbers or the like information is provided in addition to the first information, which are included in the algorithm in addition to the first information. The second information need not be visually visible or readable on the disk. They can be hidden and / or encrypted in the area or outside the area of the data carrier, which increases protection against tampering or tampering. To carry out the encryption, in particular when checking the data carrier, the second stored such Information converted into machine-readable or computer-readable characters.

The algorithm is essentially carried out on the basis of operators, with a large number of operators being available for this purpose. Preferably, operators for bit manipulations, such as exclusive OR operators, or binary arithmetic operators, such as addition operators or modulo operators, are used. These operators typically require two operands or information to perform a join. However, they can also be applied to a single operand or information, for example, if a constant (number) value is assigned to the other operand. Before the operators are applied to the information (s) intended for encryption, it is expediently converted into numerical or integer numerical values, for example based on the ASCII character set.

Encryption is easy to carry out on the basis of these operators, without starting from the result, i. starting from the marked first information, conclusions about the execution of the marking or on the specific implementation of the algorithm or the information included in the algorithm are possible.

One step of the algorithm is to obtain a sequence of digits by applying one or more suitable operators to the first and / or second information (s). Preferably, the sequence of digits has a limited number of different digit values. This can preferably be done with the help of binary modulo operator, which can be used in addition to or as an alternative to the operators mentioned above. The sequence of digits expediently has at least two different digit values, such as "0" or "1", wherein the digits or the digit values are each assigned a specific identifier, such as a color. The numbers marked in this way are assigned to the characters of the first information, so that the characters of the first information receive a label corresponding to the assigned digit. The marking of the first information generated in this way is easy to carry out and represents an effective measure for protection against counterfeiting or manipulation.

A fake or manipulated disk can be easily detected by a check. As part of the review, the information (s) relevant for the implementation of the encryption is or will first be recorded. Then the algorithm is applied to the information (s). By means of a comparison of the marking of the first information obtained by means of the algorithm with the marking of the first information deposited on the data carrier, unauthorized interventions can easily be ascertained.

The invention further relates to a data carrier, such as a badge, credit card or the like value or security document. The data carrier according to the invention is produced by the method described above. A core idea of the invention. Data carrier is that the first information is encrypted so that it is at least partially marked deposited on the disk. The mark of the first Information is an authenticity feature. It is therefore not possible to change the marked first piece of information or parts thereof without being detected by a check.

Of the markings of the first information described above are the visually recognizable markings, such as an alternating colored or a different visual design of the characters of the first information, according to the invention. These visually recognizable markings can be very advantageous in the labeling process integrate, for example, when the disk is labeled with a laser (color).

Further preferred and below-listed embodiments of the invention provide that one or more second information (s), which serve to encrypt the first information, are stored inaccessible to unauthorized persons.

According to an advantageous embodiment, the second information (s) is / are contained in a storage or additional element provided on the data carrier, such as an integrated circuit, magnetic strip or the like. Additionally or alternatively, the second information (s) may be provided outside the area of the data carrier, the second information (s) preferably being stored in an external memory, for example in a central database or similar memory device is or are. This constructive measure makes the verification by authorized persons easier, as the second information (s) on can be detected in a simple manner by being read from the memories mentioned above. Moreover, in the case of such a secure deposit of the second information (s), a second information which is uniform for all data carriers can be provided.

A further simplified possibility of checking the data carrier according to the invention results according to a further preferred embodiment in that the encryption information provided for the information and the algorithm itself are stored in the integrated circuit of the data carrier. For this purpose, the integrated circuit preferably comprises a microprocessor chip. Microprocessor chips are extremely difficult to manipulate and therefore allow inaccessible storage of the above data for unauthorized persons. Particularly advantageous in this embodiment is the ability to retrieve the result of the encryption for the purpose of verification directly from the disk or from the integrated circuit.

According to a further advantageous embodiment, the second information (s) is / are contained in a pictorial representation provided on the data carrier, wherein the second information is or are stored encrypted and / or hidden in the pictorial representation , This structural measure is particularly suitable for identity cards or documents on which a pictorial representation in the form of a user portrait is applied. The user portrait represents a person-specific information that is often subjected to forgery or manipulation, for example by the original user portrait through a new user portrait is replaced. By depositing encrypted and / or hidden information in the pictorial representation of these are also removed in such manipulations or at least changed so that such an intervention can be determined.

Fig. 1

einen erfindungsgemäßen Datenträger in Draufsicht,

Fig. 2 und 3

Tabellen zur Verdeutlichung der Durchführung einer Verschlüsselung, und

Fig. 4

eine schematisch dargestellte Anordnung zur Überprüfung des erfindungsgemäßen Datenträgers.

The invention is explained below, also with regard to further features and advantages, based on the description of exemplary embodiments and with reference to the accompanying drawings. It shows:

Fig. 1

a data carrier according to the invention in plan view,

FIGS. 2 and 3

Tables to illustrate the implementation of encryption, and

Fig. 4

a schematically illustrated arrangement for checking the data carrier according to the invention.

In Fig. 1 an embodiment of a data carrier 1 is shown, which represents an identification card. On the data carrier 1 are individual information, in particular personal or card-specific information, such as user name 3, serial number 5, user portrait 10, birth data of the user and the like information readable or visually visibly applied. This individual information can be supplemented by a plurality of machine-readable characters or lines, which are provided in the specific embodiment in the lower region of the data carrier 1. The data carrier 1 may comprise an integrated circuit 2, which expediently includes a microprocessor chip. Alternatively or additionally, a magnetic strip (not shown) may be provided.

The user name 3 represents a first information and comprises a defined number of characters 4, which are applied marked on the disk 1, that each character 4 has a certain color. Instead of the differently colored or changing colored design of the characters 4, other suitable visually visible markings may be provided. For example, the characters 4 may differ in their typeface by the characters 4 are alternately applied in normal, italic or bold on the disk 1. Such markings can be advantageously integrated into the labeling process, wherein the marked user name 3 or any other marked first information is preferably applied to the data carrier 1 by means of laser printing, laser radiation, dye sublimation printing, thermal transfer printing or inkjet printing. Another way of labeling includes, for example, the use of fluorescent materials or magnetic materials that can be on or in the disk 1 by suitable methods or introduced.

In order to avoid a transparent relationship between the characters 4 of the user name 3 and their respective colors, the user name 3 to be marked is encrypted on the basis of an algorithm. The encryption of the user name 3 is described below on the basis of Fig. 2 and 3 described in detail.

In Fig. 2 is shown a table to illustrate the encryption. The user name 3, consisting of last name and first name, is arranged character by character in line 11 of the table. The user name 3 is encrypted with the serial number 5, which represents a second information intended for encryption. The serial number 5 has a defined number of characters 6 and is arranged character by character in line 13 of the table.

In a first step of the encryption, the characters 4 of the user name and the characters 6 of the serial number 5 are converted into numerical or integer numerical values 7 and 8 using the ASCII character set, as shown in lines 12 and 14 of the table. In a further step, the numerical values 7 of the user name 3 and the numerical values 8 of the serial number 5 are linked together in numbers or bit by bit using an exclusive OR operator XOR. The result of this link is shown in line 15 of the table. Instead of the exclusive OR operator XOR, other suitable operators for bit manipulations or binary arithmetic operators, such as addition operators +, may be applied to the numerals 7 and 8. In a further step, a modulo operator%, which counts among the binary arithmetic operators, is applied to the result of the above link. Based on the% modulo operator, a sequence of digits 9 is listed, which is listed in line 16 of the table. The digits 9 comprise a defined number of different digit values, the number of different digit values being determined by the selection of a divisor T of the modulo operator%. If the divisor T of the modulo operator% is assigned the value "2", then two different digit values "0" and "1" are obtained, as in line 16 of FIG Table is shown. The digits 9 or the different numerical values in line 16 of the table are each assigned a specific color or other marking in a further step, so that each digit 9 represents a particular color. For example, the numbers 9 with the numerical value "0" are assigned the color blue, whereby the color blue is illustrated by the symbol o. The numbers 9 with the digit value "1" are assigned the color red, whereby the color red is indicated by the symbol *. The color-coded digits 9 are assigned to the character 4 of the user name 3 in a further step, as shown in line 17 of the table, so that the characters 4 receive a color corresponding to the assigned digit 9.

The choice of the divisor T of the modulo operator% depends essentially on how many colors or other markings are to be used. If you want to mark the user name 3, for example, with 3 different colors, the divider T is set to the value "3", as shown in line 18 of the table. Hereby, a total of three different digit values "0", "1" and "2" are obtained, to which a certain color is assigned. The newly added digit value "2" is assigned a further color, for example the color green, wherein the color green is marked by the symbol Δ. The color-coded digits 9 are assigned to the character 4 of the user name 3 in a further step, so that a three-color marked user name 3 results from this, as is illustrated in line 19 of the table.

Another embodiment for encrypting the user name 3 is in Fig. 3 based on a second table clarified. As a second information intended for encryption, the user name 3 is provided in a modified form. The modified user name 3a comprises characters 4a and is arranged in row 13a of the table. The modified user name 3a is obtained by shifting the user name 3 arranged in line 11a, for example, by one character position to the right, and placing the character "k" at the right-hand end of the line at the beginning of the line. Alternatively, the username 3 may be shifted by several character positions or otherwise changed so that a modified form of the user name 3 is obtained. Analogous to the previous example according to Fig. 2 For example, the characters 4 of the user name 3 and the characters 4a of the modified user name 3a are converted into numerical and integer numerical values 7 and 7a, respectively, as shown in lines 12a and 14a, using the ASCII character set. The exclusive OR operator XOR is applied to the numerical values 7 and 7a and the result of the link shown in line 15a is obtained. Subsequently, the modulo operator% is applied to the divisor T equal to "2" (see line 16a) or alternatively the modulo operator% to the divider T equal to "3" (see line 18a) to the result listed in line 15a to get a sequence of numbers 9. The numbers 9 have, as already mentioned above, depending on the choice or value of the divider T a defined number of different numerical values. The assignment of defined or different colors is carried out analogously to the example described above Fig. 2 , It can be clearly seen that by using only a different second information, namely by using the modified user name 3a instead of the serial number 5, a completely different mark of the Username 3 results as shown in line 17a or 19a of the table.

Instead of the exclusive OR operator XOR, for example, the addition operator + or similar operators can be applied to the numerical values 7 of the user name 3 and to the numerical values 8 or 7a of the serial number 5 or the modified user name 3a. To achieve a more complex encryption, several operators can be applied to the above numerals 7, 8 and 7a.

According to the invention, each visually visible, individual or first information provided on the data carrier 1 can be marked on the basis of the algorithm described above. It is not necessary that always the user name 3 or any other first information to be marked with the serial number 5, the modified user name 3a or any other second information is linked. For example, the serial number 5 may be linked to the modified user name 3a to obtain a sequence of numbers 9. It is essential that, as a result of the encryption, the characters 4 of the user name 3 are assigned a defined color or other marking suitable for distinguishing the characters 4, as in lines 17 and 19 of the table of FIG Fig. 2 and in lines 17a and 19a of the table according to Fig. 3 is shown.
According to another embodiment, the serial number 5, the modified user name 3a or the like second information in the integrated circuit 2 of the data carrier 1 included. Alternatively, this information can be stored on a magnetic strip (not shown) of the data carrier 1. Another way to increase protection against Counterfeiting and manipulation is that, for example, the serial number 5 and / or the modified user name 3a are provided according to a further embodiment outside the range of the data carrier 1 and preferably in an external memory 23 (see. Fig. 4 ) are stored. As external memory 23 is a secured against unauthorized access central database. With such a secure storage, for example, a second information unit that is identical for all data carriers 1 can be provided for encrypting the respective user name 3 or the like first information.

The data carrier 1, in addition to the person and card-specific names and labels on a user port 10 or other pictorial representation. According to a further advantageous embodiment, for example, the serial number 5 and / or the modified user name 3a is stored in the user portrait 10 (not shown). The serial number 5 and / or the modified user name 3a can be encrypted, for example present as a barcode, such a deposit or storage of information preferably being carried out with a steganographic method.

Additionally or alternatively, the serial number 5 and / or the modified user name 3a can be hidden in the user portrait 10. The hidden arrangement of the serial number 5 and / or the modified user name 3a takes place in the form of a secondary image, for example in the form of the barcode mentioned above, the secondary image in the user portrait 10, which represents a primary image, in such a way is hidden, that it is recognizable only by means of a decoder or the like aids.

In Fig. 4 an arrangement for checking the data carrier 1 is shown schematically.

For checking the data carrier 1, the marked user name 3 or another marked first information as well as the serial number 5 intended for encryption or another second information intended for encryption are detected and digitized by a camera 20 or an optical scanner. In a downstream microprocessor 21, the recorded image data of the user name 3 and the serial number 5 are evaluated and converted by means of optical character recognition (OCR) to computer-editable characters 4 and 6. The computer-operable characters 4 and 6 of the user name 3 and the serial number 5 are supplied to a verification unit 22. In this verification unit 22, the algorithm described above is applied to the characters 4 of the user name 3 and the characters 6 of the serial number 5, and the mark of the user name 3 is determined again. If the ascertained marking of the user name 3 is identical to the marking of the user name 3 deposited on the data carrier, the data carrier 1 is considered genuine.

If the user name 3, the serial number 5 or other first and / or second information intended for encryption are stored in the integrated circuit 2 or magnetic strip, this information is read out via a card reader 24 and forwarded to the verification unit 22. Is this information stored outside the area of the data carrier 1 in an external memory 23, they can be retrieved from the external memory 23 and the verification unit 22 are supplied.

According to a further embodiment, the user name 3, the serial number 5 or other information intended for encryption as well as the algorithm are stored in the integrated circuit 2, wherein the integrated circuit 2 expediently comprises a microprocessor chip. The verification of the data carrier 1 can be done directly by means of the microprocessor chip in this embodiment.

Overall, the inventive method and the data carrier according to the invention is characterized by an efficient protection against counterfeiting and manipulation and by a cost-effective production. The encryption described above can be made arbitrarily complex due to the large number of available operators. Moreover, based on the encryption, a defined marking of one or more information on the data carrier can be effected, the coding of which is only accessible to authorized persons.

LIST OF REFERENCE NUMBERS

1

disk

2

integrated circuit

3

User name

3a

modified username

4

Character (username)

4a

Characters (modified username)

5

serial number

6

Characters (serial number)

7

Numerical value (user name)

7a

Numerical value (modified username)

8th

Numerical value (serial number)

9

digits

10

user Portrait

11 - 19

table rows

11a-19a

table rows

20

camera

21

microprocessor

22

verification unit

23

Storage

24

card reader

XOR

exclusive or operator

%

Modulo operator

+

Addition operator

T

divider

*

Red color

○

blue colour

Δ

green colour

Claims (12)

1. Method for producing a data carrier, like an ID card, a credit card or the like worth- or security document, comprising at least one first information (3) that is visually visible readable provided on the data carrier and is suitable to individualize the data carrier from a series of data carriers, wherein the first information (3) is encrypted with an algorithm and the result of the encryption is deposited on the data carrier, wherein the first information (3) comprises a defined number of characters (4a, 6), and wherein the result of the encryption is deposited on the data carrier as such that at least one character (4) of the first information (3) is marked, wherein at least a second information (3a, 5) is provided that is designated for the encryption of the first information (3), and wherein the at least one second information (3a, 5) for the encryption comprises machine readable resp. computer-processable characters (4a, 6) or is converted into machine readable resp. computer-processable characters, and wherein the underlying algorithm of the encryption comprises the following steps:

   a) converting the characters (4) of the first information (3) and/or the characters (4a, 6) of the second information (3a, 5) in numerical values resp. integers (7; 7a, 8), for example on the basis of the ASCII character set, and

   b) applying at least one operator on the numerical values (7) of the first information (3) as such that a series of numerals (9) is resulting from it, and

   c) marking of the numerals (9) as such that the numerals (9) of each specific colour are assigned as identification, and

   d) assigning of the identification comprising numerals (9) to the characters of the first information (3), such that the characters (4) of the first information (3) receive a respective colour of the associated numeral (9), such that a visually visible identification of the characters (4) in the form of a differently coloured design of the characters (4) is resulting.
2. Method according to claim 1, characterised in that the at least one operator is selected from a group of operators, wherein the group of operators preferably comprises operators for bit manipulations, such as exclusive or-operators (XOR), and binary arithmetic operators, such as addition operators (+), modulo operators (%) or the like operators.
3. Method according to claim 1 or 2, characterised in that the received series of numerals (9) comprises a defined number of different numerical values, wherein the number of different numerical values is given by the choice of a divider of the binary modulo operator (5).
4. Method for producing a data carrier, like an ID card, a credit card or the like worth- or security document, comprising at least one first information (3) that is visually visible readable provided on the data carrier and is suitable to individualize the data carrier from a series of data carriers, wherein the first information (3) is encrypted with an algorithm and the result of the encryption is deposited on the data carrier, wherein the first information (3) comprises a defined number of characters (4a, 6), and wherein the result of the encryption is deposited on the data carrier as such that at least one character (4) of the first information (3) is marked, wherein at least a second information (3a, 5) is provided that is designated for the encryption of the first information (3), and wherein the at least one second information (3a, 5) for the encryption comprises machine readable resp. computer-processable characters (4a, 6) or is converted into machine readable resp. computer-processable characters, and wherein the underlying algorithm of the encryption comprises the following steps:

   a) converting the characters (4) of the first information (3) and/or the characters (4a, 6) of the second information (3a, 5) in numerical values resp. integers (7; 7a, 8), for example on the basis of the ASCII character set, and

   b) applying at least one operator on the numerical values (7) of the first information (3) as such that a series of numerals (9) is resulting from it, and

   c) marking of the numerals (9) as such that the numerals (9) are assigned to a specific typographical identification, and

   d) assigning of the identification comprising numerals (9) to the characters of the first information (3), such that the characters (4) of the first information (3) in accordance to the assigned numeral (9) are applied on the data carrier as identification in normal, italic or bold writing, such that a visually visible identification of the characters (4) is realised in the form of a different typographic design of the characters (4).
5. Method according to claim 4, characterised in that the at least one operator is selected from a group of operators, wherein the group of operators preferably comprises operators for bit manipulations, such as exclusive or-operators (XOR), and binary arithmetic operators, such as addition operators (+), modulo operators (%) or the like operators.
6. Method according to claim 4 or 5, characterised in that the received series of numerals (9) comprises a defined number of different numerical values, wherein the number of different numerical values is given by the choice of a divider of the binary modulo operator (5).
7. Data carrier, like ID card, credit card or the like worth- or security document, produced according to a method according to one of claims 4 to 6, with at least one first information (3) that is visually visible, readable provided on the data carrier and is suitable to individualize the data carrier from a series of data carriers, wherein the first information (3) is encrypted with an algorithm and the result of the encryption is deposited on the data carrier, wherein the first information (3) comprises a defined number of characters (4), characterized in that the result of the encryption is deposited on the data carrier as such that the characters (4) of the first information (3) are marked as such that each character (4) alternately is applied on the data carrier in normal, italic or bold writing, wherein a second information (3a, 5) that serves for the encryption of the first information (3) is provided on the data carrier.
8. Data carrier, like ID card, credit card or the like worth- or security document, produced according to a method according to one of claims 1 to 3, with at least one first information (3) that is visually visible, readable provided on the data carrier and is suitable to individualize the data carrier from a series of data carriers, wherein the first information (3) is encrypted with an algorithm and the result of the encryption is deposited on the data carrier, wherein the first information (3) comprises a defined number of characters (4), characterized in that the result of the encryption is deposited on the data carrier as such that the characters (4) of the first information (3) are marked as such that each character comprises a specific colour, wherein a second information (3a, 5) is provided on the data carrier that serves for the encryption of the first information (3).
9. Data carrier according to one of claims 7 or 8, characterized in that the first information (3) comprises personal, card or document specific designations resp. inscriptions, such as a user name (3), a serial number (5) or the like individual information that are provided on the data carrier.
10. Data carrier according to one of claims 7 to 9, characterized in that the second information (3a, 5) comprises personal, card or document specific designations resp. inscriptions, such as a user name (3), a serial number (5) or the like individual information that are especially provided on the data carrier.
11. Data carrier according to one of claims 7 to 10, characterized in that the second information (3a, 5) is enclosed in a storage or additional element, such as an integrated circuitry (2), a magnet strip or the like that is provided on the data carrier, and/or is provided outside of the area of the data carrier, wherein the second information (3a, 5) is stored preferably in an external storage (23), for example in a central data base or the like memory device.
12. Data carrier according to one of claims 7 to 10, characterized in that the second information (3a, 5) are enclosed in a pictorial representation (10) that is provided on the data carrier, wherein the second information (3a, 5) is preferably deposited encrypted and/or hidden in the pictorial representation (10).

Images