Methods and systems for preparing and performing an object authentication

A method of preparing a subsequent secured authentication of a physical object or group of physical objects (PO(s)) by a recipient (B, B′) thereof, the method comprising:

• determining location-invariant and time-invariant information relating specifically to said PO(s) and a random context data (RCD) indicating a random location and a random time;
• combining, to obtain a data set, according to a time-variant first predetermined combination scheme (CS3), said location-invariant and said time-invariant information relating to said PO(s) with said RCD;
• generating, an original hash value (Ho) by applying a cryptographic hash function to said obtained data set;
• signing said Ho with a digital signature;
• outputting, initialization data (IND) representing said Ho including said digital signature;
• storing or causing to be stored, said representation of said IND to a third data storage (DS3);
• and
• adding to said PO(s) a representation of a pointer indicating where said IND can be accessed in said DS3.

A system for preparing a subsequent secured authentication of a physical object or group of physical objects (PO(s)), the system comprising:

• a processor;
• and
• memory comprising instructions that when executed by the processor, cause the processor to:
• determine location-invariant and time-invariant information relating specifically to said PO(s) and a random context data (RCD) indicating a random location and a random time;
• combine, to obtain a data set, according to a time-variant first predetermined combination scheme (CS3), said location-invariant and said time-invariant information relating to said PO(s) with said RCD;
• generate, an original hash value (Ho) by applying a cryptographic hash function to said obtained data set;
• sign said Ho with a digital signature;
• output, initialization data (IND) representing said Ho including said digital signature;
• store or cause to be stored, said representation of said IND to a third data storage (DS3);
• and
• add to said PO(s) a representation of a pointer indicating where said IND can be accessed in the DS3.

A method of authenticating a physical object or group of physical objects (PO(s)), the method comprising:

• receiving and decrypting a secured start data package (SSDP) representing encrypted context data (CD) representing a location and a related time to recover said context data (CD);
• receiving or determining current context data (CCD) representing a current location of said PO(s) and a related current time;
• combining, according to a predetermined combination scheme (CS3), said CCD with said decrypted CD to thereby determine test context data (TCD), wherein said CS3 defines an inverse operation to a corresponding combination operation (CS1) previously used to generate said CD;
• accessing initialization data (IND) related to said PO(s) to recover an original hash value (Ho) being represented by said IND;
• the method further comprising one of the following processes a) to c):
• a) detecting by means of one or more sensors at least one discriminating characteristic (k) of said PO(s) to obtain respective identification data (IDDk) related to said k, said IDDk representing a presumed identity of said PO(s);
• and generating a test hash value (Ht) by application of a second predetermined cryptographic hash function (HF2) to a combination (Hc), according to a further predetermined combination scheme (CS2), of the said TCD and each of said IDDk and a time-invariant and location-invariant information (SN) identifying or being otherwise specifically related to the said PO(s);
• or
• b) detecting by means of one or more sensors at least one said k of said PO(s) to obtain said IDDk related to said k, said IDDk representing a presumed identity of said PO(s);
• applying a respective first predetermined cryptographic hash function (HF1,k) to said IDDk to obtain a respective initial hash value (Hik) related to said k;
• and generating said Ht by application of said HF2 to said Hc, according to said CS2, of said TCD and each of said Hik, and a time-invariant and location-invariant information identifying or being otherwise specifically related to the said physical object or group of physical objects;
• or
• c) generating said Ht by application of said HF2 to said TCD or to said Hc, according to said CS2, of said TCD and a time-invariant and location-invariant information identifying or being otherwise specifically related to the said physical object or group of physical objects;
• wherein for the respective one of the processes a) to c), said HF2 is equal to a corresponding cryptographic hash function previously used to determine said Ho represented by said IND, and wherein said CS2 is equal to a corresponding combination scheme previously used to determine said Ho represented by said IND;
• and
• the method further comprises:
• generating a first reading result (RR1) comprising:
• a representation of said Ht and a representation of said Ho, or
• a matching output indicating whether or not, according to at least one predetermined matching criterion, said Ht matches said Ho and thus indicates authenticity of the physical object or group of physical objects.

An object authentication system, comprising:

• a processor;
• and
• memory comprising instructions that when executed by the processor, cause the processor to:
• receive and decrypt a secured start data package (SSDP) representing encrypted context data (CD) representing a location and a related time to recover said context data (CD);
• receive or determine current context data (CCD) representing a current location of said PO(s) and a related current time;
• combine, according to a predetermined combination scheme (CS3), said CCD with said decrypted CD to thereby determine test context data (TCD), wherein said CS3 defines an inverse operation to a corresponding combination operation (CS1) previously used to generate said CD;
• access initialization data (IND) related to said PO(s) to recover an original hash value (Ho) being represented by said IND;
• said memory further comprising instructions that when executed by the processor, cause the processor to:
• a) detect by means of one or more sensors at least one discriminating characteristic (k) of said PO(s) to obtain respective identification data (IDDk) related to said k, said IDDk representing a presumed identity of said PO(s);
• and generating a test hash value (Ht) by application of a second predetermined cryptographic hash function (HF2) to a combination (Hc), according to a further predetermined combination scheme (CS2), of the said TCD and each of said IDDk and a time-invariant and location-invariant information (SN) identifying or being otherwise specifically related to the said PO(s);
• or
• b) detect by means of one or more sensors at least one said k of said PO(s) to obtain said IDDk related to said k, said IDDk representing a presumed identity of said PO(s);
• applying a respective first predetermined cryptographic hash function (HF1,k) to said IDDk to obtain a respective initial hash value (Hik) related to said k;
• and generating said Ht by application of said HF2 to said Hc, according to said CS2, of said TCD and each of said Hik, and a time-invariant and location-invariant information identifying or being otherwise specifically related to the said physical object or group of physical objects;
• or
• c) generate said Ht by application of said HF2 to said TCD or to said Hc, according to said CS2, of said TCD and a time-invariant and location-invariant information identifying or being otherwise specifically related to the said physical object or group of physical objects;
• wherein for the respective one of the processes a) to c), said HF2 is equal to a corresponding cryptographic hash function previously used to determine said Ho represented by said IND, and wherein said CS2 is equal to a corresponding combination scheme previously used to determine said Ho represented by said IND;
• and
• said memory further comprising instructions that when executed by the processor, cause the processor to:
• generate a first reading result (RR1) comprising:
• a representation of said Ht and a representation of said Ho, or
• a matching output indicating whether or not, according to at least one predetermined matching criterion, said Ht matches said Ho and thus indicates authenticity of the physical object or group of physical objects.

A non-transitory computer readable medium comprising instructions, which when executed on one or more processors of an object authentication system cause the one or more processors to:

• receive and decrypt a secured start data package (SSDP) representing encrypted context data (CD) representing a location and a related time to recover said context data (CD);
• receive or determine current context data (CCD) representing a current location of said PO(s) and a related current time;
• combine, according to a predetermined combination scheme (CS3), said CCD with said decrypted CD to thereby determine test context data (TCD), wherein said CS3 defines an inverse operation to a corresponding combination operation (CS1) previously used to generate said CD;
• access initialization data (IND) related to said PO(s) to recover an original hash value (Ho) being represented by said IND;
• said non-transitory computer readable medium further comprising instructions that when executed by the processor, cause the processor to:
• a) detect by means of one or more sensors at least one discriminating characteristic (k) of said PO(s) to obtain respective identification data (IDDk) related to said k, said IDDk representing a presumed identity of said PO(s);
• and generating a test hash value (Ht) by application of a second predetermined cryptographic hash function (HF2) to a combination (Hc), according to a further predetermined combination scheme (CS2), of the said TCD and each of said IDDk and a time-invariant and location-invariant information (SN) identifying or being otherwise specifically related to the said PO(s);
• or
• b) detect by means of one or more sensors at least one said k of said PO(s) to obtain said IDDk related to said k, said IDDk representing a presumed identity of said PO(s);
• applying a respective first predetermined cryptographic hash function (HF1,k) to said IDDk to obtain a respective initial hash value (Hik) related to said k;
• and generating said Ht by application of said HF2 to said Hc, according to said CS2, of said TCD and each of said Hik, and a time-invariant and location-invariant information identifying or being otherwise specifically related to the said physical object or group of physical objects;
• or
• c) generate said Ht by application of said HF2 to said TCD or to said Hc, according to said CS2, of said TCD and a time-invariant and location-invariant information identifying or being otherwise specifically related to the said physical object or group of physical objects;
• wherein for the respective one of the processes a) to c), said HF2 is equal to a corresponding cryptographic hash function previously used to determine said Ho represented by said IND, and wherein said CS2 is equal to a corresponding combination scheme previously used to determine said Ho represented by said IND;
• and
• said non-transitory computer readable medium further comprising instructions that when executed by the processor, cause the processor to:
• generate a first reading result (RR1) comprising:
• a representation of said Ht and a representation of said Ho, or
• a matching output indicating whether or not, according to at least one predetermined matching criterion, said Ht matches said Ho and thus indicates authenticity of the physical object or group of physical objects.

A method of securely providing a time-variant combination scheme (CS) for authenticating a physical object or group of physical objects (PO(s)), the method comprising:

• receiving and storing data representing said CS, a time and location-invariant information (SN) identifying or being otherwise specifically related to the said PO(s), and metadata (MD) defining a limited validity period of said CS;
• receiving a request for said CS and said SN from a requesting authentication system;
• authenticating the requesting authentication system;
• and
• if the requesting system is successfully authenticated as being authorized and according to said MD) corresponding to said CS and said SN to which said MD pertains is still valid, outputting data said CS and said SN over a data channel (T) being secured against interception to the requesting system;
• or
• otherwise, denying the request.

A system (TC) of securely providing a time-variant combination scheme (CS) for authenticating a physical object or group of physical objects (PO(s)), said TC comprising:

• a processor;
• and
• memory comprising instructions that when executed by the processor, cause the processor to:
• receive and store data representing said CS, a time and location-invariant information (SN) identifying or being otherwise specifically related to the said PO(s), and metadata (MD) defining a limited validity period of said CS;
• receive a request for said CS and said SN from a requesting authentication system;
• authenticate the requesting authentication system;
• and
• if the requesting system is successfully authenticated as being authorized and according to said MD) corresponding to said CS and said SN to which said MD pertains is still valid, output data said CS and said SN over a data channel (T) being secured against interception to the requesting system;
• or
• otherwise, deny the request.