RU2195021C1 - System of protective marking and document verification - Google Patents

Abstract

FIELD: marking and verifying genuineness of notarial, financial, right-establishing documents and securities. SUBSTANCE: given system includes protective marking subsystem and verification subsystem. Protective marking subsystem has unit 1 to input information, computer terminal 2, unit 3 deriving verifying fragments, unit 4 forming electron digital signature, secret key carrier 5, encoding unit 6, printing unit 7, marked document 8. Verification subsystem includes unit 9 reading and converting line code, extractor 10 of verifying information, unit 11 deriving electron digital signature, former 12 of open key, unit 13 verifying digital electron digital signature, comparator 14 and display 15. Thanks to new package of signs realizing cryptographic algorithm of formation and verification of electron digital signature high degree of protection of information presented in document is achieved. EFFECT: high degree of protection of information presented in document. 2 cl, 7 dwg

Description

 The invention relates to systems for marking and verification of objects and may find application in marking and authentication of notarial, financial, shipping, legal documents and securities.

 Known security document with a protective marking according to the patent of the Russian Federation 2149104, class. In 42 D 15/00, 2000, in which the marking comprises a plurality of holes that form the pattern on the document. The diameter of the holes is such that this pattern is essentially not visible in the reflected light to the naked eye, but is visible in transmitted light.

 With this marking, document identification is simplified, however, such marking has low resistance to counterfeiting.

 A well-known automated system for the manufacture and registration of driver's documents according to the patent of the Russian Federation 2128856, class. G 06 F 17/60, 1999, comprising a unit for forming an information insert of an identity card, a unit for receiving personal data, an operator console, a monitor, a printer.

 The disadvantage of this system is the limited scope, high technological complexity of obtaining identification features, as well as low reliability of identification of the authenticity of documents in the process of their use.

 Also known is an automated system for the preparation and submission of reports to regulatory authorities according to the patent of the Russian Federation 2154298, cl. G 06 F 17/60, 2000, containing a subsystem for preparing reporting documents, a subsystem for receiving and transmitting electronic documents, a subsystem for processing documents, a subsystem for a controlling body and a unit for generating results for receiving reporting documents.

 The specified system implements reliable confirmation of the authenticity and authorship of an electronic document. However, this system does not allow to identify the authenticity of the document on paper.

 Closest to the technical nature of the claimed is a system for verifying the authenticity of bearer documents according to British patent 2278002, cl. G 09 K 5/00, 1994, which is selected for the prototype. The known system includes a protective marking subsystem, including an information input unit, a computer terminal, printing equipment, a control fragment extraction unit, the input of which is connected to the second input of the printing equipment and connected to the output of the computer terminal, the input of which is connected to the output of the information input unit and subsystem verification, including a reading unit, a conversion unit, a comparison device and a display device, the output of which is connected to the output of the comparison device.

 The prototype system, in contrast to the previously considered analogues, allows you to mark and verify the authenticity of documents on paper.

 The disadvantage of the prototype system is the relatively low degree of protection against counterfeiting, due to the fact that in the prototype the conversion of important elements of the document into a bar code is performed without the use of cryptographic means of protection.

 With this marking, the document can be falsified or substituted, with the application of a modified bar code. Such a fake in the prototype system cannot be detected during document verification. Due to the fact that when forming a barcode they do not use unique (copyright) information - a secret key, the prototype also does not provide reliable confirmation of the marker.

 The technical result is the development of a system of protective marking and verification of documents, providing a higher degree of protection of documents from counterfeiting.

 To achieve the above technical result in a known system comprising a security marking subsystem including an information input unit, a computer terminal, printing equipment, a control fragment extraction unit, the input of which is connected to the second input of the printing equipment and connected to the output of the computer terminal, the input of which is connected with the output of the information input unit and the verification subsystem, including the reader and conversion unit, a comparison device and a display device, the input of which connected to the output of the comparison device, a secret key carrier, an electronic digital signature generation unit, an encoding unit, the input of which is connected to the output of the electronic digital signature generation unit, and the output of the encoding unit is connected to the first input of the printing equipment, the output of the unit is additionally introduced into the security marking subsystem selection of control fragments is connected to the first input of the electronic digital signature generation unit, the second input of which is connected to the output of the secret key carrier, and in the verification subsystem additionally introduced a control information extractor, an electronic digital signature extractor, an electronic digital signature verification unit and a public key generation unit, the input of which is connected to the input of the electronic digital signature extractor and to the input of the control information extractor and connected to the output of the barcode converter, the output of the generation unit the public key is connected to the first input of the electronic digital signature verification unit, the third input of which is connected to the first input of the oystva comparison and connected to the output control information extractor, in addition, output digital signature extractor is coupled to the second input of the digital signature verification, the output of which is connected to the second input of the comparator.

 The encoding block contains a public key medium and a bar code generator, the first input of which is connected to the output of the public key carrier, the second input of the bar code generator is the input of the encoding block, and the output of the bar code generator is the output of the encoding block.

 The public key generating unit comprises a public key allocator, a public key carrier and a mode switch, the first input of which is connected to the output of the public key allocator, the input of which is the input of the public key generating unit, the output of the public key carrier is connected to the second input of the mode switch, the output of which is the output public key generation unit.

 Thanks to the new combination of essential features that implement the cryptographic algorithm of electronic digital signature (EDS) and EDS authentication, a high degree of protection of the information displayed in the document is provided. Any modification or substitution in the document of at least one character of the protected information or bar code marking will be revealed during the authentication of the digital signature. In addition, the introduction of the secret key carrier and the public key generation unit allows for the verification of the document to uniquely identify the document marker.

 The analysis of the prior art made it possible to establish that analogues that are characterized by a combination of features that are identical to all the features of the claimed technical solution are absent, which indicates compliance of the claimed device with the patentability condition of "novelty".

 Search results for known solutions in this and related fields of technology in order to identify features that match the distinctive features of the claimed object from the prototype showed that they do not follow explicitly from the prior art. The prior art also did not reveal the popularity of the impact provided by the essential features of the claimed invention transformations to achieve the specified technical result. Therefore, the claimed invention meets the condition of patentability "inventive step".

The claimed system is illustrated by schemes:
figure 1 is a block diagram of the claimed system;
2 is a block diagram of a coding unit 6;
figure 3 is a block diagram of a block 12 for generating a public key;
4 is a two-dimensional bar code;
5 is a group of three bar codes;
6 is an example of marking all the information printed on the document;
7 is an example of marking individual fragments of a document;
The security marking and document verification system shown in FIG. 1, consists of a protective labeling subsystem and a verification subsystem. The security labeling subsystem includes an information input unit 1, a computer terminal 2, a control fragment extraction unit 3, an electronic digital signature (EDS) generating unit 4, a secret key carrier 5, an encoding unit 6, printing equipment 7, a marked document 8. Block 3 input the selection of control fragments is connected to the second input of the equipment 7 for printing and connected to the output of the computer terminal 2. The input of the computer terminal 2 is connected to the output of the information input unit 1. The input of the encoding unit 6 is connected to the output of the EDS forming unit 4, and the output of the encoding unit 6 is connected to the first input of the printing equipment 7. The output of the control fragment extraction block 3 is connected to the first input of the digital signature generation block 4, the second input of which is connected to the output of the secret key carrier 5. The marked document 8 comes from the output of the equipment 7 for printing, as shown by the dashed line with the arrow in figure 1. The information input unit 1 is the input of the system, and the output of the system is the display device 15.

 The verification subsystem includes a barcode reader and converter 9, a control information extractor 10, an EDS extractor 11, a public key generating unit 12, an EDS verification unit 13, a comparison device 14 and a display device 15, the input of which is connected to the output of the comparison device 14. The input of the public key generating unit 12 is connected to the input of the EDS allocator 11 and to the input of the control information extractor 10 and is connected to the output of the read and convert unit 9. The output of the public key generating unit 12 is connected to the first input of the digital signature verification unit 13, the third input of which is connected to the first input of the comparison device 14 and connected to the output of the control information extractor 10. The output of the EDS selector 11 is connected to the second input of the EDS check unit 13. The output of the block 13 check the digital signature is connected to the second input of the device 14 comparison. The marked document 8 enters the verification subsystem at the input of the reading and converting unit 9.

 Block 6 encoding (figure 2) contains the media 6.1 public key and the generator 6.2 barcode. The first input of the bar code generator 6.2 is connected to the output of the public key carrier 6.1. The second input of the barcode generator 6.2 is the input of the coding unit 6, and the output of the barcode generator 6.2 is the output of the coding unit 6.

 In FIG. 3 is a block diagram of a public key generating unit 12 comprising a public key allocator 12.1, a public key carrier 12.2, and a mode switch 12.3. The first input of the mode switch 12.3 is connected to the output of the public key allocator 12.1, the input of which is the input of the public key generation unit 12. The output of the public key medium 12.2 is connected to the second input of the mode switch 12.3, the output of which is the output of the public key generation unit 12.

 As the information input unit 1, a keyboard or a typical scanning device, which are components of a personal computer, can be used.

 Computer terminal 2 is designed to convert incoming information into digital form and is implemented in a computer programmatically based on a text editor or recognition program, for example FineReader.

 The formation of the digital signature in the security marking subsystem and the verification of the digital signature in the verification subsystem are carried out according to the standard cryptographic algorithm, for example, according to the standard GOST R 34.10-94, which allows both software and hardware implementation. In the case of a software implementation, the EDS generation unit 4 and the EDS verification unit 13 can be implemented using well-known cryptographic information protection software, for example, Verba-0, developed and commercially supplied by the Moscow branch of the Penza Research Institute or CryptonArcMail, developed and commercially supplied by ANKAD g Moscow, publ. in the book - Romanets Yu.V., Timofeev P.A., Shangin V.F. Information security in computer networks. M .: Radio and communications, 1999, p. 282.

 As the holder 5 of the secret key and the holders 6.1 and 12.1 of the public keys can be used smart cards (smart-cards), or flexible magnetic disks of a computer. The required amount of allocated memory for storing keys is at least two kilobytes.

 Block 6 coding converts information into a bar code, for example, into a two-dimensional bar code Micro PDF-417, the appearance of which is shown in Fig.4. This block is implemented in software, for example, using the Anex Tools for PDF 417 ("Anx 417") software module version 1.61, developed by Anex Technologies Inc., Canada.

 As the equipment 7 for printing, a laser printer can be used, for example, an HP LaserJet 1100 from HEWLETT PACKARD.

 As the reading and converting unit 9, a specialized reader can be used, for example, a Scanteam 3400 PDF / HD scanner, or Image Reader manufactured by WelchAllyn, for reading a two-dimensional bar code and converting it to digital form. The reading and converting unit 9 in the claimed system performs functions similar to the reading unit and the bar code conversion unit, made in the prototype as independent units.

 The extractor 10 of control information, the isolator 11 of the EDS and the block 13 of the verification of the EDS are implemented programmatically, on the basis of well-known software tools for cryptographic protection of information, for example, CryptonArcMail by AN-KAD or Verba-0 of the Penza Research Institute.

 The display device 15 is designed to display control information in a form convenient for visual reading (perception) by a person and may include a display and / or printer.

 The claimed system operates as follows.

 In order to protect documents and securities from fraud, a variety of security elements are currently used: watermarks, microprints, hard-to-reproduce printing patterns, etc. At the same time, the development of technology has led to the emergence of a large number of relatively inexpensive copiers that allow high copy the security elements with accuracy and creating a real threat of falsification of documents, securities, etc.

 The widely used system of notarization of documents also does not provide absolute reliability. The notary guarantees the accuracy of the information presented in the document only at the time of verification and does not exclude its falsification in the future. In addition, outside the notary's office, verification of a notarized document is not reliable, as it comes down to only visual inspection of the stamp and / or seal of the notary public, which can be relatively easily falsified.

 Documents are executed more and more often using computers. A document prepared in a text editor is printed on a printer. This makes it possible to use software tools for cryptographic information protection, including using the algorithm for generating and checking digital signatures to protect information applied to paper media.

 Certified means of cryptographic information protection guarantee absolute, 100% reliability of information security. The RF Law "On Information, Informatization and Information Protection" of February 25, 1995, 24-FZ, article 5 recognizes the legal force of a document confirmed by an electronic digital signature.

 The basis of the present invention is the creation of a system of protective labeling and verification of documents, which allows you to mark documents and with high reliability to confirm their authenticity and uniquely identify each of the markers.

 The claimed system of protective marking and verification of documents is presented in figure 1. The protective marking subsystem is installed at a notary's office, at a bank, at an enterprise or at any other issuer of documents and securities requiring protective marking.

 In the security marking subsystem, information is entered through the information input unit 1, by typing the alphanumeric text of the document on the keyboard, or by electronically scanning the document, for example using a Mustek ScanExpress 1200SP scanner. The conversion of information into digital form is carried out by a computer terminal 2 using a text editor, for example Word-2000, or a computer recognition program, for example FineReader. Information in digital form enters the course of block 3 of the selection of control fragments. The process of extracting control information in the form of control fragments and building block 3 are implemented in the same way as in the prototype. The number of allocated control fragments and the volume (size) of each of them depends on the type and volume of the document itself, as well as on the importance of the information displayed in it and on the required degree of its protection. So, in the extreme case, when protecting all the information, the control fragment is allocated one and contains all the information presented in the document. An example of such marking is illustrated in Fig.6.

 With a multi-page document, each page can be marked up to 1500-2000 characters. With lower requirements for the degree of protection, the amount and volume of each of the allocated control fragments can be reduced. At the same time, control fragments should not duplicate each other and should not overlap.

 In FIG. 7 shows an example of marking a payment order. Here, as control information, the most important fragments are selected, which are highlighted in bold italics for clarity. The control information is protected by an electronic digital signature and converted into a bar code.

 From the output of the control fragment extraction block 3, the control information is digitally transmitted to the first input of the digital signature generation block 4, where the digital signature is signed using the standard cryptographic algorithm using the secret key of the marker, coming from the output of the secret key carrier 5 to the second input of the digital signature generation block 4.

 The secretary (private) key is owned by the marker - a person authorized to sign or certify the protected document. In coding block 6, the control information and the corresponding EDS are converted into a two-dimensional bar code, for example, a code of type Micro PDF417.

 In the particular case, to simplify instrument verification of the document, the marker’s public key is included in the barcode. To this end, the coding unit 6 may include (Fig. 2) a public key carrier 6.1 and a bar code generator 6.2, which converts the control information to its second input and the EDS verification public key to its first input into a bar code . In this case, the software implementation of the bar code generator 6.2 allows you to get both a single bar code (Fig. 4) and a group of three bar codes with the display of control information, an electronic digital signature, and an electronic digital signature verification key, as shown in Fig. 5 . In order to simplify instrument verification, service text information in the form of additional inscriptions can be indicated next to the bar code. As an example, FIGS. 6 and 7 show official text information about the type of digital signature algorithm ("GOST R 34.10-94") and about the cryptographic information protection software used ("Cryptographic Data Protection System" of CID "CryptonArcMail").

 From the output of the coding unit 6, the generated bar code is fed to the first input of the equipment 7 for printing, the second input of which provides digital information from the output of the computer terminal 2.

 In equipment 7 for printing, a document is printed on paper with the simultaneous application of a protective marking in the form of a bar code on the latter. From the output of the printing equipment 7, the marked document 8 is received by the user, entered into economic or financial circulation, etc.

 The verification subsystem is installed at points of reception and processing of marked documents and allows you to confirm their authenticity.

 In the verification subsystem, the bar code is read from the marked document 8 and converted, the digital signature is authenticated and the control information is displayed in the display device 15 for visual comparison with the information printed on the document in the usual alphanumeric form.

 To do this, from the document received at the input of the verification subsystem, the bar code is read using the unit 9 for reading and converting and decoded in digital form. From the information received, control information is allocated (by a separator of 10 control information) and an EDS (by a separator of 11 EDS). EDS authentication is carried out in the EDS verification block 13 according to a standard algorithm, for example, according to the GOST R 34.10-94 standard using the public key received at the first input of the EDS verification block 13.

 The reliability of EDS authentication is determined by the cryptographic strength of the implemented algorithm and the length of the secret key, which can be 256, 512 or 1024 bits.

 If the digital signature is genuine, then a signal is input to the second input of the comparison device 14, allowing the output to the display device 15 and the subsequent visual comparison of the control information extracted from the bar code with the information depicted in the document in the usual alphanumeric form. The control information from the output of the comparison device 14 is fed to the input of the display device 15, where it is displayed on the display screen and / or printed on a printer in a form convenient for visual reading by a person. The coincidence of the control information with the information displayed in the document ensures its authenticity.

 The use of the secret key in the formation of the EDS and the corresponding public key during the verification of the EDS unambiguously confirms the marker, i.e. the authorship of the document executor or the person who signed (certified) the document.

 If the digital signature is not genuine, then, by the corresponding signal from the output of the electronic digital signature block 13, it is forbidden to compare the control information with the document, about which a corresponding message is displayed on the display device 15. Visual comparison is not carried out, a decision on the authenticity of the document is not taken.

 Clarification of the reasons that hinder the establishment of the authenticity of EDS is carried out by special organizational measures (investigative actions, graphological expertise, etc.), the implementation of which is beyond the scope of the claimed system.

 The public key generation unit 12 operates in one of the modes: extracting the public key from the bar code or entering the public key from the public key medium 12.2.

 The mode is selected by mode switch 12.3 by setting the corresponding option in the control program. With the hardware implementation of block 12.3, the mode is selected by the operator manually by turning on / off the corresponding switch.

 Depending on the selected mode, the output of block 12 receives a binary digital sequence of the public key from input 1 or signals from input 2 of the mode switch 12.3. This construction of block 12 provides verification of documents, regardless of the presence or absence of the public key of the marker in the barcode.

 The verification subsystem can also be installed together with the protective marking subsystem and function with the issuer (document executor), for example, to control the correctness of the protective marking and the possibility of verification of the marked document 8.

 The security marking subsystem can be configured to process a specific type of document.

 Marker public keys are distributed through public channels, including public networks, for which special public key distribution services can be created to guarantee their authenticity. The process of communicating to users information about the public keys of electronic signature verification through specially organized services is mainly organizational in nature and is not considered in the claimed system.

 A technical solution similar to the claimed system was tested on a test bench, which confirmed the possibility of creating an effective system of protective marking and verification of documents.

Claims (3)

 1. A security marking and document verification system comprising a security marking subsystem including an information input unit, a computer terminal, printing equipment, a control fragment extraction unit, the input of which is connected to the second input of the printing equipment and connected to the output of the computer terminal, the input of which is connected with the output of the information input unit, and a verification subsystem including a reader and conversion unit, a comparison device and a display device, the input of which is connected to the output of comparison device, characterized in that the secret key carrier, an electronic digital signature generation unit, an encoding unit, the input of which is connected to the output of the electronic digital signature generation unit, and the output of the encoding unit are connected to the first input of the printing equipment are added to the security marking subsystem, the output the control fragment extraction unit is connected to the first input of the electronic digital signature generation unit, the second input of which is connected to the output of the secret key carrier, and the verification subsystem additionally introduced a control information extractor, an electronic digital signature extractor, an electronic digital signature verification unit and a public key generation unit, the input of which is connected to the input of the electronic digital signature extractor and to the input of the control information extractor and connected to the output of the reader and conversion unit, the output of the block generating a public key is connected to the first input of the electronic digital signature verification unit, the third input of which is connected to the first input the comparison device and is connected to the output of the extractor of control information, in addition, the output of the isolator of electronic digital signature is connected to the second input of the electronic digital signature verification unit, the output of which is connected to the second input of the comparison device.  2. The system according to claim 1, characterized in that the encoding unit comprises a public key carrier and a bar code generator, the first input of which is connected to the output of the public key carrier, the second input of the bar code generator is the input of the encoding unit, and the output of the bar code generator is the output block coding.  3. The system according to claim 1 or 2, characterized in that the public key generating unit comprises a public key allocator, a public key carrier and a mode switch, the first input of which is connected to the output of the public key allocator, the input of which is the input of the public key generating unit, output the public key carrier is connected to the second input of the mode switch, the output of which is the output of the public key generation unit.

Images