WO2022029321A1

WO2022029321A1 - Producing document templates having security features

Info

Publication number: WO2022029321A1
Application number: PCT/EP2021/072073
Authority: WO
Inventors: Ralf RIESER; Michael Knebel; Per KRÜGER
Original assignee: Bundesdruckerei Gmbh
Priority date: 2020-08-07
Filing date: 2021-08-06
Publication date: 2022-02-10
Also published as: EP4246373A3; EP4246373A2; EP4192692A1; DE102020120842A1

Abstract

A method for producing an electronic document template for a value document or security document comprises the following steps: providing (301) a database (DB), in which different types of optical security features are each assigned one or more channels for optical sensing of the security feature in question by means of an optical reading device, the optical reading device being designed for separation of the channels, selecting (302) a plurality of types of the optical security features from the database and instantiating the selected types by placing and scaling security features of the selected types on an electronic representation of a document substrate layer of the value document or security document in order to produce a layout draft, checking (303) the layout draft, wherein, for spatially overlapping or mutually adjoining instantiated types of security features, it is checked whether these types occupy a common channel, and if this is the case, a signal is output and a correction (304) of the layout draft is input as a response to the signal, and storing (305) the resulting corrected layout draft as the electronic document template.

Description

Generation of document templates with security features

Description

area

The invention relates to a method for generating document templates with security features and for producing documents using corresponding document templates, in particular so-called value or security documents such as identity cards, passports or credit cards. Furthermore, the invention relates to document templates generated using appropriate methods and documents produced using appropriate methods. Finally, the invention includes electronic design systems for corresponding document templates and production systems for corresponding documents. State of the art

Documents, e.g. value and security documents such as identity cards, passports or credit cards, are used in many security-critical application scenarios. The risk is correspondingly high that an authorized owner of such a document or an unauthorized third party will physically manipulate the document after it has been issued in order, for example, to gain unauthorized access to a protected building complex, access to protected data, or access to the performance of services . For example, an unauthorized third party could try to replace the owner's facial image, which is printed on an already manufactured and issued identification document or on a personalized value document, with their own facial image or with a morphed image (identity theft). Other manipulations are also possible, for example manipulating location and age information on the document or making a physical copy of a genuine document.

If the document has electronic components, such as in particular a data memory and a microprocessor, there are various approaches in the prior art, a document or at least the content of its data memory using individual identifiers, cryptographic keys, signatures and other document-specific or person-specific data or algorithms clearly and tamper-proof identifiable.

However, not all value and security documents also have appropriate data storage and/or microprocessors to ensure the manipulation security of the document and/or its information content by means of algorithmic and/or cryptographic methods. Even where appropriate electronic components exist, using them in an integrity check is often time-consuming or complex. The said electronic means of securing the integrity are often insufficient, namely when the integrity of the document is also verified, at least on some occasions, on the basis of purely optical features, such as a hologram, a facial image of the document owner, a handwritten signature of the owner, etc target. For example, a person's facial image printed on that person's passport, ID card, or employee ID card is routinely used to prove to other people that the owner of the document is the person for whom the card was issued. In such scenarios, it is not sufficient just to ensure that the electronic components or data storage of the document are intact, ie have not been manipulated. Rather, it must also be ensured that the optically detectable, personal data of the document has not been manipulated or that a corresponding manipulation can be identified quickly and reliably.

subject of the invention

The invention is based on the object of creating an improved method for generating an electronic document template for a value or security document.

The objects on which the invention is based are each achieved with the features of the independent patent claims. Embodiments of the invention are given in the dependent claims. The embodiments listed below can be freely combined with one another, provided they are not mutually exclusive.

In one aspect, the invention relates to a computer-implemented method for generating an electronic document template for a value or security document. The procedure points to a

Providing a database in which one or more channels for the optical detection of the security feature in question are assigned to different types of optical security features using an optical reading device, the optical reading device being designed to separate the channels,

Selection of a plurality of types of optical security features from the database and instantiation of the selected types in each case by placement and scaling of security features of the selected types on an electronic representation of a document carrier layer of the value or security document to generate a layout draft,

Checking the draft layout, checking for spatially overlapping or adjacent ones of the instantiated types of security features whether they occupy a common one of the channels, and if so, outputting a signal and inputting a correction to the draft layout in response to the signal,

Saving the resulting corrected draft layout as the electronic document template.

Embodiments can have the advantage that they make it possible to ensure, even when drafting such a document, that an integrity check of the finished document using an optical reading device is actually especially with acceptable error probabilities, can be ensured. It can thus be ensured that the finished document is optimized with regard to the optical reading device, as a result of which it can be avoided that important features of the document cannot be reliably recognized. A design process is provided that takes into account the system of document and inspection or reading device, so that the possibilities and limitations of the optical reading device and the manufacturing process can be taken into account when the documents are designed. In particular, for example, systematic pseudo-errors during processing in the field due to contradictory design of security features can be avoided.

Embodiments can have the advantage that they allow the available optical security features to be freely selected and combined with one another in the course of designing the document layout using the database. If security features are instantiated in the course of designing in such a way that they spatially overlap or adjoin one another and at the same time occupy a common channel, there is a risk that the optical reading device will not be able to cleanly separate these security features from one another or detect them in isolation from one another. For example, the optical reading device is only able to detect an overlay of the corresponding security features, from which it cannot individually extract the underlying security features. In this case, for example, one or more of these security features cannot be detected or cannot be fully detected by the optical reading device.

In the course of a validity check of the document, there would be a risk that the corresponding security features would be classified by the optical reading device as incomplete or missing as a whole, for example. Consequently, the security features, although present and valid, would be classified as invalid by the optical reading device, which could result in the document having the security features being falsely classified as invalid.

If the corresponding security features were neglected or disregarded during a validity check due to the risk of false rejection ("false rejection"), the effort involved in introducing the corresponding security features into the document would have been in vain. Furthermore, ignoring security features would reduce the security level of the document corresponding document could be impaired, the security of the corresponding document could be jeopardized. In particular, there would be an increased risk of false acceptance of an invalid document that does not contain the corresponding security features at all, or in an incomplete and/or incorrect form. However, the corresponding security features are deemed to be necessary for one Assuming confirmation of the validity of the document, the document could not be validated or verified by a corresponding optical reading device. A successful validity check would either be impossible from the outset or at least prone to failure, since there would be a high probability of an incorrect rejection.

For a security feature, it may be necessary for the optical reader to detect a plurality of predefined characteristic details of the security feature to be checked as being present. For example, the security feature is compared to a reference template. If the match is sufficient, i.e. if the detected security feature and/or the detected characteristic details of the security feature match the reference template, the security feature is classified as present or valid. A match may include, for example, identity and/or a match within a predefined tolerance range.

Embodiments can have the advantage that, for a given optical reading device or for a given optical reading device type, it can be checked in the course of a layout design whether the instantiated security features can actually be detected in the course of a validity check with the corresponding optical reading device or the corresponding optical reading device type . If the review of the layout draft is positive, i.e. no potentially problematic combinations of security features are recorded, the reviewed layout draft is saved as an electronic document template. If the check is negative, i.e. if instantiated security features are identified in the course of the check, which the reader cannot resolve individually and therefore cannot check, a correction of the layout draft is initiated and the resulting corrected layout draft is saved as an electronic document template.

For example, after a correction, the resulting corrected layout draft is saved as an electronic document template. For example, a positive test result is a prerequisite for saving the resulting corrected layout draft. In the event of a negative test result, the test and correction can be repeated several times in succession, for example, until the test of the corrected layout draft is positive and this is stored as an electronic document template without further correction.

Embodiments can have the advantage that, before a document is produced, it can be ensured that all security features of the corresponding document can be validated or verified with the optical reading device that is provided for checking the document. In particular, validation tests of the corresponding document with one or more are unnecessary corresponding optical reading devices, which are provided for validating or verifying the corresponding document. Instead, corresponding validation tests can be replaced by checking the layout design before the physical document is produced.

According to embodiments, it is provided that the optical reading device has a given optical resolution and the layout design is checked in such a way that it is carried out for adjacent areas of the layout design that cannot be spatially resolved by the optical reading device. According to embodiments, it is provided that the layout draft is checked in such a way that it is carried out for adjacent instantiated types of security features that cannot be spatially resolved by the optical reading device. According to embodiments, it is provided that the layout design is checked in such a way that it is carried out for overlapping regions of the layout design that cannot be spatially resolved by the optical reading device. According to embodiments, it is provided that the layout draft is checked in such a way that it is carried out for overlapping instantiated types of security features that cannot be spatially resolved by the optical reading device.

Embodiments may have the advantage that the optical resolution of the optical reader is taken into account when reviewing the layout design. For example, areas of the layout design and/or instantiated security features included in the layout design can be identified using the optical resolution capability of the optical reading device, for which a check is relevant. As long as the resolving power of the optical reader is sufficient to be able to detect two instantiated security features as separate security features or areas of the layout design comprising two security features as separate areas, the recording and validation or verification of the corresponding security features is not disturbed, for example, by the fact that the security features share the same optical channel occupy. The spatial separation can, for example, be sufficient to separate the corresponding security features. If, on the other hand, the optical resolution is not sufficient for spatial separation, separation can take place, for example, by occupying different optical channels.

For example, the document to be produced is a multi-layer document which is made up of a plurality of layers. For example, the layout design defines a plurality of layers in which the security features are instantiated. For example, security features are instantiated in different layers, ie on different levels, of the layout design. Security features that overlap or are arranged on different levels in overlapping areas of the layout draft of the layout draft cannot, for example, be read spatially by the optical reading device be separated.

According to embodiments, one or more of the channels are reader-specific channels which are each assigned to one or more optical reader types. According to embodiments, the method further includes selecting one or more of the reader types for which the layout design is being checked. The checking as to whether the instantiated types of security features that spatially overlap or are adjacent to one another occupy a common channel is carried out in each case on a reader-type-specific basis. This means that only common channels that are assigned to a common reader type are taken into account. If overlapping or mutually adjacent instantiated types of security features occupy the same channel, but in each case for different reader types, no signal is output, for example, and consequently no correction is input.

Embodiments may have the advantage that a layout design can be tested for a plurality of different optical reader types. It can therefore be ensured that the instantiated security features can be detected by all optical readers of the plurality of different types of optical readers and can be used for document validation or verification.

According to embodiments, it is provided that production of the value or security document according to the electronic document template is subject to manufacturing tolerances with regard to the spatial arrangement of the instantiated optical security features, with these manufacturing tolerances being included in the determination of the overlapping or adjacent areas that cannot be resolved spatially by the optical reading device. For example, these manufacturing tolerances are included in the determination of overlapping or adjacent security features that cannot be spatially resolved by the optical reading device.

Tolerances can occur not only on the receiver side, for example in the form of the resolving power of the optical reading device, but also on the transmitter side. Tolerances on the transmitter side include, for example, manufacturing tolerances of the security features. Embodiments can have the advantage that the transmitter-side influence of the manufacturing tolerances of the instantiated security features on the detectability or separability of security features that occupy the same channel can be taken into account when checking the layout design.

According to embodiments, it is provided that the types of optical security features in the database are each assigned a verification error rate when checking for validity by the optical reading device if the relevant Security feature occurs sporadically, and the method includes a calculation of an overall verification error rate for the layout design and / or the resulting corrected layout design. Embodiments can have the advantage that an overall verification error rate for the layout design can be calculated based on the verification error rates of the individual instantiated security features. For example, the layout design review may include an overall review error rate review. If an overall check error calculated for a layout design exceeds a predefined threshold value, a signal is output and a correction of the corresponding layout design is input in response to the signal, for example. The resulting corrected draft layout is saved as the electronic document template, for example. For example, the verification error rates of the individual instantiated security features are summed up to calculate the overall verification error rate. One of the test error rates is, for example, false acceptance rates (FARs) and/or false rejection rates (FRRs). The overall test error rate is, for example, an overall incorrect acceptance rate or an overall incorrect rejection rate. For example, an overall false acceptance rate and an overall false rejection rate are calculated.

According to embodiments, it is provided that the channels are selected from the group formed by frequency channels, flip angles, excitation wavelengths, color impressions and combinations thereof. A channel can be defined, for example, by a frequency or a frequency range in which security features are detected. A channel can be defined, for example, by a tilt angle of a surface of the document relative to a plane assigned to the optical reading device, under which security features are detected. The associated plane is, for example, an image plane. For example, the tilt angle defines a relative tilt of the surface of the document, i.e. the object plane, relative to the image plane. A channel can be defined, for example, by one or more wavelengths and/or wavelength ranges with which security features are excited. A channel can be defined, for example, by a color impression with which security features are detected.

According to embodiments, it is provided that the optical security features are selected from the group formed by guilloches, micro-writing, metameric systems, imprints with fluorescence, phosphorescence and/or up-conversion colors, imprints with infrared colors, barcodes , in particular one- or two-dimensional barcodes, optically variable colors, transparent or reflective holograms or kinegrams, watermarks, in particular digital watermarks that carry machine-readable information, register printing elements, in particular see-through registers, see-through windows, mottled fibers, security threads, micro-perforations and combinations thereof. According to embodiments, it is provided that the method additionally has an optimization of the document template, preferably with the aid of an optimization algorithm using an ROC curve or a performance curve, taking manufacturing tolerances into account. For example, a function to be optimized is defined, which defines a property of the layout draft, such as the detectability of individual security features or an overall error rate. For example, the defined function is an ROC curve or a performance curve. The corresponding function can be defined, for example, taking into account manufacturing tolerances of the instantiated security features and/or the resolution of the optical reading device. The corresponding function is minimized or maximized as an objective function in the course of executing the optimization algorithm.

Embodiments can have the advantage that the layout design and thus the document template can be optimized. In other words, parameters of the instantiated security features can be automatically optimized and the result of the optimization can be used to correct or adapt the layout draft. For example, a distance between security features occupying the same channel can be optimized. For example, the distance is minimized to a minimum distance at which the corresponding security features can just about be separated from the optical reading device. For example, manufacturing tolerances of the security features and/or the resolving power of the optical reading device are taken into account.

According to embodiments, it is provided that the method additionally has a placement and scaling of security features to which multivariate separate channels are assigned, preferably with a combination of the excitation wavelength and color impression channels, in order to optimize the document template.

Embodiments can have the advantage that the placement and scaling of the security feature is taken into account during the optimization. For example, a distance between security features can be adjusted and therefore optimized by adjusting the placement and/or scaling of one or more of the corresponding security features. The corresponding security features are security features which occupy the same channel. For example, the corresponding security features are security features which occupy separate channels. The channels are, for example, multivariant channels. The optimization of the document template with regard to the placement and scaling of security features can aim, for example, at preventing crosstalk between separate channels. According to embodiments, the method also includes production of the value or security document using the electronic document template. The electronic document template is made available, for example, to a production system for documents, such as value or security documents. For example, the manufacturing system includes an electronic design system on which the document template is created. For example, the document template is sent from the design system to the manufacturing system over a network. For example, the document template is made available to the manufacturing system on a removable storage medium.

The electronic design system includes, for example, a printing system for printing the document. If the document is a personalized document, such as an identification document, the drafting system comprises, for example, a personalization system for personalizing a document blank to produce the corresponding personalized document, such as a personalized value or security document. According to embodiments of the invention, the document body can comprise a plurality of material layers, one or more of the material layers being individually personalized. For example, all material layers of the plurality of material layers are individually personalized. For example, the plurality of layers of material includes one or more layers of material that are not personalized. The plurality of material layers is assembled into the document body, for example after the personalization of the one or more material layers. For example, the plurality of material layers are laminated to form the document body from the plurality of material layers. The resulting document body thus comprises one or more individually personalized material layers. For example, all material layers of the resulting document body are individually personalized. For example, the resulting document body includes one or more layers of material that are not personalized. In accordance with embodiments of the invention, the document body may be composed of multiple layers of material, each individually personalized and then laminated to form the document body from the personalized layers. For example, the personalization system is configured to introduce personalization data into the document blank to be personalized. The personalization data include, for example, attributes of an owner of the document, such as a name, an address, etc. The personalization data also include, for example, biometric data of the owner, such as a face photo or fingerprint data. For example, the personalization data is printed on the document or on a document layer. For example, one or more of the security features each include the owner's personalization data. For example, the printing system includes the personalization system for printing personalization data. For example, the document includes a memory in which the personalization system stores the personalization data. For example, the document is a composite body that includes a plurality of material layers or material sheets. For example, the security features are arranged on one or more of the material layers. For example, security features are incorporated into one or more of the material layers. For example, security features are printed onto one or more of the layers of material. In the course of the production of the document, the plurality of material sheets are arranged one on top of the other in a document-specific sequence, for example, to form a material sheet booklet, from which a composite body is produced, for example by means of lamination.

For example, one or more of the security features include data that is required for access to a memory included in the document. For example, one or more of the checked security features is a security feature that includes corresponding data. For example, the optical reader detects the corresponding security features. A data reading device comprising the optical reading device extracts the corresponding data from the detected security feature. Using the corresponding data, the data reader derives a cryptographic key, for example. The data reader uses this cryptographic key when executing a cryptographic protocol for unlocking the memory of the document, i.e. for gaining access to the memory from which the data reader reads data using a contact or contactless communication interface.

In a further aspect, the invention relates to an electronic document template for a value or security document, generated using a method according to the invention.

In a further aspect, the invention relates to a value or security document produced using such a document template. The value or security document includes, for example, a multi-layer composite body.

In a further aspect, the invention relates to a document, in particular a value or security document, having an integrated electronic circuit and an electronic memory for storing data requiring protection and means for executing a cryptographic protocol, and with an interface to a data reader that allows access of the data reader to the data requiring protection after execution of the cryptographic protocol.

According to a preferred embodiment, the execution of the cryptographic protocol is only possible using an optical security feature of this document. In a further aspect, the invention relates to an electronic design system for document templates with a processor and a memory device in which a computer program is stored, the execution of which by the processor causes a method according to the invention to be carried out.

In a further aspect, the invention relates to a production system for value or security documents with an electronic draft system according to the invention and a printing system for value or security printing and/or a personalization system for personalizing document blanks for producing the value or security documents.

According to preferred embodiments, the method is a process for creating a test-optimized document layout, the basis of which is preferably the representation of all features using carriers (supports), occupied receiving channels and test characteristics.

This process makes characteristics, forms and/or production data available in databases. The desired layout is created and the user can be supported. Within a test routine, the local occupancy of all channels and the performance to be expected are preferably analyzed using an ROC curve or a merit function. If the result is reliable, the layout can be used and the existing data is preferably sent directly to the prepress or a printing system for printing the document. Otherwise, there is the possibility of reworking until the goal is reached. For example, an iterative repetition of correction and testing of the layout draft takes place until the test for potentially problematic combinations of features is positive and no problematic combinations of features are found. The test routine preferably also includes tests for the maximum area and channel occupancy of the document, the ratio of personal data to static features and purely aesthetic emblems, for example design elements, an assessment of the processability and the expected false acceptance rate (FAR ("False Acceptance Rate") value) and the false rejection rate (FRR ("False Rejection Rate") value) in the field based on known external data and performance curves, on manufacturability due to area occupancy and use of special materials and/or on the expected costs of the final document.

In connection with the description of the present invention and its exemplary embodiments, the following terms are defined as follows:

A "document" is a physical object, for example a paper-based or plastic-based card, with or without an integrated circuit such as a chip, which proves an identity or a property or a right of the holder of the document. A document can in particular be a value or security document. Examples of documents of value are banknotes. An identity document is a document that contains information regarding the identity of its owner (name, address, facial image, signature, etc.). An identity document can be, for example, an ID card, a passport, an employee ID card or a personalized document of value (e.g. credit card). Documents often include security features such as facial images, holograms, check numbers, cryptographic keys, or the like.

A "document template" is a data object stored electronically on a drafting system with the help of which a document can be generated whose properties are determined by the document template.

A "layout element" is an element of a layout of a document or a document template that has optical security features. Different types of layout elements have different optical security features or combinations of such security features.

"Optical security features" are properties of a document that can be used to check the authenticity or integrity of a document using an optical reader that has such security features. Examples of such security features are guilloches, micro-writing, metameric systems, overprints with fluorescence -, phosphorescence and/or up-conversion colors, imprints with infrared colors, barcodes, in particular one- or two-dimensional barcodes, optically variable colors, transparent or reflective holograms or kinegrams, watermarks, in particular digital watermarks, which are machine-readable information bear, registration printing elements, in particular see-through registers, see-through windows, mottled fibers, security threads, micro-perforations and their combinations. A feature occupies one or more channels depending on the definition (CMYK vs. RGB). A feature has an area that is required as a carrier (support), about the feature a bring up and present undisturbed. A feature has a structure per channel that needs to be checked. Characteristics are stored in a database with information on occupied channels, surface characteristics, structure and test conditions. In principle, features can be arranged in any way in the layout, although an overlapping of features can be prohibited.

A "database" is understood here as a container and/or system for storing and managing electronic data. The database is preferably a document-external database that stores the image reference data and optionally also other reference data for a large number of documents. A database can therefore For example, it can be in the form of a directory or directory tree However, a database is a database system that is designed to store large amounts of data efficiently, consistently and permanently and to provide required subsets in different, needs-based forms of representation for users and application programs. According to embodiments, a database system consists of two parts: the management software, called database management system (DBMS), and the amount of data to be managed, the database (DB) in the narrower sense, sometimes also called "database". The management software organizes the structured storage internally of the data and controls all reading and writing access to the database. A database system offers a database language for querying and managing the data. Examples of databases are a characteristics database (channels, carrier (support), characteristics), a form database (form, data groups) and a manufacturing database (manufacturing tolerances, process limits).

An "optical reader" is a device for the optical detection of a document, in particular for the optical detection of a security feature of such a document.

A "data reader" is a device for reading data from electronic memory. A data reader may be housed with an optical reader in a reader, such as a terminal.

A "channel for the optical detection of a security feature" is defined by the specific optical properties of a security feature. Examples of channels in this sense are frequency channels, tilt angles, excitation wavelengths, color impressions and combinations thereof. Typically (e.g. according to the "ICAO - Best Practice Guidelines for Optical Machine Authentication", Version 1.2, February 2018) images are recorded in Vis, UV and IR. Extensions, particularly in the area of holographic representations, are conceivable. This results in the visible ("Visible" = Vis), for example, 3 channels VisR, VisG, VisB, ie red, green and blue. The UV range can also be divided into sub-areas. For example, the UV range is divided into three sub-areas analogous to divided into the visible channels VisR, VisG, VisB, which are referred to as UVR, UVG, UVB.The UV sub-range with the largest wavelengths is referred to as the "red" UV range UVR, the middle UV sub-range with medium wavelengths as "green " UV range UVG and the UV sub-range with the shortest wavelengths as the "blue" UV range UVB. Furthermore, the IR channel and a holo channel result. Since both static and personalized features can occur in each channel, this results in a total of 16 channels, for example.

The "separation of the channels" means a detection of the optical security features by an optical reader that is separated according to channels. For example, different optical sensors can detect signals from different channels separately and process or subject to separate processing. The separation of channels is made more difficult, among other things, by so-called crosstalk or crosstalk. A feature regularly occupies a certain number of channels. For example, a yellow UV color can occupy the UVG and UVR channels, a lasered text, for example, occupies all channels. The requirement for separability now means that features within the individual channels do not overlap or are too close to each other. Texts and codes that are directly decoded are an exception. These can also be calculated out from the corresponding channels with prior knowledge of a form, a decoder and/or a characteristic. A formal description of the separability of two features Mi and Mj with the supports supp(M ^channel i ) or supp(M ^channel j ) then leads to a condition within a channel (channel) of the form: supp(M ^channel i ) n supp(M ^channel j ) = 0, where

are coordinates of pixels in a two-dimensional document plane or acquisition plane.

"Crosstalk or crosstalk" is a term from telephony and originally referred to an effect that allows you to quietly overhear another conversation on the phone - hence the name. Today the term is used in communications technology in general for the unwanted mutual interference of actually independent signal channels used.

The "instantiation of selected types of optical security features" is to be understood as including representatives of such types of optical security features in a document template when drafting this document template.

“Placement and scaling” is to be understood as meaning the local placement and selection of a specific dimensioning of the dimensions of an optical security feature in the layout of a document template when it is instantiated.

A "document carrier layer of a value or security document" is a layer in, on or on the body of the value or security document, which carries the information of the document, in particular its optical security features.

An "electronic representation of a document support layer" is the draft layout of the document support layer of a document stored in a storage device of a document template design system.

A "layout draft" is a data set that stores the instantiated optical security features of a document and their placement and scaling. "Common channels" are channels that are associated with more than one of those types of optical security features in a database in which channels are associated with different types of optical security features.

A "submission of a correction to the layout design" is the re-indication of a corrected layout design or the correction of an existing layout design in need of correction by the designer (the "Designer") of the layout design.

The "optical resolution of an optical reader" is the minimum distance between two structures, in particular of security features in a document layout, which just allows the spatial resolution (separation) of these two structures in an image recorded by this optical reader. The resolution is, for example, specified an angular distance or an angular resolution or by specifying a distance between structures that can just about be separated.

"Manufacturing tolerances" are unwanted deviations of the actual values of layout parameters such as positions, sizes or optical features from the target values of these layout parameters.

An "examination error rate" (also error rate, error quotient, error density, error rate or error frequency) is the relative proportion of incorrect elements in relation to the entirety when checking documents or document templates, i.e. the relative frequency with which an error is present distinguishes between false positive and false negative test results.The types of optical security features in the database are each assigned, for example, a test error rate when checking for validity by the optical reading device.

An "overall test error rate" for a layout draft and/or a resulting layout is calculated from the individual test error rates of the types of security features instantiated in the layout (draft) according to the rules of probability calculation. A layout is created and displayed in test channels. Based on known performance experiences ( ROC curve or similar) an expected value for field tests is created. Manufacturing-specific know-how can also be evaluated when arranging features (e.g. ink coverage). In particular, biometric features can be particularly weighted.

An "ROC curve" (ROC: English for receiver operating characteristic or German operation characteristic of an observer), also known as limit value optimization curve or isosensitivity curve, is a method for evaluating and optimizing analysis strategies. The ROC curve visually represents the dependence of the efficiency with the error rate for different parameter values. It is an application of signal detection theory. The ROC curve can be used to find the best possible value of a parameter, for example in a dichotomous (semi-)quantitative characteristic or two-class classification problem. For each possible parameter value (e.g. transmission speed, frequency, ...) the resulting relative frequency distributions are determined in the form of sensitivity (true positive rate) and false positive rate. The sensitivity (true positive rate) is preferably entered as the ordinate (“y axis”) and the false positive rate as the abscissa (“x axis”) in a diagram or in a digitally stored table. The parameter value itself does not appear, but can be used as a caption or digital label for the points. A relationship typically results that corresponds to a curved, ascending curve. A ROC curve close to the diagonal indicates a random process: Values close to the diagonal mean an equal hit rate and false positive rate, which corresponds to the expected hit frequency of a random process. The ideal ROC curve initially rises (almost) vertically (the hit rate is close to 100%, while the error rate initially remains close to 0%), only then does the false positive rate increase. A ROC curve that stays well below the diagonal indicates that the values were misinterpreted. The theoretical optimum (in the sense of a compromise between hit and error rate) of the tested value is then determined visually or with the aid of a computer from the contact point of a diagonally increasing tangent with the ROC curve.

If you plot the test values (for example as a function of the false positive rate) in the same diagram, the limit value is found as the perpendicular of the contact point of the tangent on the test value curve. Alternatively, the points of the curve can be labeled with the test value. Mathematically, one looks for the test value with the highest Youden index. This is calculated from sensitivity+specificity-1.

A "merit function" or performance function denotes a function that measures an agreement between data and a fitting model or fitting model for a certain selection of parameters. According to general convention, the performance function is small, for example, when the agreement is high. For example, in the course a regression, parameters can be adjusted based on the value of the merit function until a smallest value is obtained, thereby producing an optimal fit of the corresponding parameters that gives the smallest value of the merit function In other words, the corresponding parameters can be optimized by minimizing the merit function The result of the corresponding optimization are optimal or optimized parameter values.

To determine the influences of parameters of the instantiated security features of the layout draft and/or parameters of the optical reading device on the separability of the instantiated security features by the optical reading device, for example a Bayesian network or model is used. A Bayesian network describes a directed acyclic graph in which the nodes describe random variables and the edges describe conditional dependencies between the variables. Each node of the network is given a conditional probability distribution of the random variable it represents, which assigns random variables to the parent nodes. A Bayesian network is used to represent the common probability distribution of all variables involved as compactly as possible using known conditional independences. The conditional (in)dependence of subsets of the variables is combined with a priori knowledge. If the value of some of the variables is known, ie if there is evidence, then the conditional probability distribution of random variables can be calculated with the given variables with the help of various algorithms and inference can thus be operated. For example, a Monte Carlo algorithm can be used for an approximate inference.

A "frequency channel" is an optical channel defined by one frequency, multiple frequencies, or a spectrum of optical frequencies in or outside the visible range of electromagnetic radiation.

"Tipping angles" are important in connection with the tilting effect, which can be a possible security feature of value or security documents, in particular banknotes. On the one hand, this means that the relevant point on the banknote looks different from different angles (different colors or motifs ); on the other hand, different images can be thrown on the left and right eyes to create a 3D effect. The tilting effect can be created by embossing or lenticular images; an important example is what is known as the kinegram. A kinegram or kinegram is a technology for Protection against counterfeiting of banknotes, metal bars, passports, visas and identity cards by means of a tilting effect. It is referred to as an "OVD" (Optically Variable Device) for security purposes. Unlike the hologram, which has three-dimensional elements, the mostly silvery shiny kinegrams represent a two-dimensional movement process. The name is derived from the term kinematics, because depending on the viewing angle of the kinegram, a clearly defined film-like process takes place.

A channel defined by "excitation wavelengths" is defined by the wavelengths of the discrete or continuous spectrum of a light source that is used to illuminate a document in the optical reader. These excitation wavelengths do not have to be identical to the spectra emitted by the illuminated document. This is the case, for example, with fluorescence , the phosphorescence and/or the up-conversion colors is not the case.

A channel defined by "color impressions" is one through the optical color impressions Observer defined. The optical impression of an observer results from the product of the reflection or remission, the illuminance and the spectral sensitivity.

An "optical sensor" refers here to a sensor which is designed to capture one or more images of a physical object, for example a document or part of a document. The images can in particular be digital images be a camera or a video camera. The optical sensor can be designed, for example, to selectively detect light in a specific wavelength range, for example infrared light (IR light) or light in the wavelength range visible to the human eye (white light, daylight). the captured images are digital images that are stored electronically and/or sent to a system that processes the image further.

A "facial image" is understood here as an image, in particular a digital image, which depicts the face of a person.

A "digital image" is a data set in which image content is represented and stored. In particular, the digital image can be a data set in which the content of an image is represented by integers. In particular, it can be the digital image be a raster graphic.

A "system" is to be understood here as a whole made up of one or more system elements that are capable of processing data. For example, a system can include a computer, or a distributed computer system that is embodied, for example, as a cloud computer system It is also possible that individual components of the system or the entire system are implemented in dedicated hardware. For example, the test system can be completely integrated into a terminal, which, in addition to one or more cameras, also has one or more lighting systems and a copy of the database It is also possible, however, for individual components, such as the database, to be provided by a component external to the terminal, for example via a database server connected to the terminal via a network connection.

Brief description of the figures

Embodiments of the invention are described below with reference to the figures. Show it:

FIG. 1 shows a schematic diagram of an exemplary layout draft of a document or a document template, FIG. 2 shows a schematic diagram of an exemplary assignment of channels to features;

FIG. 3 shows a flow chart of an exemplary method,

Figure 4 is a schematic diagram of an exemplary document having an integrated electronic circuit,

Figure 5 is a schematic diagram of an exemplary drafting system for creating electronic document templates and

Figure 6 is a schematic diagram of an exemplary manufacturing system for creating a document using an electronic document template.

As shown in FIG. 1 by way of example and in a schematic manner, an exemplary layout draft 100 of a document 101 or an electronic document template has a plurality of layout elements. For example, the draft layout 100 comprises a plurality of types of optical security features 104 to 108 which are instantiated in the draft layout 100 . The security features can be placed on the same level or layer of the document and scaled if necessary or, in the case of a multi-layered document, on different layers arranged one on top of the other. For example, an optical reader captures the top of a corresponding document. In this case, the security features are distributed, for example, in a detection plane of a document carrier layer, which is spanned by two axes 102, 103 of an x, y coordinate system. One or more security features can be arranged overlapping, for example, such as the exemplary security features 105 and 107 or 106 and 108 in FIG. 1. The optical security features can, for example, include textual features (text fields) 104 or other types of optical security features. For example, security features may be placed adjacent to one another, such as exemplary security features 107 and 108, such that they touch. Security features can also have completely disjoint carriers, such as security features 106 and 105 or 107 and 106 in Figure 1.

If overlapping optical security features, such as security features 106 and 108, occupy the same channel, there is a risk that an optical reader trying to validate or verify a document with the correspondingly instantiated security features will not be able to tell the security features apart or .is able to separate from each other. For example, the optical reader comes to the conclusion that one or both security features are incomplete and therefore invalid. The same problem can occur, for example, with security features arranged adjacent to one another, such as security features 107 and 108 . If the resolving power of the optical reading device is not sufficient to resolve the border or a small distance between the corresponding security features, the optical reading device is also unable to keep these security features apart or to separate them from one another. In this case, too, the optical reading device could come to the conclusion that one or both security features are incomplete and therefore invalid.

As shown in FIG. 2 by way of example and in a schematic manner, the optical security features Mi and M2 occupy different channels. The optical security feature Mi is assigned to the channels with the channel numbers 6 and 11, for example, while the optical security feature M2 is assigned to the channel with the channel number 5, for example. The optical security features Mi and M2 are, for example, security features which have completely disjoint carriers, i.e. occupy completely overlapping and contact-free (disjoint) areas of the layout design. The channel numbers are plotted on the vertical axis 201. The horizontal x and y axes 203 and 202 span the detection plane.

As shown in FIG. 3 by way of example and in a schematic manner, the exemplary method for generating an electronic document template for a value or security document has the following steps:

In step 301 a database DB is made available. The database assigns different types of optical security features to one or more channels for optical detection with an optical reader. The corresponding optical reading device is designed, for example, to separate the channels. In step 302, one of a plurality of types of optical security features is selected from the database. In the course of their instantiation, the selected optical security features are placed on an electronic representation of a document carrier layer of the document to be designed, for example a value or security document, in order to generate a layout draft and, if necessary, scaled.

The layout draft created in this way with the instantiated optical security features is checked in step 303 . In the course of the check, a check is made for spatially overlapping or adjoining instantiated security features as to whether they occupy a common channel. If the result is negative and the check shows that there are potentially problematic overlapping or adjacent security features, the design is corrected in step 304 . For example, a signal is output or sent which possible problematic combinations of security features identified. In response to the corresponding signal, a correction of the layout design, for example, is input or received. For example, the signal is displayed on a display device of a user interface in the form of a conflict notice that identifies the possible problematic combinations of security features. Correction commands, for example, are received via an input device of the user interface. A correction of problematic combinations of security features can include, for example, spacing the corresponding security features on the document carrier layer from one another. In this case, the distance is selected, for example, such that the corresponding security features can be separated from the corresponding reading device, taking into account manufacturing tolerances and/or resolution capacity of the optical reading device, although they occupy the same channel. A corresponding objection can be made, for example, by adjusting the placement of the security features and/or by rescaling the security features, in the course of which they are reduced in size. Furthermore, the correction can include replacing one or more of the security features with security features of a different type which occupies a different channel. Finally, a correction can include omitting or removing one of the instantiated security features from the layout design.

For example, the conflict notice can include one or more automatically generated suggested corrections. The correction proposals can, for example, be created and output in a hierarchical order. As far as possible, a first proposal can, for example, propose a change in the placement of instantiated security features, a second proposal can, for example, propose a change in the scaling of instantiated security features, a third proposal can, for example, propose replacements for replacing instantiated security features with security features of a different type, which has a different channel occupied, include a fourth suggestion, for example, suggest removing one or more of the instantiated security features. For example, the input received in response to the conflict indication identifies one of the proposed corrections to be implemented to correct the layout design. Upon receipt of the appropriate input, the draft layout is corrected according to the input.

According to embodiments, the checking and correction steps 303, 304 can also be integrated into the selection step 302, for example, ie they can be carried out during the creation of the layout draft. For example, a corresponding check is carried out in the course of instantiating each of the security features. If an optical security feature is selected and arranged on the electronic representation of the document carrier layer, it is checked, for example, whether this optical security feature overlaps another optical security feature or is attached to one another optical security feature is adjacent, which occupies the same channel as the selected security feature. If this is the case, a signal is issued with conflict information. For example, the potentially conflicting security features are highlighted visually, for example in color, in a visual representation of the electronic representation of the document carrier layer on the output device of the user interface. For example, one or more correction suggestions to resolve the conflict are also displayed. This could have the advantage that the layout design can be corrected step by step as it is created. It can thus be ensured that the completed layout draft is conflict-free and can be saved as a document template in step 305 without further corrections.

For example, after each correction of the layout design in step 304, the test according to step 303 is repeated to check whether the correction has resolved all conflicts regarding overlapping or contiguous security features of the same channel. This may allow the correction of the layout design to be done iteratively.

If the check in step 303 is positive, i.e. there are no overlapping or adjacent security features of the same channel, in step 305 the layout draft is saved as an electronic document template. The saved layout draft can be an unchanged layout draft if the check in step 303 was positive, i.e. no conflicts have occurred, or a layout draft that has been corrected one or more times if conflicts were found and corrected in previous checking steps.

As shown in FIG. 4 by way of example and in a schematic manner, an embodiment of a document 101, for example a value or security document, has an integrated electronic circuit 402. The integrated electronic circuit 402 includes, for example, an electronic memory 403 for storing data requiring protection and a processor 404, which is configured to execute a cryptographic protocol 407. The cryptographic protocol 407 is implemented, for example, in the form of executable program instructions. Furthermore, the document 101 comprises a communication interface 405 for communication with a terminal 411 or with a communication interface 415 of a terminal 411 configured as a data reader or comprising a data reader. Finally, the document 101 comprises a plurality of optical security features 408 which, for example using an electronic document template generated according to the method of FIG. 3, in which documents 101 were instantiated. The plurality of optical security features 408 includes, for example, different types of optical security features that occupy different channels or can be detected via different channels. The exemplary terminal 411 includes, for example, an electronic circuit 412 with an electronic memory 413 for storing data and a processor 414 which is configured to execute a cryptographic protocol 417 . The cryptographic protocol 417 is implemented, for example, in the form of executable program instructions. Furthermore, the terminal 411 includes, for example, a communication interface 415 for communication with the document 101 or with the communication interface 405 of the document 101. Finally, the terminal 411 includes an optical reader 416 or optical sensor for detecting optical security features 408 of the document 101. The optical reader 416 is configured to detect optical security features using different channels. For example, the optical reading device 416 comprises a plurality of different optical sensors which are configured to detect optical security features via different channels in each case. For example, the optical reader 416 includes one or more optical sensors, each configured to use a plurality of channels to detect optical security features.

For example, the processor 414 of the terminal 411 is configured to control the optical reading device 416 for detecting the plurality of optical security features 408 . The detected security features 408 are checked by the terminal 411 for their validity. For example, the captured optical data of the security features 408 are compared with reference data that are stored in the memory 413 of the terminal. If the recorded optical data match the stored reference data sufficiently, the security features 408 and thus the document 101 are classified as valid and authentic. For example, one or more of the security features 408 include data that the terminal 411 extracts from the data captured by the optical reader 416 . Using the extracted data, the processor 414 derives, for example, a cryptographic key in the course of executing the cryptographic protocol 417, which unlocks the document 101 and allows the terminal 411 access to the data requiring protection in the electronic memory 403 of the document 411. Using the derived key, the terminal 411 can prove that the document 101 is actually available for visual inspection. Thus, secret reading attempts, for example without the document 101 being intentionally presented by the owner for this purpose, can be prevented.

For example, the terminal must also present an authorization certificate that defines access rights for the terminal 411. For example, the authorization certificate defines data categories for which the terminal 411 has reading rights. For example, the terminal 411 sends the authorization certificate on the train authentication to the document 101 via the communication interface 415 to the communication interface 405 of the document 101. Furthermore, the terminal 411, for example using a challenge-response method, possesses a private cryptographic key according to its associated public cryptographic key, the reading rights defined in the authorization certificate assigned. If the terminal 411 can present its read authorization and/or the key derived from the security features 408, it is given read access to the data requiring protection in the memory 403 of the document 101, for example, and can read this out via the communication interfaces 405, 415. On the part of the document 101, the data presented by the terminal 411 is checked to prove the access or read authorization, for example by the processor 404 using the cryptographic protocol 407.

As shown in Figure 5 by way of example and in a schematic manner, an embodiment of an electronic design system 500 for generating electronic document templates has, for example, a processor 502 which is configured to execute program instructions 504 of a computer program for generating an electronic document template for a value or security document . Furthermore, the electronic design system 500 includes, for example, a memory device 503 and a communication interface 504. Furthermore, the electronic design system 500 includes, for example, an output device 505, such as a display, and input devices 506, such as a mouse and/or keyboard. Furthermore, the electronic design system 500 has access to a database 507, for example. The database 507 can, for example, be comprised of the storage device 503 of the electronic design system 500 or it can be a remote database to which the electronic design system 500 can access via the communication interface 503 and, for example accessing a network, such as an intranet or the Internet. Various types of optical security features TI, T2, T3, . . . , TN are stored in the database 507, for example. The different types of optical security features TI, T2, T3, . For example, different channels for optical detection can be assigned to the different types of optical security features TI, T2, T3, . . . , TN for different types of optical reading devices. For example, the database 507 can also include information on the manufacturing tolerance of the optical security features TI, T2, T3, . . . , TN and/or on the resolution of the optical reading device or devices. Finally, the database 507 can include information on verification error rates for the different types of optical security features TI, T2, T3, . . . , TN, such as false acceptance rates and/or false rejection rates. For example, the exam error rates of the different types of optical security features TI, T2, T3, TN each assigned to a specific type of optical reader or only apply to the corresponding type. Corresponding information can also be stored in different databases, for example. For example, in addition to the database 507, which is, for example, a feature database, the electronic design system 500 can have access to a separate form database, which provides form specifications for documents to be produced, such as specifications for the content arrangement and structuring of data in the document and for data groups , which should include the corresponding document. Furthermore, the electronic design system 500 can have access to a separate manufacturing database, for example, which includes information on manufacturing tolerances and/or process limits, for example.

The electronic design system 500 is configured to allow a user to select a plurality of types of optical security features TI, T2, T3, ..., TN from the database 507 and to instantiate the selected types by placement and scaling of security features, respectively selected types on an electronic representation of a document carrier layer of a value or security document to generate a layout design. For this purpose, the user can make entries via the input devices 506, the result of which, for example in the form of the layout draft, is displayed to the user by means of the output device 505. The electronic design system 500 is further configured to perform a review of the layout design. In this case, for example, for spatially overlapping or adjacent types of instantiated security features, it is checked whether they occupy a common one of the channels. If this is the case, a signal is output, for example via the output device 505, and an input of a correction of the layout design is received in response to the signal via the input devices 506. The resulting corrected layout design is used, for example, as an electronic document template for the production of a corresponding Document, ie value or security document, stored in the storage device 503.

As shown in FIG. 6 by way of example and in a schematic manner, an embodiment of a production system 600 for value or security documents 101 has an electronic drafting system 500, as for example from FIG. Furthermore, the production system 600 has, for example, a printing system 602 for value or security printing. The electronic design system 500 provides the printing system 602 with the electronic artwork. Furthermore, sheets of material 601 for producing the document 101 are provided. The printing system 602 prints the sheets of material 601 in accordance with the specifications of the electronic print template. In the case of a multi-layer document, these material sheets 601 are combined, for example, to form a material sheet booklet, from which document 101 or the document body of document 101 is created. If the document 101 is a personalized document that is assigned to an individual owner, the production system 600 also includes, for example, a personalization system 604 for personalizing document blanks 605 for producing personalized documents 101, such as value or security documents. For example, in the course of personalization, the owner's personal data is printed on the document blanks 605 or one of the material sheets 603 . In this case, the personalization system 604 can be integrated into the printing system 602, for example. In addition or as an alternative, the personalization system 604 can enter personal or person-related data of the owner into an electronic memory of the document blank 605 .

R e f e c t i o n l s t e

100 layout draft

101 document

102 y-axis of a coordinate system in the document plane

103 x-axis of a coordinate system in the document plane

104 Text field, security feature in text form

105 to 108 optical security features

Mi ^6.11 optical security feature 1 with channels 6 and 11

M ₂ ⁵ optical security feature 2 with channel 5

201 channel number axis

202 y-axis of a coordinate system in the document plane

203 x-axis of a coordinate system in the document plane

301 to 305 process steps

DB database

402 integrated circuit

403 memory

404 processor

405 communication interface

407 cryptographic protocol

408 optical security features

411 terminals

412 circuit

413 memory

414 processor

415 communication interface

417 cryptographic protocol

416 optical reader

500 electronic design system

501 processor

502 program instructions

503 storage device

504 communication interface

505 output device

506 input device

507 database

TI to TN types of security features

Kl to KN channels

600 Manufacturing System 600 Material sheet Printing system Personalization system Document blank

Claims

P atentClaims

1. A method for generating an electronic document template for a value or security document, comprising a

Providing (301) a database (DB) in which different types of optical security features are each assigned one or more channels for the optical detection of the relevant security feature with an optical reading device, the optical reading device being designed to separate the channels,

Selection (302) of a plurality of types of optical security features from the database and instantiation of the selected types in each case by placement and scaling of security features of the selected types on an electronic representation of a document carrier layer of the value or security document to generate a layout design,

Examination (303) of the layout design, wherein spatially overlapping or adjacent ones of the instantiated types of security features are checked whether they occupy a common one of the channels, and if this is the case, outputting a signal and inputting a correction (304) of the layout design as response to the signal

storing (305) the resulting corrected draft layout as the electronic document template.

2. The method according to claim 1, wherein the optical reader has a given optical resolution and wherein the examination of the layout design is carried out in such a way that it is performed for overlapping or adjacent regions of the layout design that cannot be spatially resolved by the optical reader.

3. The method according to claim 2, wherein production of the value or security document according to the electronic document template is subject to manufacturing tolerances with regard to the spatial arrangement of the instantiated optical security features, these manufacturing tolerances being included in the determination of the overlapping or adjacent areas that cannot be resolved spatially by the optical reading device.

4. The method according to any one of the preceding claims, wherein the types of optical security features in the database are each assigned a verification error rate when checking for validity by the optical reading device if the relevant security feature occurs sporadically, and with a calculation of an overall verification error rate for the layout design and/or or the resulting corrected draft layout.

5. The method according to any one of the preceding claims, wherein the channels are selected from the group formed by frequency channels, tilt angles, excitation wavelengths, color impressions, optical resolution and combinations thereof.

6. The method according to any one of the preceding claims, wherein the optical security features are selected from the group formed by guilloches, micro-writing, metameric systems, imprints with fluorescence, phosphorescence and / or up-conversion colors, imprints with infrared Color, barcodes, in particular one- or two-dimensional barcodes, optically variable colors, transparent or reflective holograms or kinegrams, watermarks, in particular digital watermarks that carry machine-readable information, register printing elements, in particular see-through registers, see-through windows, mottled fibers, security threads, micro-perforations and their combinations.

7. The method as claimed in one of the preceding claims, comprising an optimization of the document template, preferably with the aid of an optimization algorithm using an ROC curve or a performance curve, taking manufacturing tolerances into account.

8. The method as claimed in claim 7, comprising a placement and scaling of security features to which multivariate, separate channels are assigned, preferably with a combination of the excitation wavelength and color impression channels, in order to optimize the document template.

9. The method according to any one of the preceding claims, further comprising producing the value or security document using the electronic document template.

10. Electronic document template for a value or security document, generated with a method according to any one of the preceding claims.

11. value or security document, produced using a document template according to claim 10.

12. Valuable or security document (401) according to claim 10, having an integrated electronic circuit (402) and an electronic memory (403) for storing data requiring protection and means (404) for executing a cryptographic protocol, and having an interface (405 ) to a data reader (406), which enables the data reader to access the data requiring protection after the cryptographic protocol has been executed.

13. value or security document according to claim 12, wherein the execution of the cryptographic protocol is only possible using an optical security feature of this document.

14. Electronic design system for document templates with a processor and a memory device in which a computer program is stored, the execution of which by the processor causes a method according to one of claims 1 to 9 to be carried out.

15. Production system for value or security documents according to one of claims 11 to 13 with an electronic design system according to claim 14, having a printing system for value or security printing and/or a personalization system for personalizing document blanks for producing the value or security documents.