GB2459239A - Product authentication and supply line security system therefor - Google Patents

Abstract

An authentication system to prevent counterfeit products from infiltrating supply chains, at a point below the producer allows distributors, retailers and consumers to verify the authenticity of stock by means of a single-use, multi-segmented, dynamic-length, alphanumeric code covertly embossed on the packaging or physical surface of a bulk quantity of product or a single product. The alphanumeric code is transmitted by mobile device to an authentication, multi-nodal, database, which compares the code to a duplicate in storage. For the database to respond that authentication was successful by means of an automated SMS message to the mobile device of the authenticator, it is necessary that all digits match those of the decrypted duplicate and that an actor above the present authenticator in the supply chain had authenticated the same stock, whether or not in a larger batch quantity, by means of a different SMS access route to the same database. Different sections of the code are generated according to different time frames and structured to contain details of a particular product maker.

Description

PRODUCT AUTHENTICATION AND SUPPLY LINE SECURITY SYSTEM

THEREFOR

The invention provides a means for product authentication, which is further reinforced by a further enhancement of the security of the supply chain in which the product travels to the end user. This is achieved by curtailing the entry of counterfeit products into any level of the supply chain below the product maker such as wholesalers, distributors, consignees, retailers and product end-users.

Field of Invention

Social When a counterfeit product enters a certain point of a supply chain, it is first to the detriment of those at the top of that chain who loses a portion of the market for their own genuine product, and then very often to the detriment of the product end user if, as is usually the case, the product is of inferior quality. But even when it is of similar quality.

consumers may buy a product for a plethora of other reasons not directly embodied in the product itself and will at any rate prefer not to buy counterfeit products. If none of these concerns are of any value to a consumer, and he or she will willingly buy a counterfeit product knowing it to be counterfeit, for whatever reason but usually to do with cost, then such a consumer is said to be complicit in the act, and this distinction between complicit and non-complicit consumers is fundamental to the design of anti-counterfeiting systems to combat the illicit practice.

If in the view of a producer the end consumer especially, but also to a certain extent other components of the supply line to the consumer, will not willingly substitute counterfeit products for genuine articles, then the technology he or she is likely to adopt will rely on the end user or others downwards the supply line to make good of it to verify the authenticity of the product. Evidently, this scenario is likeliest when the product has health and safety implications such that a malfunction or inefficacy could have particularly undesirable results. Which is to say that the higher the risk pertaining to inefficacy and malfunction, and also, sometimes even more crucially, the lower the ability of the consumer to discern in appropriate time the presence of a malfunction or inefficacy, the greater the likelihood that a consumer will be non-complicit in the practice of counterfeiting.

A number of products such as drugs, foods, cosmetics, and chemicals of various sorts, automobile parts, aeronautical components. and medical devices, fall into the category of products of which consumers will often be hard put upon to condone their counterfeiting thereof.

On the other hand, for sonic categories of products, usually less likely to pose grave harm to users or others around them in the event of inefficacy or malfunction, the end user will often prioritize cost and show a greater willingness to tolerate lower performance or even non-performance seeing either as an acceptable risk. In this case the end-user may be complicit. Typical examples of such categories of products include: various entertainment discs, software packages for noncritical tasks, and certain pieces of computer hardware accessory.

The producer in this context, faced with complicit end users, will opt for an authentication system that integrates an activation module, such that the smooth operation or use of the product will depend on a successful validation of the product's authenticity.

Further, the producer will sometimes so design the authentication system that an intermediary technology, sometimes called a "reader", will be needed to mediate between the end user and the authentication system.

Technical In the light of above considerations, authentication systems that presuppose the complicity of the end-user, or refuse to commit one way or the other to making that determination, will incorporate complex mechanisms at the front end of the system where it interacts with the end-user/authenticator.

In some instances, genetic material will be programmed to uniquely mark the product, on a per item basis, in the notion that alteration at any stage will be impossible, given the peculiar characteristics of such materials. The authenticator at any point on the supply line would be expected to interact with this level of complexity during the process of authentication with the aid of a special device, or "reader".

In other instances, a multi-layered application of nanoparticles will be preferred. By means of intricate chemical patterning, a non-duplicable identification mark is achieved which, decipherable only by a specialized reader, authenticates the product to the benefit of the end user.

In other illustrations of the principle, covert data are stored in miniaturized hardware subsequently appended to the product. This data, accessible only to a specially programmed reader, represents to the product end-user/authenticator that the specific product is the genuine article as intended by its maker. For additional levels of security, this data may instead act as a key to access a remote backend authentication system which completes the authentication process.

Background of the Invention (Prior Art)

Patent Background

The following patents are relevant to the invention disclosed in this document: Publication Number: WO/2003/038767 Application No.: ________________________________________________ Publication Date: 08.05.2003 International Filing 31.10.2002 Date: __________________________________________________ mt. Class.: GO7D 7/00 (2006.01), 007F 7/12 (2006.01), GO9F 3102 ___________________ (2006.01) Applicant: BOUTIIIAUX, Catherine [FR/FRI; 194, rue Saint Genes F- ____________________ 33000 Bordeaux (FR).

Inventor: BOUTFIIAUX, Catherine [FR/FRI: 194, rue Saint Genes F- ____________________ 33000 Bordeaux (FR).

Agent: POUCHUCQ, Bernard; Aquinov 12, rue Condorcet F-33 150 ____________________ Cenon (FR).

Priority Data: 01/14148 31.10.2001 FR Title: (EN) METHOD FOR PRODUCT TRACEABILITY AND

AUTHENTICATION

(FR) PROCEDE DE TRACABILITE ET ______________ D'AUTHIENTIFICATION DE PRODUITS Abstract: (EN) The invention concerns a method for traceability and authentication of a product with high added value such as bottled, corked, capped and labeled wine or sensitive products such as medicines individually protected in a labeled package. The invention is characterized in that it comprises the following steps: affixing at least a first identification code (18) marked in clear, on the upper surface of the cork (10) or on the individual protection of the medicine, or on the label, said code being generated by an algorithm held by the producer and readable by that same algorithm; affixing at least a first identification code (22) marked in clear, on the cap (12) of the bottle or on the package, box, flask or blister pack, of the medicine, said code being generated by a algorithm held by the producer and readable by that same algorithm; and recording with the producer, on any appropriate media, combinations of pairs of identification codes.

Publication Number: WO/2004/075098 Application No.: __________________________________________________ Publication Date: 02.09.2004 International Filing 18.02.2004 Date: __________________________________________________ mt. Class.: GO6K 17/00 (2006.01), GO6K 19/10 (2006.01), GO6K 7/00 __________________ (2006.01) Applicants: CHIYODA MAINTENANCE CORP. [JP/JP] 1632 Minowa, Asahi-niura. Kashima-gun. Ibaragi-ken 311-1493 (JP) (All Except US).

INOUE, Yoshiaki [JP/JP]; do Chiyoda Maintenance Corp., 1632 Minowa, Asahi-mura, Kashima-gun, Ibaragi-ken 311- 1493 (JP) (US Only).

YOSHIKAWA, Yuichi [JP/JP]; cfo Chiyoda Maintenance Corp., 1632 Minowa, Asahi-irnira, Kashima-gun, Ibaragi-ken 31 1-1493 (JP) (US Only).

Inventors: INOUE, Yoshiaki [JP/JP]; do Chiyoda Maintenance Corp., 1632 Minowa, Asahi-mura, Kashima-gun, Ibaragi-ken 311-1493 (JP).

YOSHIKAWA, Yuichi [JP/JP]; do Chiyoda Maintenance Corp., 1632 Minowa, Asahi-mura, Kashirna-gun, Ibaragi-ken 311-1493 (JP).

Priority Data: 2003-40692 19.02.2003 JP Title: PRODUCT AUTHENTICATION SYSTEM FOR

PREVENTING DISTRIBUTION OF COUNTERFEITS IN

______________ MARKET

Abstract: By means of preventing counterfeits on the market from entering a distribution channel, the benefit of manufacturers, dealers, distributors, and consumers forming the distribution channel. First, a data server reads ID data of a non-contact tag (11) and of a reader (12), creates data files thereof, and stores the data files in a database. The reader (12) connected to the Internet reads its own ID data and sends it to an authentication server. The authentication server checks the received ID data of the reader (12) against the data file of the reader (12) stored in the database. If the two are identical, the reader is authenticated. The authenticated reader (12) reads the ID data of the non-contact tag (11) embedded in a product and sends it to the authentication server. The authentication server checks the received ID data of the non-contact tag (11) against the data file of the non-contact tag stored in the database. If, as a result, the two are identical, the authentication server notifies the reader (12) that the non-contact tag is authenticated. The product authentication system is administered and operated by an application service provider (ASP) entity (10).

Publication Number: WO/200 1/093144 Application No.: ____________________________________________________ Publication Date: 06.12.2001 International Filing 25.05.2001 Date: ____________________________________________________ Chapter 2 Demand 19.12.2001 Filed: ________________________________________________ tnt. Class.: GO6Q 30/00 (2006.01) Applicants: DARTZ COMMUNICATION CO., LTD. [KR/KR]; Daekyung Bldg. 2F., 1385 Sungin-dong, Jorigro-ku Seoul 110- 550 (KR) (All Except US).

SUH, Kun [KR/KR]; Hyundai 2-cha Apt. 210-504, Hagye- ___________________ dong. Nowon-ku Seoul 139-230 (KR) (US Only).

Inventor: SUH, Kun [KR/KR]; Hyundai 2-cha Apt. 210-504, Hagye- ___________________ doug, Nowon-ku Seoul 139-230 (KR).

Agent: KIM, Won-Ho; Teheran Bldg., 825-33 Yoksam-dong, ___________________ Kangnani-ku Seoul 135-080 (KR).

Priority Data: 2000-28889 27,05.2000 KR Title: OFF-LINE BUYING AUTHENTICATION SYSTEM AND

______________ METHOD

Abstract: Disclosed is an off-line buying authentication system and method. Product identification numbers of the off-line selling products are generated to the products and a database for storing the product identification numbers is built. When a consumer buys a product in the off-line manner, accesses the system via a network and inputs a product identification number attached to the product to the system, the system authenticates the product corresponding to the input product identification number as that purchased by the consumer in the off-line manner in the case the product identification number has been registered to the database. After the buying authentication, the system provides the consumer with mileage points or free gifts to be used in further transactions.

Accordingly, the consumer can receive the buying authentication services at any time, the mileage points or the free gifts promote the consumer's continuous purchase, and transactions are further activated.

Publication Number: WO/1 999/003031 Application No.: Publication Date: 21.01.1999 International Filing 03.07.1998 Date: ____________________________________________________ Chapter 2 Demand 26.01.1999 Filed: ________________________________________________ mt. Class.: G06F 1/00 (2006.01), GO6F 21/00 (2006.01), GO7F 7/00 ___________________ (2006.01) Applicants: LOW, Huan, Khing [SG1SG]; Bik. 60 Dakota Crescent #06- 233 Singapore 390060 (SG).

YEO, Chwee, Seng [SGJSG]; Bik. 60 Dakota Crescent #06- ____________________ 233 Singapore 390060 (SG).

Inventors: LOW, Huan, Khing [SGISG]; Bik. 60 Dakota Crescent #06- 233 Singapore 390060 (SG).

YEO, Cbwee. Seng [SG!SG]; Bik. 60 Dakota Crescent #06- ____________________ 233 Singapore 390060 (SG).

Agent: LAWRENCE Y. D. HO & ASSOCIATES; Thongsia ___________________ Building 30 Bideford Road #07-01 Singapore 229922 (SG).

Priority Data: 9702398-0 07.07.1997 SG Title: 0FF-LINE BUYING AUTHENTICATION SYSTEM AND

_______________ METHOD

Abstract: The present invention is a method and system universally applicable to minimize unauthorized use of intellectual property products distributed to mass market.

Identification codes (ID) are assigned to individual intellectual property product and the means of using such product (User Means). Process to minimise unauthorized use of such product includes: firstly, means of selling or distributing such product (Dealer Means) to generate check code from ID of such product stored in said Dealer Means and user supplied ID of User Means. Secondly, Dealer Means supplies such check code to such product placed in said User Means to execute check code authentication by verifying such check code with the code generated from ID of such product and ID of said User Means before allowing use of such product on said User Means to proceed. Alternatively, such check code is generated by User Means from ID of said User Means and ID of such product supplied by individual portable tamper-proof data storage device e.g. plastic card embedded with magnetic storage strip or integrated circuit, such data storage device being distributed together with such product to said User Means. Objectives of the present invention are achieved by embedding essential data and modalities required to execute such check code generation and check code authentication processes into at least one tamper-proof data storage device.

Publication Number: WO!2007/049869 Application No.: __________________________________________________ Publication Date: 03.05.2007 International Filing 12.10.2006 Date: __________________________________________________ mt. Class.: GO6Q 99/00 (2006.01) Applicant: LEE, Hang Kyung [KR/KR]; #B-1606, Michelan Cherevill, 180, Jeongja-dong. Bundang-gu, Seongnam-si, Geyonggi-do _____________________ 463858 (KR).

Inventor: LEE, Hang Kyang [KR/KR]; #B-1606, Michelan Cherevill, 180. Jeongj a-dong, Bundang-gu, Seongnam-si, Geyonggi-do _____________________ 463-858 (KR).

Agent: LEE, Un Cheol; 11th Floor, Won Bldg., 648-26 Yeoksam- ___________________ doug, Gangnam-gu, Seoul 135-080 (KR).

Priority Data: 10-2005-0101428 26.10.2005 KR 10-2006-0094134 27.09.2006 KR ___________________ 2000-28889 27.05.2000 KR Title: METHOD AND SYSTEM FOR AUTHENTICATING

PRODUCTS USING SERIAL NUMBERS AND

______________ PASSWORDS OVER COMMUNICATION NETWORK

Abstract: The present invention relates to a method and system for authenticating products using serial numbers and passwords over a network, which can determine whether the products are genuine based on the serial numbers, which are attached to the respective products, and the passwords, which can be viewed at the time of unsealing the products. When the present invention is used, authentication for a product is performed according to whether the serial number and password of the product match and whether a request for the authentication of the serial number has been made, and thus a reliable authentication system can be provided. Furthermore, one or more passwords for the product are sealed in or attached to the product, so that, if the password is not known, an imitation is distinguished as not being a genuine product, therefore an effective authentication system can be provided.

Prior Art Known to Those Skilled in the Art

It being a case that even where supply chain actors below the producer are non-complicit in the practice of counterfeiting they will often still have immense difficulty in detecting inauthenticity, unless the differentiation between genuine articles and counterfeit ones are to such an extent that in the ordinary course of purchase, and prior to use, a non-expert product user or distributor can spot without undue exertion which article is authentic and which is not, the situation is further complicated when the product maker considers end-users as potentially complicit, or has not made a determination one way or the other.

The use of a specialised intermediary technology resolves this difficulty by allowing detailed complexity within the authentication mechanism without need for a corresponding level of training on the part of the authenticator, particularly at the end of the supply chain.

But in economically deprived communities, specialised readers, instead of fully resolving this issue concerning the interplay between complexity and training represents a significant burden of investment to supply chain controllers, and to end users cum authenticators. Furthermore, the costs of achieving front-end complexity at the point of interaction for authenticators can be prohibitive, and therefore inimical to the feasibility and economic viability of the prospective authentication system.

At any rate, unless as stated earlier on, authentication is inseparably bound to the smooth or successful operation or use of the product, front-end complexity of the authentication system may not confer additional protection against end-user complicity in counterfeiting. Rather it may pose a moral hazard by interfering with the alertness of the authenticator to major vulnerabilities, such as the corruption of readers by rogue markers on counterfeit products deliberately introduced into the supply chain not to misrepresent these products as genuine but instead to destabilise readers and undermine their role in the security of the supply chain.

The costs of front-end complexity are further exacerbated by their higher requirements for infrastructure strictly external to the authentication system as such. Whether complexity is achieved by means of genetic programming, nano-particle manipulation. or covert data accessed by radio frequency identification devices (RFID), or by some approach similar in principle, the infrastructural needs of the resultant system are unlikely to be easily met in deprived communities, limiting the rate and scale of adoption of the emergent authentication system within such communities, In view of above considerations, and particularly when the category of products for which supply chain actor authentication systems are being sought are of such a type that reasonable non-complicity on the part of product end-users can be assumed or determined, an effective authentication system that is not restricted by extensive infrastructural and investment requirements must not rely on extensive front-end complexity at the point of interaction with the authenticator.

Detailed Description of the Invention

Patent Description

Thus, against the background of existing limitations of existing methods of authentication, where complexity at the front end is the chief means of security but also a source of burden to the authenticator, the following improvements and enhancements must be embodied in a unified invention.

1. The burden of authentication should be shared such that a higher proportion is borne progressively upwards the supply chain. In particular, lower-stage actors should be able to play their role without the possession of specialist expertise, without the need to procure or handle complex equipment, and without the requirements of extensive external infrastructure.

2. The front end of the authentication system, which is appended uniquely to each product item in the supply chain to be protected, must rely on a backend system to perform its discriminating effect between genuine and inauthentic articles. The connection between the front-and backend of the authentication system should iiot rely on a specific, particularly resource-entailing, communication link.

3. The front end of the authentication system, where interaction between the system and product end-users/authenticators occur, must be a compact mechanism with an internal structure capable of dynamic representations.

In respect of the above objects, the present invention achieves its effects by embodying the front-end of the authentication system in a multi-segmented, dynamic, alphanumeric code. The communication link by means of which this code reaches the backend of the authentication system comprises of any mobile connector such as SMS, or other cellular-electronic medium. The backend of the authentication system comprises of interconnected, multi-nodal, electronic databases, capable of interaction with cellular networks and with Internet communication nodes.

The components of this authentication system, as described, coordinate to discriminate between genuine and counterfeit products to the benefit of the product end-user or other authenticator in a manner as follows.

One set of electronic databases composes an internet portal (IP) to serve within the authentication system as an internal communicator between the product maker (PM), or product makers, and an authentication system manager (AM).

One set of electronic databases constitute the system manager's facility (AM) in two parts, one of which (AM 1) communicates with the product end-user (EU) and other supply chain authenticators (SA), and another which generates multi-segmented, dynamic, alphanumeric codes (AM2).

Prior to the product maker packaging the product for entry into the supply chain, a communication is issued via the web portal (IP) to the system manager (AM) for the generation of unique, multi-segmented, alphanumeric codes (ACs) corresponding in quantity to the number of products designated for entry into the supply chain. Upon receipt of the communication, at AM!, information of the product and product maker stored during set-up is called or queried. This information concerning the product (AC1) and product maker (AC2) had been coded alphanumerically during set-up and self-altered continuously, automatically, according to pre-set timefraines. Upon being called, AC1 and AC2 are duplicated at AM 1, one set of duplicates then transfers to AM2 as alphanumeric codes of determinate length, prompting the generation of a fully random alphanumeric code also of determinate length (RC). Based upon a specific sequential arrangement, a single alphanumeric code (AC) of determinate length is produced at this stage incorporating AC!, AC2 and RC according to a structural order depending on the exact coordination needs of the authentication system. AC is transferred to AM1 at which point it is duplicated for covert output via the web portal (IP) into the product labeling facility of the product maker. AC at this stage is destined for a single, unique, product item.

But as an additional layer of security, every such transfer of a number of unique product codes (ACs) via the web portal (IP) for output at the product maker's labeling system to correspond with a quantity of individual product items is considered a batch transfer (BT). An algorithm at AM2 having completed the generation of each product code (AC), now tallies these, and by a process of algorithmic manipulation generates a single pseudo-random code (BC), which it subsequently transfers to AM1. Depending on the number of supply chain actors who must handle a particular sub-quantity of product items for whom it is expected that each such sub-quantity maintains a certain integrity, particularly that the sub-quantity not be split into the individual product items, AM! has the option to segment BC into a number of separate batch codes of equal length (BC 1, BC2, BC3.. .etc) by means of a special algorithm. This batch code (BC) or batch codes (BCs) are duplicated and outputted in the same way as AC via the web portal through the product maker's labelling system but is intended to correspond to a designated quantity or sub-quantities of products rather than to a single, individual, item.

Below the product maker in the supply chain, the following events exhibit the authentication effect according to the present invention.

When a supply chain actor -such as a distributor or other consignee -receives a batch of products, the actor must transmit the batch code (BC) via a password-protected access key (AK), such as an SMS number to the backend authentication system (AM!). A response indicating receipt. but not authenticity of the code, is returned to the device by means of which the communication was made, such as a cellular receiver. However at AM1 this code is kept in storage only if it matches the duplicate of BC generated during batch transfer (BT). If there are other batch codes (BC 1, BC2. . .etc.) corresponding to successive sub-quantities, these too must be transmitted by consignees via a password-protected access key (AK or AK!, AK2, AK3. . ..etc.) to AM!, and be validated through positive matches with their duplicates. When all consignees have transmitted the batch codes (BCs) appended to their consignment to AM1, the BC-generating algorithm now attempts to recover the original code (BC) by whose segmentation the other successive codes (BC1, BC2, BC3. . .etc.) had been derived. A successful recovery implies the authenticity of all the codes along the supply chain, and a response is communicated to the respective supply chain actors indicating success. An unsuccessful recovery likewise indicates the presence of an inauthentic code or codes and a negative message is thus communicated to the respective actors. Obviously where only a single batch code was generated (BC), authentication of the supply chain does not wait for the authentication of non-existent sub-batch codes (BC1, BC2. . .etc.) but occurs immediately through a response from AM I informing the sole supply chain intermediary of a successful authentication of the supply line.

The product maker at the top of the supply chain (PM) has the capability through IP to keep track of the responses of AM I to other actors along the supply chain, having been the initiator of the batch transfer (BT).

When the product finally reaches the end user (EU) the authentication code (AC) is unveiled by the end user, in the act of confirming the product's authenticity, and transmitted to the backend authentication system (AM1).

At this stage if BC was successfully authenticated to validate the supply chain from the product maker to the end user, all contents of the particular batch transfer (BT). that is to say all the generated codes contained in that BT (ACs) will be active, i.e. within a root in the hierarchy of AM1 that is capable of being called and queried to determine a match. In that context, the incoming AC from the product end-user's communication device if genuine will match its duplicate and thereby prompt a positive response from AM I to the product end user's communication device. If AC is counterfeit or had been incorrectly keyed by the end user, then, whether or not the supply chain (BT) has been successfully validated or not, a negative response will be issued by AMi and sent to the end user's communication device.

Full Details of Invention In a multi-nodal set of databases such as the one described above, the mechanisms of input, storage, encryption, processing, and output of multi-segmented, dynamic, alphanumeric codes, are integrated across a single framework of coordination. It is submitted that the structure of this coordination as appertains to the authentication system described above is novel, original and of fundamental integrity to the effect of the invention.

To exhibit said coordination, making occasional reference to the set of diagrams attached, the key elements of which have been introduced in the summary of the invention above,

the following descriptions are in order.

IP, a mediation interface, such as an internet portal or advanced GSM cellular medium, is the means of communication between the product maker or product makers (PM; PM 1, PM2. . . etc), at the top of the supply chain, and the non-supply chain, third party manager, of the authentication databases. Said communication is often in the form of a set of instructions (BT) for authentication codes to be outputted from said product maker(s)' labeling facility connected remotely to IP or to some other network which in turn is connected to IP. Said instructions (BT) will at a minimum specify product types in their respective quantities.

IP being configured in such a way that when it connects to the configuration of interactive databases AM1, as shown in the diagram, and passes said instructions (BT) on, it also identifies the specific product maker whose instructions it is conveying.

AM 1 being configured in such a way that an inventory of all product makers associated with the authentication system is held, and for each product maker a specified alphanumerical ID code having been assigned, which continually self-alter orthogonally to a specified time frame, on a self-prompting basis, AMJ will, on receiving said instructions, first, time-stanip' it, by copying said specified aiphanumerical ID code (AC 1) at a point in time between two successive phases of said aiphanumerical code. It will second. create a directoiy with said alphanumerical ID code acting as the upper-level identifier of said directory.

AMI being further configured in such a way that it holds an inventory of all product types associated with said product maker, and indeed those associated with all product makers associated with the authentication system, each said product type represented as an alphanumeric code, also an orthogonally self-altering quantity, It will now copy, in between two successive phases of alteration, the alphanumeric codes (AC2) of the products listed in the aforesaid instructions (BT) received from IP. and proceed to transfer said codes into the directory marked and identified by the product maker's ID code (ACt), making sure to pass on the record of the quantities specified in the instructions.

At the next stage of the process, AM 1 now successively duplicates each code (AC2) in said directory, and twinning each with said upper level identifier (AC 1) next transfers every duo (ACI, AC2) to AM2, a set of relational databases and random code generators.

Upon receipt of each such duo (AC!, AC2), AM2 creates a directory, and after employing said duo to establish a path to the relevant directory in AM 1, which bears one member of the duo as an upper-level identifier, discards same, before proceeding to populate the newly created directory with a quantity of fully random alphanumeric codes (RC), as specified in the instructions (BT) received from IP through AM1.

AM2 next duplicates each directory together with its contents (RC 1, RC2, RC3. . . .etc.), and transfers each duplicate (RC) to AMI to be assigned by means of aforesaid specified path to the relevant directory in AM1, whereupon each duplicate (RC, RC2, RC3. . ete) is twinned, according to a specified order of arrangement, with the stored duplicate of each product type code (AC21, AC22, AC23.. .etc.) and upper-level identifier (product maker code: ACI). Next, each ensuing combined code (AC = ACI + AC2 + RC) is transmitted to IP wherefrom the product maker issues a command for its outputting via said product maker's labeling facility. When AC (AC1-i-AC2+RC) has been transferred from AMI to IP, AM! promptly discards it, and IP 1 does not store a record. AM2 however retains duplicates of RC, alongside the corresponding information about the specified paths into AM!, and AMi likewise retains duplicates of AC! and AC2, alongside the corresponding information about the specified paths into AM2.

Further, parallel to the process described in detail above, whenever IP communicates the information (BT) received from the product maker concerning product types and quantities, said information, first, conveys instructions, as already seen, necessary for AM! to generate and duplicate specified code segments (AC! & AC2), based on which AM2 generates and duplicates fully random codes (RC). This information is thus carried into AM2. such that AM2 identifies all directories containing fully random codes generated following the transmission from IP (BT) as a single batch corresponding to a specified quantity of a specified product type from a specified product maker, and this specified batch it marks with a batch code (BC). Other specified batches constituted by a specified product type associated with a specified product maker will likewise be marked by other batch codes (BCI, BC2... BCN).

A duplicate of said batch code (BC) is next transferred to AM 1, where, if according to the instructions multiple intermediaries will handle the same batch, an algorithm is tasked to segnient the batch code into a number of sub-batch codes (BC 1, BC2, BC3. . .etc.) corresponding to the number of specified intermediaries. The duplicate of BC received is discarded on completion of this process, and AMI henceforth retains only BCI, BC2, BC3. etc., each of which is, as was the case with AC, duplicated for output through IP at the Product maker's labeling facility.

AC upon output will usually be applied to product items under covert cover and in tamper-resistant mode. BC will similarly be applied under covert cover and in tamper-resistant mode, save that in BC's case the application will be done to the packaging of a specified quantity of product items constituting a batch.

When such a consignment of products leaves the product maker's liability and is consigned to the next actor in the supply chain, say a distributor, wholesaler, cash and carry or retailer, the said consignee will endeavour to authenticate the said batch of product consignments. This undertaking by said consignee will proceed as follows.

The said consignee already being aware of an access key (AK) to the aforementioned interactive authentication system database, AM1, and being knowledgeable of a unique ID identifying said consignee to said database will, in the act of authentication, use said access key AK. which may be an SMS number, to transmit the unique, now unveiled, batch authentication code (BC) to said interactive database.

Upon receipt of said batch code (BC), AMI informs the transmitter, the aforesaid consignee, of receipt, but does not affirm the authenticity or otherwise of the code, and then proceeds to search the relevant directory and finding no segment duplicates transfers BC promptly to AM2, wherein a comparison with a stored duplicate is made and the result, whether of a negative or positive match, is communicated, by a process such as SMS. via AM1 to the communication device of said consignee in clear and unambiguous terms.

A modification of this process occurs when instead of there being a single intermediary (SAlconsignee) between the product maker and product user, instead there are two or more, such knowledge about the number of said consignees having been communicated in the instructions (BT) of the product maker to AM1 through IP prior to the issuing of BC.

Where there are thus more than one consignee, AM2 on generating BC, as described above, will transfer it to AM1 as before, but in this case AM1 will segment said code (BC) by means of a special algorithm into a number of code segments corresponding in number to the number of consignees, obtaining BC1, BC2, BC3 etc. Duplicates of said codes are also, as before, outputted via IP in the product maker's labeling facility.

Under these modified circumstances, when a consignment of products leaves the product maker's liability, destined as it were for the liability of a series of consignees (SAN), the following hierarchy of events will correspond to the hierarchy of the supply chain as it is One level of the supply chain, the one directly below the product maker may, for illustrative purposes, be called the distributor level, corresponding in this meaning to BCI, BC2, BC3, as aforementioned. Each member of this level, that is BCI, BC2, or BC3, will engender a different branch below their level of the supply chain (distributors).

For same illustrative purposes we may call this new subsidiary level: wholesalers. BC], according to these definitions, will therefore have subsidiaries at the wholesaler level corresponding, say, to BC 11, BCI2, and BCI3. In practical ternis, the meaning is that the product maker sells a batch of consignments separately to BCI, BC2, and BC3, whereupon BC! sells its portion of said batch to BCI 1, BCI2, and BC 13. Similarly BC2 and BC3 sell onwards to their own sub-consignees, at the level here named wholesalers'.

The principle is identical at all levels downwards the supply chain in between the product maker and the product end user, until it is terminated at the level of the retailer. Because said principle is identical, a simplified version involving only a limited set of actors is sufficient to illustrate said principle.

Therefore, under these modified circumstances, authentication of the supply line or rather that portion of it between the product maker and product end user will proceed as follows.

When BC 1, BC2 and BC3 are separately in receipt of a consignment from the product maker (PM), BCI, BC2, BC3 will transmit, as in the case of BC. the unique alphanumeric code (BC!) appended to said consignment. This is required as a matter of principle whether onward sale is imminent or not. Where a consignee (BC 1, BC2 or BC3) will for some reason not take charge of a consignment after having agreed to do so, it is incumbent on PM to communicate the relevant information to AM] for said consignee's ID (BC!, BC2, BC3... etc.) to be expunged by AM1. But in the present scenario it is envisaged that BC 1, BC2 and BC3 all transmit, in their separate capacities, their consignment ID (BC!, BC2 or BC3) to AM1 via the relevant access keys (AK!, AK2 &AK3). Said access keys being constituted of an ID known only to the respective consignee and a specified access number to AM!, such as an SMS number. Upon receipt at AM!, the following series of events take place as per these modified circumstances.

AM! upon receiving a batch code (BC], BC2 or BC3), as per above, first communicates confirmation of receipt to the communication devices of respective consignees, then compares said codes to stored duplicates of previously generated batch codes in the relevant directory. If a positive match between said code and a duplicate is established, AM] transfers said code to AM2. AM] follows such procedure until such a time as all duplicates have been matched, or all access keys have relayed a communication. AM2, on the other hand, will on receipt of each such code from AM! try to match said code, say BC!, with the stored duplicate of BC, generated as per above. hf such a match is unsuccessful, AM2 will await receipt of the next code, say BC2, from AMI and upon receipt attempt another match. AM2 will continue to do this until such a match has been established or until AM1 communicates the termination of the series of transfers. If the latter is the case, that is if a successful match was not made but AM1 has indicated the end of the transfer process, AM2 will attempt to recover BC by a recombination of all the received codes (say, BC!, BC2, BC3) by means of above-mentioned special algorithm. If such an attempt is successful, communication is issued via AMI to the communication devices of the respective consignees (BC 1, BC2 and BC3) and via IP to PM that authentication of that supply line level (in this case named distributors) was successful. If the reverse is the case and a recornbination failed, the opposite is communicated to respective consignees and PM.

Upon every successful authentication of a code (BC, BC!, BC!! etc.), said code is removed from current active directory and stored in a non-interactive directory wherefrom no comparisons with inbound codes are possible.

At subsequent levels of the supply line, such as that referred to above as wholesalers, the same procedures and events are applicable. However, as aforementioned, this level will by design be segmented into nodes corresponding to each actor at the superior level (referred to above as distributors), such that the actors at this level are apt to be known as, in the first node, BC1 1, BC22 and BC33; and in the next node as BC2I, BC22 and BC23; and in the final node as BC3I, BC32 and BC33; and furthermore each node will communicate with AMI by means of their respective access keys AKI I, AK 12, AKI3 etc. The importance thus of a multi-nodal configuration of databases emerge in this context for the full practicality of the present invention.

Now, considering the above, it is envisaged clearly that, for instance, when BCI1, BCI2 and BCI3 transmit their respective codes via AK11, AKI2 and AK13, and a successful recombination occurs at AM2, as per above, then even in the case where supply line level distributors was not successful authenticated, the supply line branch constituted of BC! and its nodes: BC!!, BCI2 and BCI3 will conversely be regarded as having been successfully authenticated. The effect thus is such that by means of such nodal arrangements in which a consignee (say BC1) and its sub-consignees (BC! 1, BC 12.. .etc.) are related at AM1 through a connection between one access key (AK1) and its derivations (AKI I, AKI2. ..etc.), it is possible to isolate supply line branches from supply line levels and vice versa, especially in the case where authentication of a supply line level or supply line branch has been unsuccessful, this same providence thus allowing for a triangulation to the part of the overall supply chain which is the source of an inauthentic batch code (BC, BC1, BC1 I.. .etc.). The particular structure of the supply chain, vis a vis the authentication system, is nevertheless, as alluded to above, the strict result of the instructions of the product maker (PM) who determines which actors to involve in the process prior to setup, and who retains the right to alter that arrangement post-setup.

Now, when the product does reach the end user (EU), the said user will in the act of authentication unveil the authentication code (AC) and transmit same to AM! via the access key AK. widely known to the general public.

Upon receipt at AM 1, at first a decoupling of the code according to its preset structure takes place so that AC! and AC2 are identified. If either fails to match any duplicate in the relevant directories, immediately a response indicative of unsuccessful authentication is communicated to the communication device by means of which EU had reached AM! via AK. If AC I successfully matched its duplicate it will point to AC2 in the relevant directory and will thus trigger the relevant path to AM2 by means of which RC enters AM2. Here, at AM2, RC is assigned to a directory supraindicated by BC, thus unless a supply line branch, as described above, had been successfully authenticated, if such had been the instructions of product maker PM, then access to the relevant directory is denied and a response indicating unsuccessful authentication is communicated via AM! to the communication device by means of which the user EU had reached AMI via AK. But if said supply line branch had been successfully authenticated, then RC is matched with stored duplicates and the result whether successful or not is communicated via AM1 to said product end user's communication device indicating whether or not authentication of the product item was successful.

Whenever RC is successfully matched with its duplicate, it is immediately transferred to a non-active directory and cannot be subsequently subjected to further matches at any point in the future.

As those specializing in the field of supply line security management will attest, a number of situations are advantageously served by the present invention according to the illustrations of said invention's effects as demonstrated above.

1. A scenario can be envisaged wherein a counterfeiter or agents acting at the behest or in the interests of said counterfeiter collects unveiled alphanumeric codes (AC) from used products and proceeds to apply these to said counterfeiter's own counterfeit products which are then repackaged and reintroduced into the market. But as demonstrated above such a scheme will falter because said alphanumeric codes are of single-use utility and cannot be authenticated twice.

2. A further scenario can be envisaged where a counterfeiter or agents acting in said counterfeiter's interests obtain by misrepresentation a consignment of genuine products, transfer the codes onto their own counterfeit products and reintroduces repackaged obtained genuine products into another market bereft of the benefits of the present invention. But, here too, as demonstrated above, such a design will be thwarted because where such a risk exists the product maker will insist on the supply line branch being authenticated as a prerequisite to the successful authentication of individual product items, and as such the stolen consignment will, qua batch, be treated as alien to the supply chain, as demonstrated above, and its contents, individual product items, will fail to be authenticated.

3. Yet another scenario is envisaged wherein a counterfeiter or agents acting in said counterfeiter's interests steal or obtain by deception copies of the datafiles stored in AMI s databases and proceeds to copy these onto said counterfeiter's own counterfeit products. But, even where customary encryption protections are successfully overridden, the scheme is certain to encounter hurdles, firstly because AMI holds only a portion of alphanumeric codes; and, second, these self-alter continually.

4. If, on other hand, the envisaged scenario is that the counterfeiter or those acting in said counterfeiter's interests, obtain by theft or deception the datafiles in AM2, still a similar hurdle is certain to be encountered for, even where customary encryption is overridden, AM2 does not hold the full duplicates of relevant alphanumeric codes.

5. With regards to 3 & 4 above, the situation is better clarified if its is understood that AMI & AM2 need not be in the same location to coordinate their roles and may even be located in different geographical settings, such as on different continents, and further that the same human administrators need not be responsible for their day to day operations.

This disclosure, albeit being full according to the rules, does not purport to demonstrate all possible scenarios, or give account of various specific modifications that may differ in some respects from the strict descriptions in the text, but it is submitted that to those skilled In the art such alterations, improvements and modifications will readily appear as being in the spirit of this invention.

Key to the Drawings

Brief Description of the Acronyms in the Drawings

XY -Authentication System Actor/Supply Chain Actor XY Integrated Set of Multi-nodal Databases XY -Aiphanumenc Code XYI -Sub-Actor XY -Process/Route/Access Gateway XY.1 -Sub-Code/Code Segment XYI -Sub-Route/Sub-Access Port -Authentication Signal -Communication/Communication link _______ -Supply Chain Route/Line (2) -Cluster/Group PM -Product Maker BT -Batch Transfer IP -Mediation Interface/Internet Portal AMI -Backend Interactive Database/Batch Details Recorder AM2 -Backend Relational Database/Code & Algorithm Generator BC -Batch Identifier/Supply Chain Authentication Code BC1. ..2.. .3 -Sub-Batch Identifier/Supply Chain Authentication Code Segment AC -Product Authentication Code ACI. . .2.. .3 -Product Maker & Product Type Code/Authentication Code Segment RC -Fully Random Segment of Product Authentication Code AK -SMS Number/Interactive Database Access Key or Port AK 1... 2.. .3 -Password-protected Interactive Database Access Key/SMS Number EU -Product End-User

Claims (11)

1. Claims 1. A product authentication protocol enhanced by a corresponding supply chain security and validation system by means of a unified process of coordination in which single-use, multi-segmented, alphanumeric, codes constitute the front-end of said product and supply line authentication system whereat authenticators interact with the system as a whole, without need for any specialized scanners to read said alphanumeric codes, save for a medium capable of transmitting alphanumeric codes to a set of remote electronic processors; said multi-segmented, alphanumeric, codes being structured in such a manner that different sections are generated under different specified conditions and by different specified algorithms according to different specified timeframes, and can hence also be dc-coupled into their constituent segments, with the purpose of enhancing the representation of product and product maker information within the front-end of said product and supply line authentication system, this forming an integral part of the protection of said authentication system as a whole from manipulation by unauthorized agents.
2. 2. A product and supply line authentication system as generally described above, and defined in claim 1, dependent on a back-end of multi-nodal databases with specified split functions, one set of which mediate between the product maker or product makers and the authentication system manager or administrator; comprising the means of said mediation whereby specified product types and quantities are represented as batches via the mediation interface, such as an internet, intranet, or cellular, medium, recorded as dynamic statistics in an electronic account enabled by the mediation system, and whereby generated multi-segmented, alphanumeric, codes are outputted to remote publishing systems as physical, readable, marks to be applied to individual product items or packaging, batches and sub-batches of products.
3. 3. A product and supply line authentication system as generally described above, and further defined in claims 1 and 2, dependent on a back-end of multi-nodal databases with specified split functions, one set of which algorithmically represents information about a dynamic stream of product types and product makers in the form of alphanumeric code segments that randomly self-alter orthogonally according to specified timeframes on an automatic, self-prompting, basis.
4. 4. A product and supply line authentication system as generally described above, and further defined in claims 1 to 3, dependent on a back-end of multi-nodal databases with specified split functions, as specifically described in claim 3, that receives from a mediation interface information from a product maker or product makers concerning batches of specified product types of specified quantities, as described in claim 2, whereto it assigns alphanumeric code segments as identifiers, and comprising the means wherewith it does this; said alphanumeric code segments being static copies of dynamic, randomly, self-altering alphanumeric code segments, as described in claim 3; said static copies having been achieved by time-stamping an alphanumeric code segment during a period between two alteration phases.
5. 5. A product and supply line authentication system as generally described above, and as defined in claims Ito 4, dependent on a back-end of multi-nodal databases with specified split functions, one set of which receives alphanumeric code segments from another set, the one specified in claim 4, and upon receipt constructs a root directory for the storage of subsequently generated fully random alphanumeric code segments of a specified quantity in accordance with product makers' specifications, as described in claim 4; each such said root directory being thus uniquely assigned to the alphanumeric code segments generated by the adjacent set of multi-nodal databases, the one described in claims 3 and 4.
6. 6. A supply line validation, security and authentication system as generally described above, and reliant on the coordination of systems described in claims I to 5, wherein the totality of fully random alphanumeric codes contained in a root directory identifying a sub-batch constituted by a particular product line, as described in claim 5, are tallied together with the contents of other root directories similarly derived, but constituted separately by other product lines, all within the single batch defined by the information supplied by the product maker, as described in claim 3, and algorithmically melded into a single identifier for the overall batch of product types and quantities, as described in claim 3: said identifier thereupon acting as an authentication code for that particular batch to the benefit of intermediaries between the product maker and the product end user; it still being understood that because such intermediaries may be more than one, said identifier could be segmented into separate sub-identifiers according to an algorithm that can also recover the original code prior to segmentatiom the purpose being to ensure that where intermediaries are more than one the system will treat their separate identifiers as segments of a single identifier.
7. 7. A supply line validation, security and authentication system as generally described above, and further defined in claim 6, additionally capable of receiving via a communication medium, such as internet, intranet, or cellular link, alphanumeric codes transmitted by supply chain intermediaries between the product maker or product makers and the product user or product users; and, within the part of the system defined in claim 3, capable of comparing said alphanumeric codes in turn to duplicates of previously generated and stored alphanumeric codes; and, if a match is found, stores the received alphanumeric codes in the directory wherein their duplicates were found, until such a time as each duplicate in said directory has been successfully matched by inbound alphanumeric codes, whereupon one set of all said duplicates are transferred into an adjacent part of the system, the one specified in claim 5. wherein, except in the case where only one duplicate was transferred, they are melded by a special algorithm and the resultant alphanumeric code compared in turn to duplicates of previously generated alphanumeric codes, as described in claim 6, to verify if a positive match can be made or not, the result being then communicated via the part of the system specified in claim 3 to the communication devices wherefrom the alphanumeric codes originally originated, as well as to the control units of the part of the system specified in claim 5 indicating thereto that the directory of random alphanumeric codes described in claim 2 should be made available thenceforth to comparisons with inbound alphanumeric codes as described in claim 8 below; this process being a means to validate that every member of the supply chain between the product maker and the product end-user are authorised to consign a sub-batch of the product. and, furthermore to ensure that, in the absence of such validation, the authentication of individual product items do not occur.
8. 8. A product authentication system as generally described above, and specified in claims Ito 7, wherein a part of said system, as specified in claim 3, is capable of receiving a transmission of alphanumeric code associated uniquely with a single product item, via a communication medium, such as internet, intranet, or cellular link, from a product end-user at the end of the supply chain; comprising the means for said portion of the system to segment said alphanumeric code into three units of specified length, according to a specified predetermined structural order, and to compare in turn two of the ensuing segments, chosen on a specified basis, each to a set of duplicates of alphanumeric code segments previously generated, as described in claim 3, and in storage in different compartments; a successful match of said inbound alphanumeric code being necessary for a further step to be taken, that of a referral of the third unit of, now segmented, said inbound alphanumeric code to that part of the product authentication system specified in claim 5, and to a specific directory identified by means of one of the aforesaid, positively compared, two segments of the inbound alphanumeric code, wherein a match of this third unit or segment with stored duplicates of previously generated alphanumeric codes, as described in claim 5, is attempted, for the result, whether of a successful match or not, to be communicated to the communication device wherefrom the original alphanumeric code originated in clear and unambiguous terms; with the aforestated process presupposing that where an earlier match of either or both of the first two units of the segmented alphanumeric code with stored duplicates had been unsuccessful the communication to the transmitter of the original alphanumeric code will be issued immediately without need for a referral of the third unit to that part of the authentication system specified by claim 5, and that such a communication, similar to the case where the third unit had failed to find a positive match, will be to indicate in clear and concise terms that the product whereto the alphanumeric code had been associated is inauthentic and alien to the authorized supply chain.
9. 9. An integrated product authentication system and supply chain management mechanism and a unified protocol thereof, described generally above and specified in claims 1 to 8, whereby the successful authentication or otherwise of the full supply chain is linked to, is interrelated with, and is a prerequisite to, the successful authentication or otherwise of a single, individual, product item at the tail end of the supply chain; and whereof by means of multiple, potentially and advantageously password-protected, differentiated, access to the interactive components of said system, responses from such a system regarding product or supply-chain authentication can be differentiated, in terms of detail or nature, based on appropriate rrodifications to aforementioned alphanumerical codes, as specified in claim 8, to the differential benefit of different supply chain actors or non-supply chain actors who are nevertheless stakeholders to said authentication system.
10. 10. A multi-actor, product authentication and supply chain validation and security system as generally described above, and further elaborated in claims 1 to 9, demonstrably optimized for multiple, unrelated product makers, product consignees and distributors and product users, by means of a unified set of processes according to a unified protocol, and thus capable, given adequate coverage of said product makers, consignees, distributors and users within a specified product industry, specified geography, or specified time horizon, of providing integrated datasets of dynamic information for said specified industries, geographies and time horizons, such as may be required where said datasets are only viable in the presence of said dynamic information showing interconnections within and between said industries, geographies and time horizons; it having been demonstrated in detail above that said dynamic information are the result of such supply chain integration as has been demonstrated by the present invention.
11. 11. An integrated product authentication and supply chain validation and security system, whereof the authentication effects are not confined to a restricted direction of flow of the supply chain, and whereof the performance of the authentication process is not predicated upon a necessarily linear, uni-linear, or uni-directional movement or set of movements, but capable of functioning in diverse arrangements of main actors, such that, given a particular object in view, the authentication process, by means of said system, described generally above and specified in claims 1 to 10, is capable of successful execution irrespective of direction of travel of consignments of products between main supply chain actors, and such that, given some specific object in view, consignments may for instance move upwards of the supply chain in the sense of individual product items being aggregated into sub-batches, batches and higher hierarchies of quantities, with said main actors benefiting from the authentication system generally described above and specified in claims I to 10.