RU2814089C2 - Methods and systems for automatic object recognition and authenticity verification - Google Patents

Abstract

FIELD: authenticity.

SUBSTANCE: systems and methods for automatically recognizing and verifying the authenticity of objects. The technical result is achieved by performing the following stages: obtaining object data, which represents the distinctive characteristics of a physical object; processing object data through a machine learning-based object recognition process to produce distinctive data that is collision-resistant virtual representations of the physical object; comparing at least one parameter of the distinctive data and obtained therefrom by applying a predetermined encryption hash function thereto of the original hash value with corresponding reference data stored in one or more restricted data stores; issuing digitally signed identification data including a hash value if comparison with the reference data results in a match.

EFFECT: increasing the accuracy of recognition and establishing the authenticity of an object by taking into account the effects of aging when recognizing objects.

18 cl, 8 dwg

Description

Field of invention

The present invention relates to the field of tracking and anti-counterfeiting of objects such as products such as, for example, pharmaceuticals or other health-related products, and especially to the automatic recognition and authentication of such objects. First of all, the invention is directed to providing a method and system for automatic object recognition, a method for training such a system, a method for verifying the authenticity of an object using an object authentication device in communication with said system, as well as such an object authentication device as such, as well as to create computer programs associated with the specified methods, stored in appropriate storage media. The invention further relates to a system for automatic object authentication, which comprises said system for automatic object recognition and one or more of said object authentication devices, which system for automatic object authentication can primarily be used as protection against counterfeits and product tracking systems.

State of the art

In many industries, counterfeiting of products is a significant problem that significantly affects not only the income of manufacturers of original products, but can also pose a serious threat to the health and also the lives of consumers or operators of counterfeit, that is, counterfeit products. These safety-related product categories primarily include automotive and aircraft parts, structural components of buildings or other infrastructure, food products, and medical devices and pharmaceuticals.

Additionally, across a wide range of different industries, traceability of goods and physical objects is a key requirement. This is particularly applicable to logistics and supply chain infrastructure, as well as highly regulated/structured production process environments. Examples are jobs in industries governed by official regulators such as the FDA and/or certified by, for example, GMP (Good Manufacturing Practices), GLP (Good Laboratory Practices), GCP (Good Manufacturing Practices). clinical practice), or DIN ISO or similar other standards and regulations. Each of these regulated environments primarily requires the use of an audit trail and verifiable technologies. Another example is the traceability of high-value items, such as industrial spare parts, to confirm their authenticity and the intended use of these parts in aftermarket markets.

To limit counterfeiting and ensure the integrity of supply chains and manufacturing processes, including recognizing and verifying the authenticity of products within manufacturing processes and supply chains, numerous different security measures and identification solutions have been developed in various industries. Widely used security measures involve adding a so-called security feature to products, which feature can only be falsified with great difficulty. For example, holograms, optically variable inks, security threads and embedded magnetic particles are known security features that are difficult for counterfeiters to reproduce. While some of these security features are “overt”, meaning they can be easily seen or otherwise recognized by the user of the product, other security features are “covert”, meaning they are hidden and can only be detected by special devices. , such as UV radiation sources, spectrometers, microscopes, magnetic field sensors or even more complex forensic equipment. Examples of secret security features are primarily prints made with luminescent inks, or inks that are visible only in the infrared part of the electromagnetic spectrum, but not in the visible part, as well as special material compositions and magnetic pigments.

A special group of security features that are primarily used in cryptography are known as Physical Unclonable Functions (PUFs). PUFs are sometimes also called "Physically Unclonable Functions" or "Physical Random Functions". A PUF is a physical object that is embodied in a physical structure and is easy to estimate but difficult to predict, also for an attacker with physical access to the PUF. PUFs depend on the uniqueness of their physical microstructure, which typically includes a random component that is already inherently present in the physical object, or that is explicitly introduced into the physical object or created during its manufacture, and which is essentially not controllable and unpredictable. Accordingly, even PUFs produced within the same manufacturing process differ in at least their random components and can thus be distinguished. While in most cases, PUFs are covert features, this is not a limitation, and uncloaked PUFs are also possible. PUFs are also ideal for allowing passive (i.e., without active translation) identification of physical objects.

First of all, PUFs are known in connection with their implementation in integrated electronic circuits through minimal unavoidable changes to the microstructures produced on the chip within specified process-related tolerances and, in particular, as used to derive encryption keys from them, for example, in microcircuits for payment cards with an embedded microprocessor or in other security-related chips. An example of the explanation and application of such chip-related PUFs is disclosed in the article “Reference to Physically Unclonable Functions, PUFs,” Virginia Polytechnic Institute and State University, Department of Electrical and Computer Engineering, 11, which is available on the Internet at the hyperlink http://riindael. ece.vt.edu/Duf/backqround.html.

However, other types of PUFs are also known, such as random distributions of fibers in paper used as a base for banknotes, in which the distribution and orientation of the fibers can be detected by special sensors and can be used as a security feature of the banknote. For the purpose of evaluating PUFs, a so-called challenge-and-confirm authentication scheme is used. "Request" is the physical input signal applied to the PUF, and "acknowledge" is its response to the input signal. The confirmation depends on the uncontrollable and unpredictable nature of the uncontrollable physical microstructure and thus can be used to verify the identity of the PUF, and thereby also the physical object of which the PUF is a part. A specific request and its corresponding confirmation together form a so-called “challenge-response pair” (CRP).

An anti-counterfeiting system based on the use of PUFs to verify the authenticity of products is described in each of two European patent applications EP 165928.1 and EP 1659.8, each of which is incorporated herein by reference in its entirety.

Asymmetric cryptography, sometimes also called "public key cryptography" or "public/private key cryptography", is a well-known technology based encryption system that uses pairs of keys, each key pair containing a public key and a private key. While private keys are kept secret and are usually known only to their owner or holder, public keys can be widely distributed and are usually also publicly available. Asymmetric cryptography provides the ability to: (i) authenticate, which occurs when a public key is used to verify that the holder of the associated private key is the source of specific information, such as a message or stored data containing information, based on the digital signature generated using his private key , and (ii) protecting information, such as a message or stored data, through encryption, with only the owner/holder of the associated private key having the ability to decode a message encrypted by someone else using the public key.

Recently, blockchain technology has been developed, where a blockchain is a public ledger in the form of a distributed database containing many blocks of data, which maintains an ever-growing list of data records, and which is protected from tampering and modification through encryption means. A well-known application of blockchain technology is the virtual currency Bitcoin, used for online monetary transactions. Another well-known blockchain platform is represented, for example, by the Ethereum project. In essence, a blockchain can be described as a decentralized protocol for recording transactions between parties, which transparently captures and stores any modifications in its distributed database, and stores them “forever”, that is, for the life of the blockchain. Storing information in a block chain involves digitally signing the information to be stored in a block of the block chain. Additionally, maintaining a blockchain involves a process called "blockchain mining" in which so-called "miners" who are part of the blockchain infrastructure validate and close each block in such a way that the information contained in it is "permanently " saved and the block can no longer be modified.

Another new ledger technology, known as "Tangle", is a blockless and public distributed ledger architecture that is scalable, low-power, and provides consistency in a decentralized peer-to-peer system. A well-known related technology using Tangle as its technical basis, called “IOTA,” is a trade settlement system and data integrity layer for the Internet of Things.

The essence of the invention

An object of the present invention is to provide an improved method for efficiently recognizing and verifying the authenticity of a physical object, such as a product.

The solution to this problem is provided by the principle in the appended independent claims. Various preferred embodiments of the present invention are provided in the dependent claims.

In addition, the object authentication solution provided herein includes a method and system for recognizing objects, a method for training such a system, and an apparatus for verifying object authenticity, as well as associated methods and storage media with associated computer programs stored therein, as well as various aspects that may constitute parts of a complete multi-component object authentication solution for object authentication to effectively protect physical objects from tampering and tampering.

The first aspect of the object authentication solution provided herein is directed to a method for automatically recognizing objects. The method includes (i) receiving object data representing one or more distinctive characteristics of a physical object or group of physical objects, (ii) processing the object data through a machine learning-based object recognition process to obtain distinctive data representing one or more collision-resistant virtual representations of a physical object or group of physical objects, (iii) comparing at least one parameter of the distinctive data and the original hash value obtained from them by applying a predefined encryption hash function to them with the corresponding reference data stored in one or multiple data stores with limited access, and (iv) issuing a digitally signed identification data including a hash value if comparison with the reference data results in a match, that is, a match with respect to one or more predefined matching criteria.

Optionally, the identification data may contain additional information, such as time or location data or other metadata associated with the object or group of objects being recognized and/or the circumstances of the recognition process.

The matching criteria may primarily be specified such that a "match" ends if the distinguishing data or the original hash value, or both, or a predefined set of 5 of them, is contained in or otherwise represented by the reference data.

The term "physical object" as used herein refers to any kind of physical object, primarily any kind of man-made product, such as, by way of example and without limitation, a pharmaceutical product or other health-related product, or to a natural object, such as, by way of example and without limitation, a plant or an object of natural raw material; or to containers for any of the above or other objects. A physical object as such may contain several parts, for example, a consumable product and its container.

The term "authentication", as used herein, refers to the confirmation of the truth of an attribute of a physical object, primarily its kind and its origin, claimed to be true by the system.

The term “object data” as used herein refers to data that describes or otherwise represents a corresponding object or group of objects, and which includes one or more of its distinguishing characteristics. As used herein, the term “distinguishing characteristics” refers to at least one characteristic property of an object or group of objects that is suitable for distinguishing the object or group of objects from others in at least a substantially collision-resistant or also one-to-one manner.

The term “machine learning-based object recognition process,” as used herein, refers to a process where one or more computers are applied to recognize a physical object or group of physical objects based on input data, such as sensory data (for example, image data or video data captured by one or more cameras serving as sensors) and to identify characteristics of an object or group of objects using one or more machine learning-based algorithms. In the context of the present invention, the previously mentioned “object data” is used as input data. Machine learning is an application of artificial intelligence (AI) that provides systems with the ability to automatically learn and improve from experience without being explicitly programmed. Without limitation, machine learning may include (i) supervised learning, in which a "teacher" presents the computer with typical inputs and their required outputs, and the goal is to learn a general rule that maps the inputs to the outputs, (ii) semi-supervised learning, in which the computer is given only an incomplete training signal: a training set with some (often many) missing target outputs, (iii) active learning, in which the computer is only able to receive training labels for a limited set implementations (depending on the budget), and must also optimize its choice of objects to receive labels, (iv) incentive learning, in which training data (in the form of rewards and punishments) is provided only as feedback to the actions of the program in a dynamic environment , such as moving a vehicle or practicing game actions against an opponent, or (v) unsupervised learning, in which the learning algorithm is not given any labels and must independently find the structure in its input data.

The term "collision-resistant virtual representation" of a physical object or group of physical objects, as used herein, refers to a representation of the data of that object that is defined in such a way that it is difficult, in particular almost impossible in practice, to detect two at least substantially different objects or groups of objects such that their respective data representations are the same, that is, indistinguishable.

The term "encryption hash function", as used herein, refers to a special type of hash function, that is, a mathematical function or algorithm that maps data of an arbitrary size to a fixed-size bit string (hash value) that also designed as a computationally irreversible function, that is, a function that can be easily calculated for any input data, but whose inversion for a given pattern of random input data is difficult. Preferably, the encryption hash function is a so-called collision-resistant hash function, that is, a hash function that is designed in such a way that it is difficult to detect two different data sets d1 and d2 such that hash (d1) = hash ( d2). Well-known examples of such hash functions are the SHA family of hash functions, such as the SHA-3 function, or the BLAKE family of hash functions, such as the BLAKE2 function. First of all, so-called “provably secure encryption hash functions” can be used. These are hash functions that can be mathematically proven to have a certain sufficient level of security. In the solution for verifying the authenticity of an object of the present invention, the security of the encryption hash function can be further improved due to the fact that the analysis of the item or group of items to be examined is carried out at a specific place and time when the physical object or group of objects is actually present at such place and time. This can be used to either increase the absolute level of security achievable, or to enable the use of encryption hash functions operating on smaller data sets, such as shorter data sequences as input and/or output data, while achieving a given required level security.

The term "digital signature", as used herein, refers to the use of a set of one or more digital values that verifies the identity of the sender or creator of digital data, as well as the integrity of that data. To create a digital signature, a hash value is created from the data to be protected by applying a suitable encryption hash function. This hash value is then encrypted using the private key (sometimes also called the "secure key") of an asymmetric encryption system, such as the well-known RSA encryption system, with the private key typically known only to the sender/creator. Typically, a digital signature contains the digital data itself, as well as the hash value obtained from it by the sender/creator. The recipient in this case has the opportunity to apply the same encryption hash function to the received digital data, using the public key corresponding to the specified private key to decode the hash value contained in the digital signature 5 and to compare the decoded hash value from the digital signature with the hash value created by applying an encryption hash function to the received digital data. If both hash values match, this indicates that the digital information has not been altered and thus its integrity is not compromised. In addition, the identity of the sender/creator of the digital data is verified through an asymmetric encryption system, which ensures that public key encryption only works when the encrypted information has been encrypted using a private key that is mathematically paired with the public key. The representation of a digital signature can primarily be done using an RFID transmitter, or a one-dimensional or multi-dimensional barcode such as a QR code or DATAMATRIX code, or simply using a multi-digit number.

The term "restricted data store" refers to a data store, such as a database, in which the data stored therein can only be accessed with prior permission, primarily after verifying the identity of the system or person attempting access. Without limitation, such limited access may be accomplished through password protection, or also through two-factor or multi-factor authentication, such as through multiple independently provided access passwords or other means of identification such as a digital signature.

This object authentication method specifies one of several aspects of a complete object authentication solution. Within a complete solution, this method serves to recognize that a physical object has been identified based on the corresponding object data and by applying a machine learning-based object recognition process to this, and to return a hash code that, according to previously generated and stored reference data correspond to the recognized object and can thus be used to identify it. The object data may be received, for example, from an object authenticator as described below, which may form another component of the object authentication solution 5, and may be used, among other things, to collect sensor-based characteristic information describing the object. The returned hash code can then be used by an object authenticator to verify the identity of the object through a comparison including, on the one hand, the hash code or a derivative thereof, and, on the other hand, corresponding independently obtained information related to the object. such as identity information provided on or in connection with an object or group of objects as such.

In some embodiments, which also relate to other aspects of the present solution, the physical object contains one or more of the following objects for consumption (consumer goods) or use: a pharmaceutical or cosmetic compound or composition; medical device; laboratory equipment; spare part or component of a device or system; pesticide or herbicide; seed; coating, ink, coloring composition, paint, pigments, varnish, impregnation composition, functional additive; raw material for additive manufacturing of products, products of the additive manufacturing process, that is, products created using 3D printing technology. Above all, all these objects have in common the need to prevent counterfeiting in order to prevent breakdowns, health hazards or other hazards.

The second aspect of an object authentication solution focuses on the way the system is trained to automatically recognize objects. The method includes (i) receiving object data representing one or more distinctive characteristics of a physical object or group of physical objects, (ii) processing the object data through a machine learning-based object recognition process to obtain original distinctive data by generating, by performing one or several predefined modifying operations, several collision-resistant virtual representations of a physical object or group of physical objects in such a way that at least two of these virtual representations represent the same physical object or the same group of physical objects, but each with its own (i.e., different from another) condition, wherein said different conditions relate to 5 different age steps in the lifespan of a physical object or group of physical objects representing aging-related effects, and (iii) storage in one or more limited data stores accessing reference data containing the original distinctive data and the original hash value obtained from it by applying a specified encryption hash function to it.

This method of training the system to automatically verify object authentication defines another aspect of a complete object authentication solution. Within the overall verification solution, the method serves to generate and store reference data and thereby prepare the system and thereby enable it to implement the method of the first aspect during the authentication of a physical object or group of physical objects.

The following discussion describes selected embodiments of this method of system training, which may be optionally combined with each other or with other aspects of the verification solution described herein, unless such combination is expressly excluded, inconsistent, or technically impossible.

In some embodiments, storing the reference data includes storing the original signature data in a first of a number of data stores, and storing the identification data in a separate second of a number of data stores such that neither the first nor the second data store simultaneously stores the original signature data and the corresponding original hash value. Such separation allows the original distinctive data and the original hash value to be stored in different spatial locations, such as data centers, thereby enabling, for example, distributed computing and distributed data storage. In addition, access to and management of data stores can thereby be separated, making it possible, for example, to outsource the operation of one of the data stores, and achieve an increased level of information security due to the separation of the original distinctive data and the corresponding original hash value.

As stated above, processing object data to obtain original distinctive data includes generating, by performing one or more predefined modifying operations, multiple collision-resistant virtual representations of a physical object or group of physical objects such that at least two of these virtual representations represent the same physical object or group of physical objects, but each under its own condition. Such different conditions refer to different age stages in the life of a physical object or group of physical objects, but may also refer to different environmental conditions to which a physical object or group of physical objects may be exposed during the discovery of one or more distinctive characteristics, respectively, during subsequent object authentication process. Such environmental conditions for an object may, for example, primarily refer to one or more of lighting, temperature, air pressure, or other environmental parameters in which the object or group of objects may be located during the authentication process. The above-mentioned different age stages for an object can be primarily used to create appropriate virtual representations of an object or group of objects that relate to their different ages and thus can be used to improve the recognition of objects that tend to be susceptible to effects of aging. These embodiments can primarily be used to improve the reliability of object recognition, especially the level of success in object recognition, since aging-related or environmental effects are thereby included in the recognition process. In some related embodiments, at least one of the predefined modifying operations is defined, at least in part, by one or more tensors that are to be applied to a vector representation of the object data or data derived from the object data. This allows for a particularly efficient and well-structured implementation, in which only linear (and thus simple and fast) operations are carried out. In this case, each of the different virtual representations can be used for 5 comparison purposes as discriminative data. For example, in the case of different virtual representations of the same object but at different ages, comparisons can be made across two or more virtual representations, allowing one to examine whether at least one of them results in a match and thus successful recognition of the object based on associated object data.

In some embodiments, storing the reference data includes storing merged data that is formed as a combination of the reference data and an additional incremental value that is set to be independent of the reference data in one or more restricted data stores. First of all, this approach can be used in cases where two or more data stores are used and the corresponding data to be stored therein must be distributed among one or more of them via one or more corresponding communication lines. Adding an incremental value serves to increase the entropy of the data to be reported and thus increase the achievable level of protection against interception, such as, for example, a brute-force attack on the data stream over a communication line or, when the incremental value is also stored in a data store, on a storage data as such.

In some related embodiments, the combined data is generated by: (i) combining the original distinctive data or the original hash value derived therefrom (on the one hand) with an incremental value (on the other hand) in a predefined reversible, i.e. injective, manner to produce the combined value, which represents both quantities, and (ii) including the combined value in the reference data. By way of example and without limitation, in some of these embodiments, the combined data is generated by applying an encryption hash function to the input data containing both the original hash value and an incremental value (optional additional information) to produce the combined value.

In some embodiments, processing of object data includes processing of data representing one or more of the following 5 properties of a physical object or group of physical objects, respectively: (i) a characteristic biometric or physiological property of a living organism or group of living organisms that is at least , part of a physical object or group of physical objects, respectively, (ii) a characteristic electrical, magnetic, or electromagnetic property, such as color or wavelength, (iii) a characteristic acoustic property, (iv) a characteristic geometric property, (v) a characteristic chemical property, (vi) characteristic mechanical or thermodynamic property. These types of properties have the advantage that they can generally be automatically detected by corresponding existing types of sensors without the need for human intervention.

In some embodiments, the method further includes iteratively retraining the system to automatically recognize objects based on additional object data representing distinctive characteristics of a physical object or group of physical objects for which corresponding original reference data has previously been generated and stored in one or more multiple data stores during a previous iterative training step of the system, with additional object data serving as input to the machine learning-based object recognition process. In this way, the system can be effectively trained to improve its ability to recognize a given physical object or group of objects, such as the proportion of correct recognitions (true positives, true negatives). Primarily, this may also involve improving its ability to recognize an object or group of objects under a (wider) range of different conditions to the extent that the corresponding object data of different iterations correspond to different situations or conditions under which the sensor-based measurement of the corresponding object or group of objects in order to generate corresponding object data.

In some embodiments, storing the reference data includes one or more of the following: (i) storing the reference data in a digitally signed form in at least one of the data stores 5, (ii) storing or causing one or more nodes in the blockchain environment for storing the identity in a digitally signed form in a block chain associated with the specified blockchain environment, (iii) storing or causing one or more nodes of a blockless distributed ledger environment, such as, for example, a Tangle ledger environment, to store the identity in the form digitally signed in at least one node of the blockless distributed ledger environment, (iv) storing the identification data in digitally signed form in a public/private key environment storage device. A digital signature serves as a security measure against which the originality of the stored data can be verified. First of all, similar considerations apply when retrieving stored data and communicating it over a communication link, for example, to an entity authenticator as described herein. In addition, the storage device in the public/private key environment adds encryption such that the stored and/or communicated data is thereby further protected from interception.

Specifically, storing identity data on a blockchain or in a blockless distributed ledger, such as a Tangle-based ledger, allows the results of a read to be securely and reliably stored with very high data integrity such that it is essentially impossible to manipulate or erase or other falsification or destruction of such data, for example due to unintentional or intentional deletion or due to data corruption. In this way, the complete memory history remains available. In addition, stored information can be accessed wherever there is access to a blockchain or a blockless distributed ledger, respectively. This makes it possible to securely and distributedly store and access stored identification data, for example, for integrity checks or for authentication purposes, such as checking whether the claimed supplier of an article is the actual creator of the article or not. Based on one or more of these embodiments, the material world to which the objects to be authenticated belong can be connected to the power of blockchain technology. In this way, 5 a high degree of traceability of the origin and supply chain of physical objects such as products can be achieved.

In some embodiments of a method according to the first aspect or the second aspect, the corresponding method may be implemented by a system comprising two or more separate devices that jointly implement the method, and which are connected to each other with the ability to transmit data through one or more tamper-evident channels communications. Ensuring the security of communication channels, first of all, may include data encryption. It goes without saying that other security measures are also possible, for example physical protection (especially against interception or destruction) in the case of physical data lines. In this way, the security of the system and method can be increased, especially against man-in-the-middle attacks.

A third aspect of the present solution is directed to a system for automatic object recognition, the system being configured to implement a method according to one or more of the first and second aspects of the present solution as described herein.

A fourth aspect of the present solution is directed to a storage medium having a computer program stored therein including instructions that, when executed on one or more processors of a system for automatic object recognition according to the third aspect, cause the system to implement a method according to any or both of the first and second aspects of this decision.

Based on this, the explanations provided above regarding these methods can be, mutatis mutandis, applied to the system according to the third aspect as well as to the computer program according to the fourth aspect of the present solution.

A fifth aspect of the present solution is directed to a method for verifying the authenticity of an object using an object authentication device, which method includes: (i) sensor-based detection of one or more distinctive characteristics of a physical object or group of physical objects, (ii) generating object data, representing one or more distinctive characteristics of a physical object or group of physical objects, (iii) communicating object data to the system according to the third aspect of this solution, (iv) receiving digitally signed identification data from the system in response to reporting the object data, (v) reading the marking, provided on or in combination with a physical object or group of physical objects, respectively, to obtain from it digitally signed, optionally also encrypted identity information, (vi) confirmation of the correctness of each digital signature of the identification data and digital signature of the identity information, ( vii) comparing the received identification data with the received identity information to confirm the identity of the object or group of objects based on the result of this comparison, and (viii) providing authentication information indicating whether the physical object or group of physical objects was found to be authentic as a result of this verification.

Specifically, authentication may require the success of both checks, i.e., verification that digital signatures correctly identify the expected/claimed creator, e.g., the correct object recognition system and the creator of the object (e.g., the manufacturer, in the case of products), and a comparison of the accepted identification data with the received identity information results in a match based on one or more predefined match criteria. The term “digital signature verification,” as used herein, refers to the general approach of verifying the originality of a digital signature and primarily involves reading it by applying the associated public key of the intended creator to determine its originality, i.e., the presence of its signature with associated with the creator's secret private key.

First, the entity authentication device may be a mobile device, such as a device specifically designed to perform authentication, or a general purpose device, such as a smartphone or laptop computer, primarily programmed to perform the authentication method, and using one or more of its sensors, such as a camera, microphone or RFID reader, to detect object data. The object authentication device can thus be represented as a device that can be used in a non-permanent manner at different locations, for example, along a product supply chain. It serves, on the one hand, as a device for generating object data relating to an object or group of objects, which are subject to authentication through sensor-based detection of one or more of their distinctive characteristics. In this case, the object data may be communicated to an object recognition system, which may primarily be represented by a central system that maintains multiple object authentication devices, and which processes the object data through a machine learning-based object recognition process to obtain original distinctive data , representing one or more collision-resistant virtual representations of a physical object or group of physical objects.

The object recognition system further compares at least one of the signature data and an original hash value obtained therefrom by applying a predetermined encryption hash function thereto to reference data stored in one or more limited data stores. access. If the comparison with the reference data results in a match, that is, if an object or group of objects is recognized, the system issues, first of all informing the corresponding object authenticator, a digitally signed identification data containing a hash value, that is, an identification data related to the recognized object or a group of objects.

In this case, the object authentication device serves, on the other hand, as a device for actually verifying the authenticity of an object or group of objects, that is, to confirm its originality by comparing the received identification data with the identity information obtained from the object or group of objects as such, for example, by a bar code, radio frequency identification chip or any other suitable marking provided on the object/group of objects or on the container or other material provided with it. First, the marking may comprise, optionally, an encrypted digital signature representation of the identity information, or a pointer representation pointing to a location where said digital signature can be accessed.

If applicable, encrypting the digital signature representation and/or the pointer representation pointing to the location where said digital signature can be accessed adds another layer of security because before the digital signature can be read, the corresponding representations must first be decoded, which requires knowledge of the encryption scheme and knowledge of the correct key to the cipher. The encryption may primarily be based on a known symmetric or asymmetric encryption scheme, for example in accordance with the known AES (symmetric) or RSA (asymmetric) encryption schemes.

The term "pointer indicating a location where a specified digital signature can be accessed" as used herein may primarily mean a pointer to a local or remote database or to a server address or Internet address, such as a hyperlink or the like, by which the digital signature can be accessed, for example, to download it. First of all, the indicator can be implemented using an RFID transmitter, or a single or multidimensional bar code such as a QR code or DATAMATRIX code as its representation

First, in some embodiments, comparison of the received identification data with the identity information is accomplished by comparing two corresponding hash values, i.e., the original hash value represented by

identification data and the corresponding hash value obtained from the marking. If two hash values match, this indicates that the physical object is genuine and the marking has not been tampered with. Otherwise, that is, when they do not match, it indicates that some kind of fraud may have been committed after the creator applied the mark to the physical object.

In some embodiments, in the event that the authentication fails or detects a lack of authenticity, the entity authentication device may issue itself or cause another system to issue an alarm to indicate the failure or lack of authentication, respectively, to, for example, a human user or other device.

Thus, as part of the present solution, an object authenticator may interact with an object recognition system to reliably verify the identity of an object or group of objects. Thus, in contrast to the PUF-based solutions mentioned above, the objects to be authenticated do not have to be primarily marked by the PUF, and the distinctive characteristics of the objects do not have to be predefined and assigned, but instead can be identified and subject to continuous improvement through the machine learning-based recognition process used by the object recognition system.

The following discussion describes other selected embodiments of the object authentication method, which may be optionally combined with each other or with other aspects of the present solution described herein, unless such combination is expressly excluded, inconsistent, or technically impossible.

In some embodiments, sensor-based detection of one or more distinctive characteristics of a physical object or group of physical objects includes detecting at least one distinctive characteristic that is at least substantially invariant under changes in the environmental conditions in which the sensor is detected. at least one distinctive characteristic. This may be the case, for example, when distinctive characteristics are provided through an object-specific characteristic signal emitted by an RFID tag attached to the object. In addition, the special properties of an object's material may, in some circumstances, exhibit such 5 invariance. In this way, the reliability of the complete object authentication process can be guaranteed.

In some embodiments, the method further includes: including the original hash value or other entity-specific information contained in the identity in the output authentication information. This can serve several purposes. Primarily, this may be used to inform the user of the object authentication device regarding the original hash value or other object-specific information, respectively, if the authentication information is provided to a human-machine interface such as a display. In addition, the output data can serve to similarly inform another automated process, for example via a corresponding machine-to-machine interface.

Moreover, in some related embodiments, the method further includes a storage process, wherein the storage process includes digitally signing and storing or causing another device, such as a separate and optionally also remotely located computer, configured to perform ( i) mining the blockchain or (ii) entries in a blockless distributed ledger node, respectively, to storing the original hash value or other object-specific information or both in digitally signed form in (i) a block of the first blockchain or in (ii) ) node of the first blockless distributed registry, respectively. This allows data to be stored securely and reliably with very high integrity in such a way that it is essentially impossible to manipulate or erase or otherwise tamper with or lose such data, for example due to inadvertent or intentional deletion or due to data corruption. This ensures that the complete authentication history remains available. Additionally, stored information can be accessed wherever the blockchain is accessible. This makes it possible to securely and distributedly store and access stored identification data, for example for authentication purposes, such as checking whether the claimed supplier of the item 5 is the actual creator of the item or not. Based on this embodiment, the material world to which objects belong can be connected to the power of blockchain technology. In this way, a high degree of traceability of the origin and supply chain of physical objects such as products can be achieved.

In some related embodiments, the storage process further includes: (i) reading a mark provided on or in connection with a physical object or group of objects to be authenticated, or detecting one or more selected properties of the object or group of objects to obtain additional information relating thereto, and (ii) digitally signing and storing or causing another device to store that additional information in digitally signed form in a block of a second blockchain that is separate from the first blockchain or in a node of a second blockless distributed ledger that is separate from the first blockless distributed ledger. For example, the additional information may be supply chain related information and may primarily comprise one or more of the following: (i) location information related to the location at which the additional information was obtained by the entity authenticator, (ii) Object Authenticator device user authentication information, (iii) time and/or date information indicating the point in time at which additional information was obtained by the Object Authenticator device, (iv) product identifier, registration number, and /or the serial number of the item marked with the marking, (v) the date of manufacture or expiration date of the item marked with the marking, (vi) information that identifies the place of production of the product, etc.

These embodiments provide the ability to further store and thus save additional information in a corresponding second blockchain, and thereby also provide the additional information benefits discussed in connection with the immediately preceding embodiment. Using 5 different blockchains or blockless distributed ledgers for the original hash value or other object-specific information on the one hand, and for additional information on the other hand, furthermore provides the advantage of easily supporting the combination of existing (second) blockchain or blockless distributed ledger, respectively, to obtain additional information with additional first blockchain or blockless distributed ledger, respectively, for the original hash value or other object-specific information.

Accordingly, different access rights can be easily provided, and the blockchain can be managed by different authorities. First of all, these embodiments can be used to confirm the conformity of the supplier of the product and its actual creator, as well as the conformity of the supply chain as expected. Additionally, it can be used to both (i) examine a mark/object for the presence or absence of tampering or tampering, and (ii) read from the mark and provide additional information such as supply chain or other logistics information. Additionally, however, a combination of both uses (i) and (ii) may be applicable to further improve the security aspects of the present entity authentication solution, since additional information such as supply chain information can be used for reverse identification the locations or persons involved in the supply chain, and possibly the dates or time periods associated with them, in the event that potential fraud may occur. Based on this, the object authentication device configured to implement the method according to these embodiments is a dual-use device or also a universal device, which increases ease of use and reduces the number of different devices required to read a complete complex security marking.

In some related embodiments, the saving process further includes, in the case of a blockchain: (i) contained within a block of the first blockchain, an inter-blockchain pointer that constructs a logical mapping between a block of the first blockchain and a corresponding block of the second blockchain when storing the original hash value and/or other entity-specific information in a block of the first blockchain, and (ii) contained in the block of the second blockchain, an inter-blockchain pointer that builds a logical correspondence between the block of the second blockchain and the corresponding block of the first blockchain while storing additional information in block of the second blockchain.

Likewise, the saving process further includes, in the case of a blockless distributed ledger: (i) an inter-ledger pointer contained in a node of the first blockless distributed ledger, which builds a logical mapping between the node of the first blockless distributed ledger and the corresponding node of the second blockless distributed ledger when saving at least one of the hash values in the node of the first blockless distributed ledger, and (ii) contained in the node of the second blockless distributed ledger, an inter-ledger pointer that builds a logical correspondence between the node of the second blockless distributed ledger and the corresponding node of the first blockless distributed ledger while maintaining at least one of the hash values in a node of the second blockless distributed ledger.

Thus, these two blockchains or two blockless distributed ledgers, respectively, can be linked through inter-blockchain pointers or inter-ledger pointers, respectively, which can be used to further increase the achievable level of security of the present object authentication solution. Primarily, it can be used to track attempts to tamper with or tamper with tagged items at various points along the supply chain. For example, this embodiment provides the ability to track the location and/or timing of such an attempt or, in the case of mandatory authentication to an entity authenticator, the identification of a user or system associated with such an attempt.

In some embodiments, the authentication information may be produced at least in part in the form of a one-dimensional or multi-dimensional bar code, such as a DATAMATRIX code or a QR code. This makes it possible to use readily available bar code scanners for subsequent processing of the issued authentication information, which may be particularly advantageous in the case where the object authentication device is integrated into or interacts with an automated production line or other processing line , in the case where its output data must be further processed through algorithms processed by the line, but not by the human user.

In some embodiments, the method further includes, if the authentication information does not identify a physical object or group of physical objects as being authentic, repeating the method for authenticating the object until one of two events occurs: (i) successful authentication or (ii) ) fulfillment of the specified completion criterion. For example, the termination criterion may be specified in terms of the number of failed authentication attempts.

In some embodiments, the method further includes performing authentication on the user, and granting or denying permission to the user to perform entity authentication by the entity authenticator based on the user's authentication result. This can be advantageously used to further enhance the security of the solution by preventing unauthorized users from successfully interacting with the entity authenticator and thus being included in the security chain provided by the solution. In addition, it can be used to obtain user identification information or other relevant user information, which can be used to increase transparency of the flow of physical objects, most notably those to be authenticated along the product supply chain. In the event of security concerns, this information can be used to provide complete solution tracking of potential security threats, and to identify locations or individuals that may be associated with such threats.

In some embodiments, the method further includes communicating over the communication link to the opposing party the authentication and/or identification verification information 5, in whole or in part, and/or additional information derived therefrom. First, the message may be adapted to send and receive data over a wireline, radio link, or optical link, such as, by way of example and without limitation, a wireless LAN, Bluetooth, cellular, or classic telephone line. Such a communication link may be used for a variety of different purposes, including sending received information, such as issued authentication information, to an opposing party, which may be represented, for example, by a central security authority, such as a security operations center, which includes a central a security server that may form a component of the present authentication solution.

In some related embodiments, the method further includes capturing and sending security-related information to an opposing party over a communication link. The opposite party could, for example, be the security control center mentioned above. First of all, such sending of security-related information may occur randomly or may be specifically triggered according to a predetermined trigger pattern or remotely, for example, by an opposing party. This makes it possible to remotely monitor the security status of the object authenticator itself and/or security-related events in which the object authenticator is involved. Such a security-related event could, for example, be the detection of a mark/object that has been tampered with or tampered with according to authentication information or other security-related information provided by the object authenticator.

First, according to related embodiments, the security-related information comprises one or more of the following: (i) location information characterizing the current or past location of the entity authentication device, (ii) user data characterizing or identifying the user 5 of the entity authentication device entity, (iii) network data characterizing the communication link, (iv) information characterizing the attempt or actual action detected by at least one sensor of the entity authenticator device, or the corresponding response of the entity authenticator device (e.g., as described above), ( v) authentication information generated by the entity authenticator.

In some related embodiments, the method further includes detecting a security event in information contained in a signal received from an opposite party over a communication link. Primarily, this can be used to cause the entity authenticator to enter a secure mode or also to disable it in the event that an authorized counterparty, such as a security hub, transmits information containing such a security event to the entity authenticator in order to prevent any negative impact that the entity authentication device might otherwise have on the authentication system as a whole. Such a negative impact may be recognized, for example, when some threatening activity such as unauthorized intrusion or modification of firmware/software in the object authentication device or use by an unauthorized person or in an unauthorized location occurs and is reported to the opposite party or otherwise discovered by it.

In some related embodiments, the method further includes sensor-based detection of one or more of the following security events: (i) an attempted or actual act of physical intrusion into an entity authentication device, (ii) an attempted or actual act of local or remotely gaining access to the internal control functions of an object authenticator device, such access not being authorized by the user of the object authenticator device during the normal course of its operation. Specifically, such an access attempt may be aimed at seizing control of the functions of the entity authenticator 5 or modifying them. As a result, this embodiment can preferably be used to further enhance the security level of the present entity authentication solution, and primarily to protect against unauthorized intrusion and tampering with both the entity authentication device itself and the complete entity presented herein. solution.

In some related embodiments, the method further includes performing one or more of the following security measures in response to detection of a security event: (i) disabling the object authentication device, such as limiting or preventing its further use, (ii) self-destructing at least one functional part of the object authentication device or destroying the data stored therein in order to prevent its further use or access by the user, (iii) issuing an error message. First of all, security measures can be considered as special measures to put the object authentication device into a secure mode or to disable it, as described above.

The sixth aspect of the present solution is directed to an object authentication device configured to implement the method according to the fifth aspect.

In some embodiments, the object authentication device is incorporated into or otherwise forms a component of one or more of the following devices: a hand-held device, such as a product or bar code scanning device; equipment for production, quality control or commissioning; line for production or quality control or commissioning; a flying object, such as a drone; a robot, such as an agricultural robot; agricultural machine. This ensures the integration of the functionality of the object authentication device into a system having additional or broader functionality, primarily in an automated or semi-automatic manner. For example, in the case of a production or quality control or commissioning line, an object authentication device can be integrated into the line in such a way that it automatically reads 5 markings, especially complex security markings, on products moved along the line in order to perform an initial capture relevant data. This captured data can then be stored in an appropriate database or compared with data already stored to confirm that the production or commissioning line, respectively, is producing or accepting the intended set of products. Similarly, at one or more nodes in the supply chain, such as logistics centers, such object authentication devices can be quickly integrated into identification and transportation systems, such as conveyors, for the purpose of automatic or semi-automatic (for example, in the case of a manual device) verification and confirmation authenticity of products based on their labeling, before they are sent to the next node in the logistics chain. The same applies to the final node, that is, the recipient and/or end user of the products.

According to another preferred embodiment, the object authenticator is a portable electronic communication terminal device. Without limitation, the object authentication device may be, for example, a smartphone or a laptop computer, such as a tablet computer. In this case, the communication link with the object recognition system can be established using communication capabilities that are somehow present in the electronic communication terminal device, for example, for cellular communications.

A seventh aspect of the present solution is directed to a storage medium having a computer program stored therein including instructions that, when executed on one or more processors of an entity authenticator apparatus according to the sixth aspect, cause the entity authenticator apparatus to implement a method according to the fifth aspect.

As stated above, the computer programs according to the fourth and/or seventh aspects are implemented in a storage medium in which one or more programs for implementing the method are stored. It may be advantageous when a computer program product is intended to be sold as a separate product, independent of the processor platform on which one or more programs are to be executed. In another embodiment, the computer program product is provided as a file on a computing device, primarily a server, which may be downloaded over a data connection, such as the Internet, or a dedicated data connection, such as a proprietary or local network.

Based on this, the above explanations regarding the method according to the fifth aspect can be, mutatis mutandis, applied to the object authentication device according to the sixth aspect as well as to the computer program according to the seventh aspect of the present solution.

The eighth aspect of the present solution is directed to a system for automatically verifying the authenticity of an object, including:

- a first device configured to: receive object data representing one or more distinctive characteristics of a physical object or group of physical objects; processing the object data through a machine learning-based object recognition process to obtain distinctive data representing one or more collision-resistant virtual representations of a physical object or group of physical objects; comparing at least one of the signature data and an original hash value obtained therefrom by applying a predetermined encryption hash function thereto with corresponding reference data stored in one or more restricted data stores; and issuing digitally signed identification data including the hash value if comparison with the reference data results in a match; And

- a second device configured to: based on the use of sensors, detect one or more distinctive characteristics of a physical object or group of physical objects;

generating object data representing one or more distinctive characteristics of a physical object or group of physical objects; reporting the object data to the first device; receiving digitally signed identification data from the first device in response to the object data message; reading markings provided on or in combination with a physical object or group of physical objects, respectively, to obtain digitally signed identity information therefrom; confirming the correctness of each digital signature of identification data and digital signature of identity information; comparing the received identification data with the received identity information to confirm the authenticity of an object or group of objects based on the result of this comparison; and providing authentication information indicating whether a physical object or group of physical objects has been found to be authentic by that verification.

Brief description of drawings

Other advantages, features and applications of this object authentication solution are provided in the following detailed description and accompanying drawings, in which:

Fig. 1 schematically shows an overview of a preferred embodiment of the present entity authentication solution including a system for automatically verifying entity authentication,

Fig. 2 schematically shows the teaching method shown in FIG. 1 systems according to a preferred embodiment of the present solution for object authentication and its application to physical objects such as consumer goods, pharmaceutical tablet kits housed in blister packs and associated blister pack containers,

Fig. 3A schematically shows a method for automatically recognizing objects and verifying their authenticity using the device shown in FIG. 1 of a system according to a preferred embodiment of the present solution for verifying the authenticity of an object in the case where the object under examination has been successfully recognized,

Fig. 3B schematically shows the same as in Fig. 3 A method for automatically verifying the authenticity of an object, but in the case when the object under study was not successfully recognized,

Fig. 4A and 4B are flowcharts illustrating a method for automatically verifying object authentication using the object authentication device 5 according to a preferred embodiment of the present object authentication solution.

FIG. 5 shows a schematic overview of a preferred embodiment of the present entity authentication solution including a public key infrastructure environment, and

Fig. 6 schematically shows the development of a complex of two cross-linked blockchains along the supply chain for a security-marked item in accordance with preferred embodiments of the present item authentication solution.

In the drawings, identical reference numerals are used for the same or mutually corresponding elements of the solution described herein.

Detailed description

Fig. 1 shows system aspects of a complete object authentication solution 1 according to a preferred embodiment of the present invention. Aspects of Solution Method 1 are described below with reference to other drawings. Solution 1 comprises a system 2 for automatic entity authentication, which in turn comprises one or more entity authentication devices 4 (only one of which is shown), each of which may be primarily represented by a mobile device, such as a mobile an object authentication device or also a mobile computer, for example a tablet computer or a smartphone, having at least one sensor for capturing or measuring properties of the physical object A or group of physical objects to be authenticated. Each of the object authentication devices 4 includes a sensor node 4a, a computing node 4b and a memory 4c. The memory 4c stores a computer program configured to be executed on the computing node 4b for the purpose of controlling the corresponding object authentication device 4 including the sensor node 4a, and primarily for causing the corresponding object authentication device 4 to implement an object authentication method, for example, as described below with reference to FIGS. 4A/4B and 5A/5B. The object authentication device 4 may further include a security device 4d including one or more sensors for detecting a security event 5, such as an attempted or actual act of physical intrusion into the object authentication device 4, or an attempt or actual act local or remote access without permission to the internal control functions of the object authentication device 4. Preferably, the security device 4d cooperates with or also includes a security protection device 4e to protect the object authentication device 4 in the event of detection of a security event. First of all, the safety protection device 4e can be adapted to perform a step similar to step S5 in FIG. 4A, which is described in more detail below. For example, the security protection device 4e may be configured to block the user interface of the object authentication device 4 if a security event is detected, or to cause the security chip contained in the object authentication device 4 to self-destruct in order to protect data stored therein, including, for example, private cipher key or other security-sensitive data such as authentication information. In addition to or instead of the security device 4d, the object authentication device 4 may include a control device 4f that is configured to detect a security event indicated in information contained in a signal received from the opposite party over a communication link. For example, in the event that such an opposing party, such as a security control center, becomes aware of a large-scale attempt to attack the security and integrity of site authentication devices 4 located in the field, for example, along a given supply chain, such a signal can be used to proactively initiate a block. (at least temporarily) continued use of site authentication devices 4 in the field to prevent interference with site authentication devices 4 as a result of such attacks.

In addition, the object authentication system 2 includes an object recognition system 3, which can primarily be implemented as a central server-level system operating 5 in conjunction with one or more object authentication devices 4. In addition, the system 3 may serve as the counterparty or security control center mentioned above in connection with the security aspects of the entity authentication device 4.

The object recognition system 3 includes a recognition subsystem 3a, which in turn includes a data analysis module 5, which is configured to analyze object data provided by one or more of the object authentication devices 4 using one or more machine learning-based algorithms (for example, one or more neural networks), and which may primarily include algorithms for pattern recognition, etc. To this end, the data analysis module 5 includes a computing node 5a with one or more CPUs and a memory 5b. Memory 5b stores one or more computer programs configured to run on compute node 5a (or alternatively, a distributed processing platform (not shown)) and to implement one or more algorithms. The recognition subsystem 3a further includes a data processing module 6 configured to further process the data output by the data analysis module 5, as described in more detail below. For this purpose, the data processing module 6 includes a computing node 6a with one or more CPUs and a memory 6b. The memory 6b stores one or more computer programs configured to run on the data processing unit 6 and to carry out the data processing. The data analysis module 5 and the data processing module 6 together form the data processing platform 3b of the recognition subsystem 3a. In fact, in some embodiments, the data analysis module 5 and the data processing module 6 may be implemented together as a single module forming a data processing platform 3b, which may, first and foremost, and without limitation, comprise only a single computing node and a single memory.

The recognition subsystem 3a further includes a first data store 7, which in particular can be implemented as a database. As will be explained in more detail below, the first data store 7 is configured to store and provide reference data obtained as a result of data processing performed by the data processing unit 6 based on the analysis results output by the data analysis unit 5 during training of the object recognition system 3.

In addition, the object recognition system 3 includes a second data store 8, which is implemented separately from the recognition subsystem 3a. The second data store 8 is configured to store and provide a subset of reference data resulting from data processing performed by the data processing unit 6, as will be explained in detail below. External to the automatic entity authentication system 2, the entity authentication solution 1 may comprise an external data registry 9, which may primarily be implemented through a blockchain environment, a blockless distributed ledger environment, or a public key infrastructure environment, or a combination of one. or more of the above environments. Each of the above components 4-9 is connected to each other as shown in FIG. 1, through a set of secure communication channels L1-L6. For each of the communication channels L1-L5, its implementation in the form of a wired line, a wireless or optical channel type, or any other suitable type of data transmission channel can be individually selected. Ensuring the security of communication channels may include, first of all, data encryption. It goes without saying that, in addition, other security measures are also possible, for example physical protection (primarily against interception or destruction) in the case of physical data lines. thirty

Fig. 2 schematically shows the teaching method shown in FIG. 1 of the system 3 according to the preferred object authentication solution 1. During training preparation, the object authentication device 4, which in this case is typically the central object authentication device 4-1 provided at the location of the system 3, uses its sensor node 4a to capture, primarily measure, the properties of a known physical object A, as well as to produce the corresponding results in the form of object OD data. First of all, object A can be represented by a product that is subject to subsequent delivery, and which is thus used in training to enable the system 3 to verify its authenticity at the end of training. Training is typically carried out as part of the production or post-production process of the relevant product A before it is delivered into the supply chain.

Training can either be directed at a special single instance of object A or, alternatively, only at its item type such that different instances of the same item type produce the same learning results and thus these learning results can be used to subsequently verify the authenticity of any instance of products of this type of product, and not just a special individual product A. As shown in FIG. 2 non-limiting examples, item A is a multi-component item containing multiple consumer goods A1 in the form of a set of pharmaceutical tablets housed in multiple blister packs, as well as corresponding product packaging A2 for blister packs A1.

During the learning process, the data analysis module 5 receives the object OD data as input, and uses one or more machine learning-based algorithms to analyze the object data to obtain, based on the received object OD data, distinctive data representing one or more collision-resistant data. virtual representations of physical object A. This resulting signature data is referred to in the following discussion as "original" ODD signature data to distinguish it from similar DD signature data generated during a later authentication process. The original ODD distinctive data is then sent to the data processing module 6, where it is processed to obtain reference data that can be used in the subsequent object recognition/authentication process as a reference.

The processing may primarily include generating, by performing one or more predetermined modifying operations, multiple collision-resistant virtual representations of the physical object A such that at least two of the virtual representations represent the same physical object A, but 5 each on its own terms. The corresponding different conditions may primarily be attributed to different age stages in the life of object A or to different environmental conditions to which the object may be subjected in the future, such as different lighting, temperature or pressure conditions. This makes it possible to create reference data that provides a good basis of comparison for distinguishing data obtained from a captured object during a later object recognition process, also in the case where age characteristics or environmental conditions differ significantly from those during training.

The generated reference data is then grouped into a first subset RD1 and a different second subset of reference data RD2, each of which is digitally signed and stored in two different data stores. First of all, the first subset RD1 is defined such that it includes the output data CD (ID, AV1) of a data combining function CD(), which is configured to receive the identification data ID and the predetermined first incremental value AV1 as input data, and to perform a data combination operation, such as chaining, mixing and rearranging, or other mathematical combination in a specified reversible manner to generate output data. The ID data comprises at least an OH hash value derived from the original ODD signature data or a portion thereof by applying a predefined encryption hash function, and optionally MD metadata containing additional product or training related information. First, the MD metadata may contain information indicating the time or location of the training, the identification of the user operating the object authentication device 4 or the hardware identifier of the device 4, a registration number and/or date or place of manufacture, or one or more preferred invariants properties of object A. The incremental value AV1, on the other hand, can be represented by an arbitrary known value, or also a random value that is added as additional input to the combination function CD() in order to increase the entropy of the resulting first subset RD1 and thus , to enhance the level of security that can be achieved by encrypting or digitally signing RD1. In addition, the first subset of RD1 may be stored in an external registry 9, primarily for the purpose of creating redundancy and reducing the risk of data loss, as well as increasing the availability of RD1 data. Likewise, a second subset of reference data RD2 is generated by the data processing unit 6, wherein RD2 primarily contains information obtained by applying the same or different combination function CD() to the original ODD signature data, or parts thereof, and also contains the second increment is AV2, the latter serving the same purpose as AV1 relative to RD1.

First of all, the training process can be specified as iterative, in which case the data analysis module 5, when processing the object OD data, receives the previous second subset of reference data PRD2, which was generated during the previous training iteration, and refers to the same object A as subsequent inputs. Following the learning process or also as part thereof, a first subset of reference data RD1, which includes the identity identifier, is sent to the object authentication device 4-1 and/or used to create a mark M, (primarily, respectively, MA for item A), such as a one-dimensional or multi-dimensional bar code, (for example, a QR code or two-dimensional matrix bar code) or radio frequency identification tag that is attached or otherwise attached to or combined with the item A. The M, MA marking includes the RD1 data encoding. The thus marked item A is then ready for delivery into the supply chain, and the system 3 is trained to recognize it again at a later time based on the object OD data captured from the item at a later point in time, and possibly at a different location.

Fig. 3A and 3B schematically show a method for automatic object recognition and authentication using the system shown in FIG. 1 according to a preferred embodiment of the present authentication solution. Fig. 3A refers to the case where the investigated object A was successfully recognized, while FIG. 3B 5 refers to the case where the examined object B was not successfully recognized.

According to FIG. 3A, the object authentication device 4 is again used to capture/measure characteristic information related to a physical object A, such as an article to be examined, and to generate corresponding object OD data. However, now, the object authentication device 4 is typically represented by the object authentication device 4-2, which is specifically intended for use in the field rather than at the factory level, for example at a supply chain node, or during customs control, or where- or where else it is desirable to track and/or verify the authenticity of the product in order to detect counterfeiting. Accordingly, the object authentication device 4-2 is generally different from the object authentication device 4-1 used during the training process described above with reference to FIGS. 2, which process is usually carried out at the factory level.

In this case, the object data is transmitted as shown in FIG. 1 channel L1 data transmission to system 3 for automatic object recognition. Similarly, as described above for the learning process, the data analysis module 5 generates DD distinctive data and forwards it to the data processing module 6. The data processing unit 6 accesses the first data store 7 to retrieve the reference data RD2 stored there during the learning process and compares it with the distinctive data DD received from the data analysis unit 5. This comparison can be primarily made on the basis of (i) the original OH hash codes contained in the RD2 reference data, typically across different object datasets, each for one of a typically large number of different objects for which previously training has been performed, and (ii) the corresponding hash code obtained from the distinctive DD data. If the comparison results in a match according to some predefined match criteria for one of the data set object-related items contained in the reference data RD2, the match criteria of which, in a simple case, may require mathematical equality of the two hash codes being compared, the data processing module 6 sends the corresponding object index value IN to the corresponding data set for which 5 matches were found.

In this case, the second data store 8 retrieves and sends to the object authentication device 4-2 a subset of reference data RD1 corresponding to the object according to the index IN. As mentioned above, the digitally signed data RD1 contains identification data related to the object A. The process as described so far can be called an object recognition process because it ultimately returns as a result the identity of the recognized object A.

This process can, however, be extended to transform it into an entity authentication process, as described in detail below with reference to FIG. 4A and 4B. As a result of the object authentication process, the authentication data AD is issued by the object authentication device 4-2, and in the storage step, the digitally signed data RD1 received from the second data store 8, or at least the selected identification information ID contained in RD1, is stored there are 9 data in the external registry, for example the first blockchain. Optionally, additional SI information may also be stored in the same or another data registry 9, for example, a second blockchain, as described below in more detail. The additional information SI may primarily include information regarding one or more of the following aspects: the time and/or location of the object authentication check performed by the object authentication device 4-2, the identification information of the user operating the device 4-2 object authentication, the hardware identifier of this device 4-2, the registration number and/or date or place of manufacture, one or more preferred invariant properties of the object A, and the identity of the successfully authenticated object A, which identity is derived from the identification data contained in the RD1 ID data or produced on the basis thereof.

Fig. 3B refers to the case where, unlike shown in FIG. 3A, the examined object B was not successfully recognized. This may, for example, be the case when no prior learning has been performed on entity B, or due to problems such as detection errors or data loss, or also due to errors occurring during the authentication process. While the first part of the process may be similar to that in FIG. 3A, when an authentication failure is detected, for example, by the data processing unit 6, an error signal ERR is sent to the second data store 8 instead of the index IN, and a corresponding message is sent to the object authentication device 4-2 to inform it of the authentication failure. ERM error. The entity authenticator 4-2 may then either repeat the process or output AD authentication data indicating a failed authentication attempt. In addition, the ERM error message or other equivalent information may be stored in an external data register, optionally again along with corresponding additional information SI, as described above with reference to FIGS. 3A.

Fig. 4A and 4B together show a flow diagram (divided into two parts connected via connector "C") illustrating a preferred embodiment of a method for automatically verifying object authentication using an object authentication device 4 (such as, for example, the device 4-2 discussed above, which is referred to in the following description of the method) according to a preferred embodiment of the present invention. The method optionally comprises a first phase including steps S1 to S7, which serve to enhance the security of the object authenticator performing the method as such.

Step S1 is an access control step in which output data from sensors within the entity authentication device is evaluated to detect a security event, such as an attempted or actual act of physical intrusion into the entity authenticator, or an attempted or actual act of obtaining local or remote access to internal control functions in a processing device or in a communication device as part of an object authentication device. If it is determined in the next step S2 that a security event (S2; yes) was detected in step S1, the method performs the security protection step S5 as a final step, wherein an error message indicating the security event is output to the user interface and/or transmitted over communication link to the opposite party, such as a predefined security control center, which, first of all, may be identical to that shown in FIG. 1 system 3 for automatic object recognition or may form part of it. First of all, this may be implemented as part of the data analysis module 5 or data processing module 6, or as a separate security control center module (not shown), for example a security server within the system 3. In addition, the entity authentication device may be blocked and/or the object authentication device, or at least the data stored therein, may self-destruct to prevent unauthorized access to the data or any functions of the object authentication device. Otherwise (S2; no), the method proceeds to information monitoring step S3.

In the information control step S3, a signal is received over a communication link (for example, communication link L1 or L6 in FIG. 1) from a central entity authentication solution node, such as a security control center, that provides a security server (for example, within system 3) , and evaluate it to determine whether the information contained in the signal indicates a safety event. If it is determined in the next step S4 that the information in step S3 indicated a security event (S4; yes), the method proceeds, as a final step, to the security protection step S5 and executes it. Otherwise (S4; no), the method proceeds to authentication step 6.

In step S6, the authentication tests subject the user of the object authentication device to identification, for example, through a suitable user interface such as a password keyboard or a fingerprint sensor, etc. If it is determined in the next step S7 that the authentication in step S6 has failed (S7; no), the method returns to step S7 or, alternatively (not shown), to the authentication step S6. Otherwise (S7; yes), the method proceeds to the second phase, in which the object A (or B) to be examined is subjected to inspection by sensors to generate object OD data and output it to system 3.

Accordingly, this second phase comprises an object detection step S8, 5 wherein one or more distinctive characteristics of the object under investigation (or group of objects, as the case may be) is detected by the sensor node 4c of the object authentication device 4-2, and corresponding object OD data is generated, representing these characteristics.

In the subsequent communication step S9, the generated object OD data is communicated via data link L1 to the object recognition system 3 to enable it to carry out the object recognition method described above with reference to FIG. 3A/3B. Step S9 further includes receiving, via communication link L6, from the system 3, in response to the message OD, digitally signed identification data included in the subset of reference data RD1 obtained by implementing the object recognition method.

The method further includes a signature reading and verification step S, in which the mark M (primarily the mark MA for the object A) which is placed on the object to be authenticated is read. The mark M may either itself contain digitally signed identity information relating to the object A, or alternatively may contain a pointer to a data source, such as a server on the Internet, where such information can be accessed. Step S further includes validating each of the digital signatures of the received identification data as well as the identity information read from the mark M to confirm the originality of the corresponding digitally signed data.

If the signature verification in step S fails (S is yes), the method proceeds to step S12b, in which the authentication data to be subsequently issued is set to indicate that the authenticity of the examined object could not be verified. Otherwise (S - no), the method proceeds to authentication step S11, in which the received identification data (in RD1) is compared with the identity information obtained from the mark M. If, as a result of this comparison, it has been identified, according to the corresponding predefined matching criteria that the identification data matches the identity information (S11 - yes), the authentication data to be subsequently issued 5 is set in step S12a so that it indicates that the authenticity of the examined object has been confirmed. Otherwise (S11 - no), the method proceeds to step S12b, which is already described above.

The method further includes a storage step S13, in which data representing the original hash value OH is received as part of the identification data (in RD1) into a first blockchain block of the external data register 9, and data representing identity information is at least partially - into a block of a second, separate blockchain, which, first of all, may belong to the same external data registry 9. As part of the persistence process, the corresponding cross-blockchain pointers are added to each of the two blockchains. Cross-blockchain pointers are consistent in the sense that they contain data created and stored during a single authentication event. First, the second blockchain can be correlated with supply chain information such as the time, location, and user identity of the current authentication event. On the other hand, the first blockchain is used to track authentication information, primarily authentication success, during the current authentication event of a physical object being marked M as original (i.e., not tampered with or tampered with). In alternative embodiments, blockchains may be replaced by blockless distributed ledgers or public/private key infrastructure (PKI) environments.

The method further includes a data output step S14, which may be performed before, simultaneously with, or (as shown) after the storage step S13, wherein the authentication data AD specified in step S12a or S12b, respectively, is output to, for example, the user interface of the object authentication device 4 into either a data stream or a file provided on the electronic or optical interface of the object authentication device 4. The AD data output in step S14 may further include, in whole or in part, identification information in RD1 and/or identity information read from the mark M. The AD data output may be used for on-site authentication purposes (eg , at various points along the supply chain of marked products), or also initially, at a production site for manufacturing or commissioning, when a physical object is initially marked, in order to confirm the marking and to capture its contents for later use, for example, for storage it in the database for subsequent authentication purposes.

In addition, the method may optionally include a security tracking step S, in which the authentication data issued in the data issuing step S14 and, optionally, also a time stamp and/or current location of the read event corresponding to the object authenticator device (all of which may be considered security-related information elements SI) are transmitted over a communication link to a predetermined central server, which may, for example, be part of a security control center, which in turn may again be part of a system 3 for object recognition, as already described above.

Fig. 5 and 6 further illustrate preferred security-related aspects of the overall entity authentication solution discussed above. First of all, FIG. 5 shows an alternative schematic overview of a basic embodiment of a complete object verification solution 1, which enables the supply chain recipient P to confirm the originality of the M-marked product A (for example, according to FIG. 2) and its actual delivery by the intended original manufacturer OM, located upstream in the supply chain.

For this purpose, the original manufacturer OM is equipped with a device for applying the MA marking to the product A, which is to be subsequently sent along the logistics chain described above with reference to FIGS. 2 in a manner which includes a device similar to that shown in FIG. 1 device 4 (4-1) for verifying the authenticity of an object or can be used in connection with it. The marking MA contains identity information that matches or is derived from the product-related reference data subset RD1, which subset is provided by the system 3 during learning method implementation 5 in FIG. 2. The information represented by the MA marking, first of all, includes information about identity, and is digitally signed with the personal key of the manufacturer OM.

Based on this, the object authentication device 4-2 is configured to detect the distinctive characteristics of the product A and to access the identity information contained in the mark MA. In addition, the object authenticator 4-2 is configured to generate a public/private key pair of the asymmetric cryptography system, store the private key (secure key, SK) in a secure memory area of the object authenticator 4-2, and provide a public key (PUK) , along with identity information and optionally other security-related information such as current time and/or location, to a central security server located in a security command center maintained by a trusted third party. Based on this, the security control center plays the role of a registration node where the public keys of one or more object authentication devices 4 are registered and stored. Preferably, any communication to and from the security control center is protected by encryption, primarily to prevent "man in the middle" attacks. In some embodiments, the security control center may be a portion of the object recognition system 3 described with reference to FIG. 1-3, and can primarily be implemented as part of its data processing platform 3b. Alternatively, the security control center may be represented as part or function of the external data registry 9.

In order to increase the level of security available, the public key may be provided to a public key infrastructure (PKI) certifying node, primarily the associated certifying node server 12, where the public key is certified and included in a cryptographic certificate that is available to the OM manufacturer and authorizing node (server) 11. Now any other node in the supply chain equipped with an entity authentication device 4 (4-2) as described herein, such as recipient P, has the ability to request a certificate from authorizing node 11 5 for use him to examine a marked item believed to be from the OM manufacturer to determine its authenticity. For this purpose, the object authentication device 4-2 at the recipient P carries out the authentication method according to FIG. 3A/3B and/or figs. 4A/4B to generate authentication data AD and to confirm from it that OM was the actual creator of item A or, failing that, that item A examined or its MA markings were tampered with or otherwise tampered with.

The result of this authentication process, that is, authentication data, which may optionally further include security-related information such as the time and location of the authentication process and/or the identity of the user of the authenticator of the authentication device 4-2 object, sent to the central security server of the security control center and stored there. This allows for centralized control of the supply chain and early identification of any counterfeit or tampering issues along the supply chain. The central security server may further be configured to generate or consolidate and provide, through an API data interface, the availability of tracking and traceability data showing the processing of an item along the supply chain based on comparison results and security-related information provided by any devices 4 involved in the logistics chain verify the authenticity of the object.

Fig. 6 relates to another preferred embodiment of the present entity authentication solution in which blockchain technology is used to securely store and make available AD authentication data generated along the supply chain. Specifically, FIG. 6 schematically shows the development of a complex consisting of two cross-linked blockchains in parallel with the supply chain for an MA-labeled product A implementation according to preferred embodiments of the present solution for verifying the authenticity of an object. First of all, the embodiments of FIGS. 5 and 6 can be combined within a single verification solution 1.

The solution in Fig. 6 comprises a first blockchain BC-PUF that is configured to securely store and make available authentication information, primarily original OH hash values, obtained from various items through the learning process of FIG. 2 as described herein. In addition, a second BC-SCM blockchain is provided that is configured to securely store and make available supply chain information such as product registration numbers, product authentication dates and locations, product markings, etc. First, such supply chain data may be stored in the second BC-SCM blockchain in the form of corresponding hash values, or as a complement thereto, which hash values are created from such data by applying a suitable hash function to them. These two blockchains BC-PUF and BC-SCM are configured to track the movement of products through the supply chain and have their own linked blocks, that is, blocks containing data related to the same control point in the supply chain, which blocks are linked through cross-blockchain pointers , which ensures the provision of communications from and to the corresponding blocks.

At the first node in the supply chain, which belongs to the original manufacturer OM of item A, that item A is marked with an MA marking as described herein, for example of the type shown in FIG. 2. Again, the object authentication device 4 (4-1) may be used for this purpose, as described above with reference to FIG. 1. In this marking process, the distinctive characteristics of the article A are subjected to detection by the object authentication device 4-2 and using the authentication method according to FIG. 3A/3B and/or figs. 4A/4B, wherein reference data RD1 including primarily the original OH hash value of the successfully recognized item (or alternatively, an ERM error message) is received from system 3. Optionally, this original OH hash value is confirmed by comparing it with the corresponding the hash value provided by the MA marking. The hash value OH is then stored in the first block of the blockchain BC-RD1 as the initial original hash value as part 5 of the first stored transaction #1 whose origin is the manufacturer OM.

In addition, the product mark MA contains a second digital signature, which includes a second hash value derived from supply chain-related data related to the manufacturer OM. This second hash value is read from the MA token by the object authenticator 4-2, and stored in the first block of the second blockchain BC-SCM as part of the first transaction #1, the origin of which is the manufacturer OM, optionally, along with other related supply chain data. Both of these first two blocks contain data corresponding to the initial OM step of the supply chain, and accordingly, in each of the two blocks, in order to ensure mutual communication, an inter-blockchain pointer to a correspondingly related block in the other block chain is added.

At the next step along the logistics chain, product A reaches a second, intermediate node C, which may, for example, belong to a logistics company that is responsible for the further transportation of the product along the logistics chain. Node C is equipped with another object authentication device 4-2-C and thus performs product examination by implementing the method according to FIG. 3A/3B and/or figs. 4A/4B on the object authentication device 4-2-C regarding the MA marking of item A. If this examination confirms the manufacturer OM as the creator of item A, the corresponding positive examination transaction #2 is stored in the second block of the first blockchain BC-RD1. Otherwise, saved transaction #2 indicates a negative test result, thereby indicating fraud regarding Product A or its MA labeling. In addition, for the purpose of indicating a negative result, an alarm or error message may be output, for example, to the user interface of the object authentication device 4-2-C, or an alarm or error message may be transmitted to a control center security through the communication line.

The second block is cross-linked with the previous one, that is, the first block of the blockchain by adding the block hash of the previous block. This entry in the first blockchain BC-RD1 confirms that Item A was examined at Node C with the corresponding result. The initial original OH hash value remains available through cross-linking with the first block. In a similar manner to the previous node, supply chain information is generated from the second digital signature of the MA mark and other node-related data, and stored in the second blockchain as transaction #2. Additionally, in this second blockchain, the second block is cross-linked to the preceding first block by storing the block hash of the preceding block in the second block. Again, a cross-blockchain pointer is added to each of the second blocks to enable mutual communication between them.

In the next step along the logistics chain, product A reaches a third, intermediate node d, which can be represented, for example, by a remote logistics station that is not equipped with an object authentication device 4, but instead, only with a conventional scanner 13, which is only capable of reading the second digital signature contained in the MA marking of product A. Unlike previous nodes, in node d, in the same way as in node C, in the third block of the second block chain BC-SCM, only those related to the logistics chain are recorded as transaction #3 data. However, in the first blockchain, BC-25 RD1 does not store any data because the scanner is not capable of reading the distinctive characteristics of item A and generating associated item OD data.

Finally, in the fourth step along the supply chain, item A reaches node E, which can be, for example, the final destination or local retailer of item A. At this node E, a similar procedure is performed by another object authentication device 4-2-E, as in the preceding node C, and accordingly, similar entries are added to the corresponding further blocks of both the PC-RD1 and BC-SCM block chains.

These two blockchains serve as a secure public ledger for all transactions that have ever been made and have been stored since the initiation of these blockchains. In addition, blockchains 5 provide an extremely high level of integrity since they are (virtually) unmanipulable and thus their use further enhances the security of the complete entity authentication solution presented herein. First of all, the data stored on these two blockchains can be used to investigate both whether manufacturer A is the actual creator of product A and whether the supply chain is as expected. Such an investigation can be carried out at each node OM, C, E along the logistics chain, which is equipped with an object authentication device 4 and, thus, it is possible to examine both the product A and its marking MA, as well as gain access to the data stored on two blockchains.

While at least one exemplary embodiment of the present object authentication solution has been described above, it should be noted that there are a large number of modifications thereto. In addition, it should be understood that the described illustrative embodiments show only non-limiting examples of how the present object authentication solution may be implemented, and that they are not intended to limit the scope, application, or configuration of the apparatus and methods described herein. Rather, the foregoing description provides those skilled in the art with designs for implementing at least one illustrative embodiment of the solution, it being understood that various changes in the functionality and arrangement of elements of the illustrative embodiment can be made without departing from the scope of the appended claims and their legal equivalents.

LIST OF REFERENCE SYMBOLS

1 – object authentication solution

2 – system for automatic object authentication

3 – system for automatic object recognition 5

3a – recognition subsystem

3b – data processing platform

4 – object authentication device

4-1 – central object authentication device of system 2

4-2 – field object authentication device

4a – sensor node of the object authentication device

4b – object authentication device computing node

4c – object authentication device memory

4d – protective device

14e – safety protection device

4f – control device

5 – machine learning based data analysis module

5a – computing node of the data analysis module

5b – data analysis module memory

6 – data processing module

6a – computing node of the data processing module

6b – data processing module memory

7 – first data store

8 – second data storage

9 – external ledger, such as a blockchain or blockless distributed ledger or public key infrastructure environment

– central security server

11 – authorizing node (server)

12 – server of the certification node

13 – scanner 30

A, B – (physical) objects to be authenticated

A1 – consumer goods, for example, a set of pharmaceutical tablets placed in blister packs

A2 – food containers, primarily containers for blister packs A1

API – Security Operations Center Data Interface

AV1 – first incremental value

AV2 – second incremental value

BC-RD1 – First Blockchain for Reference Data

BC-SCN – second blockchain for supply chain data 5

C, d, E – nodes of the logistics chain

CD() – data combining function

DD - distinctive data

ERR – error signal

ERM - Error Message

ID – identification data

B – index

L1-L6 – secure communication channels

M, MA MB – markings

MD - metadata

OD – object data

ODD – original distinctive data

OH – original hash value

OM – original manufacturer

PUK – public key

PRD2 – previous second subset of reference data

R – recipient, e.g. customer, along the supply chain

RD1 – the first subset of reference data containing

identification data

RD2 – second subset of reference data

SI - additional information

SK – secure (private) key.

Claims (48)

1. A method for training a system for automatic object recognition, including: obtaining object data representing one or more distinctive characteristics of a physical object or group of physical objects, processing object data through a machine learning-based object recognition process to obtain original distinctive data by generating, through one or more predefined modifying operations, multiple collision-resistant virtual representations of a physical object or group of physical objects such that at least two of these virtual representations represent the same physical object or the same group of physical objects, but each under its own condition, these different conditions referring to different age stages in the life of the physical object or group of physical objects, representing aging-related effects, storing the reference data, including the original distinctive data and the original hash value obtained therefrom by applying a predetermined encryption hash function thereto, in one or more restricted data stores. 2. The method according to claim 1, wherein storing the reference data includes storing the original distinctive data in a first of the data stores, and storing the identification data including the original hash value in a separate second data store such that neither the first nor the second data store does not simultaneously store both the original distinctive data and the corresponding original hash value. 3. The method of claim 1 or 2, wherein storing the reference data includes storing merged data that is formed as a combination of the reference data and an additional incremental value that is set to be independent of the reference data in one or more restricted data stores. 4. Method according to one of paragraphs. 1-3, which further includes iterative retraining of the system for automatic object recognition based on additional object data representing the distinctive characteristics of a physical object or group of physical objects for which the corresponding original reference data has already been previously generated and stored in one or multiple data stores during a previous iterative training step of the system, with additional object data serving as input to the machine learning-based object recognition process. 5. Method according to one of paragraphs. 1-4, wherein storing the reference data includes one or more of the following steps: storing the reference data in a digitally signed form in at least one of the data stores, storing or causing one or more nodes of the blockchain environment to store identification data in digitally signed form in a block chain associated with said blockchain environment, storing or causing one or more nodes of the blockless distributed ledger environment to store identification data in digitally signed form in at least one node of the blockless distributed ledger environment, storing the identification data in digitally signed form in a public/private key environment storage device. 6. Method according to one of paragraphs. 1-5, carried out by a system containing two or more separate devices that jointly implement the method, and which are connected to each other with the ability to transmit data through one or more communications channels protected from unauthorized interception. 7. A system for automatic object recognition, designed to implement the method according to one of claims. 1-6. 8. A storage medium in which a computer program is stored, including commands that, when executed on one or more processors of a system for automatic object recognition, cause this system to implement the method according to one of claims. 1-6. 9. A method for verifying the authenticity of an object using an object authentication device, including: sensor-based detection of one or more distinctive characteristics of a physical object or group of physical objects, generating object data representing one or more distinctive characteristics of a physical object or group of physical objects, message of object data to the system according to clause 7, receiving identification data with a digital signature from the system in response to a message of object data, reading the markings provided on or in combination with a physical object or group of physical objects, respectively, to obtain digitally signed identity information from it, confirmation of the correctness of each digital signature of identification data and digital signature of identity information, comparing the received identification data with the received identity information to confirm the identity of an object or group of objects based on the result of this comparison, and providing authentication information indicating whether a physical object or group of physical objects has been verified as authentic. 10. The method of claim 9, wherein the sensor-based detection of one or more distinctive characteristics of a physical object or group of physical objects includes detecting at least one distinctive characteristic that is at least essentially invariant under changes in environmental conditions in which at least one distinctive characteristic is found. 11. The method according to claim 9 or 10, which, in addition, includes: including the original hash value or other entity-specific information contained in the identity in the authentication information issued. 12. The method of claim 11, which further includes a storage process, wherein the storage process includes digitally signing and storing or causing another device to store the original hash value or other object-specific information in a digitally signed form in a block of the first blockchain or a node of the first blockless distributed ledger. 13. The method according to claim 12, wherein the storage process also includes: reading markings provided on or in connection with a physical object or group of objects to be authenticated or detecting one or more selected properties of the object or group of objects to obtain additional information relating thereto, and digitally signing and storing or causing another device to store this additional information in digitally signed form in a block of a second blockchain that is separate from the first blockchain or in a node of a second blockless distributed ledger that is separate from the first blockless distributed ledger. 14. Method according to one of paragraphs. 9-13, which further includes one or more of the following: performing user authentication, and granting or not granting permission to the user to perform object authentication using the object authentication device based on the result of user authentication, communication via communication line to the opposite party of information about authentication and/or identification data, in whole or in part, and/or additional information obtained from them, capturing and sending security-related information to the opposite party over the communication line, detecting a security event in the information contained in a signal received from the opposite party over a communication line. 15. Method according to one of paragraphs. 9-14, which further includes sensor-based detection of one or more of the following security events: - an attempt or actual act of physical intrusion into an entity's authentication device, - an attempt or actual act of gaining local or remote access to the internal control functions of an entity authentication device, such access not being authorized by the user of the entity authentication device during its normal operation. 16. Method according to one of paragraphs. 9-15, which further includes implementing one or more of the following security measures in response to the detection of a security event: - blocking the object's authentication device, for example limiting or preventing its further use, - self-destruction of at least one functional part of the object authentication device or destruction of data stored in it in order to prevent its further use or access by the user, - displaying an error message. 17. A storage medium in which a computer program is stored, including commands that, when executed on one or more processors of the object authentication device, cause the object authentication device to implement the method according to one of claims. 9-16. 18. A system for automatically verifying the authenticity of an object, including: - a first device configured to: receive object data representing one or more distinctive characteristics of a physical object or group of physical objects; processing the object data through a machine learning-based object recognition process to obtain distinctive data representing one or more collision-resistant virtual representations of a physical object or group of physical objects; comparing at least one of the signature data and an original hash value obtained therefrom by applying a predetermined encryption hash function thereto with corresponding reference data stored in one or more restricted data stores; and issuing digitally signed identification data including the hash value if comparison with the reference data results in a match; And - a second device configured to: based on the use of sensors, detect one or more distinctive characteristics of a physical object or group of physical objects; generating object data representing one or more distinctive characteristics of a physical object or group of physical objects; reporting the object data to the first device; receiving digitally signed identification data from the first device in response to the object data message; reading markings provided on or in combination with a physical object or group of physical objects, respectively, to obtain digitally signed identity information therefrom; confirming the correctness of each digital signature of identification data and digital signature of identity information; comparing the received identification data with the received identity information to confirm the authenticity of an object or group of objects based on the result of this comparison; and providing authentication information indicating whether a physical object or group of physical objects has been found to be authentic by that verification.

Images