WO2006100581A2 - System and method for the analysis of security strings to be associated to goods such as products or services - Google Patents

Abstract

A system for analyzing security codes or strings applied to goods, comprising means for generating a plurality of strings which can be associated uniquely with respective goods and means for applying each of the strings to the respective item of goods, wherein the system further comprises: a data bank (3), which stores the strings and, for each string, a description of the respective item of goods; a communications network (6); a Web server (4), which is connected to the communications network (6) and to the data bank (3); data communications means (1) for sending to the Web server (4), via the communications network (6), a request which comprises a string to be checked and receiving a data communications reply; the Web server (4) comprising a memory which stores instructions for checking whether the string to be checked matches a string of the plurality of strings stored at the data bank (3) and for sending to the data communications means (1) a data communications reply which contains the outcome of the check.

Description

SYSTEM AND METHOD FOR THE ANALYSIS OF SECURITY STRINGS TO BE ASSOCIATED TO GOODS SUCH AS PRODUCTS OR SERVICES Technical Field The present invention relates to a system and a method for the generation and associated management of security strings to be associated with goods such as products or services in general, in order to achieve protection and traceability of goods, products or services reliably and automatically. Background Art

In many fields of commerce, industry, design, manufacturing and entertainment, as well as in the field of documents, securities (checks, stamps, certificates, policies, et cetera) and in the production of goods or services, the need is increasingly felt for forgery prevention techniques intended to check the originality, authenticity and traceability of the product in order to avoid fraud, forgeries and illegal imports.

One of the systems used for this purpose is the application to the products, by way of various techniques, of a unique and typically progressive alphanumeric string on each goods, be it a product, a document or a service. These alphanumeric strings, which can be encrypted or not encrypted, can be printed for example on a ticket for a show or on a security seal applied to a product or to a certificate of guarantee of an item of clothing.

Unfortunately, even this solution has proved to be often inadequate and not definitive for today's true requirements. The forger can in fact duplicate illegally a document or a goods, and despite not having the algorithm for generating the alphanumeric strings, can resort to two stratagems: gain possession of a single item of goods, duplicate its string to reproduce in several copies the security string of the original, or imitate a string. In both cases, the forger achieves the intended aim, since it is virtually impossible, by simply looking at the string, to determine whether it is truly authentic. Disclosure of the Invention The aim of the present invention is to solve the above-mentioned drawback, by providing a method for the analysis and management of encrypted alphanumeric strings applied to goods in order to achieve their protection and traceability.

This aim and other objects are achieved by the method according to the invention, which comprises the steps of: a) generating a plurality of strings; b) associating uniquely each of the generated strings with a respective item of goods and storing at a data bank said strings, preferably together with a description of the respective item of goods; c) applying each of said strings to the respective item of goods; d) receiving from a data communications means of a user a request which comprises a string to be checked; e) checking, at a server which communicates with said data bank, whether said string to be checked matches a string which belongs to the plurality of strings stored at the data bank; f) sending to the user a data communications response, which contains a confirmation or error message, depending on the outcome of the check. The aim and objects of the invention are also achieved by a system for analyzing security codes or strings applied to goods, which comprises means for generating a plurality of strings which can be associated uniquely with respective goods, wherein the system further comprises:

- a data bank, which stores the strings and, preferably, a description of the respective item of goods for each string; - a Communications network;

- a server connected to the communications network and to the data bank;

- data Communications means for sending to the server, over the communications network, a request which comprises a string to be checked, and for receiving a data communications reply; the server comprising a memory, which stores instructions for checking whether the string to be checked matches a string which belongs to the plurality of strings stored at the data bank and means for sending a data communications reply which contains a confirmation or error message, depending on the outcome of the check.

In greater detail, the method provides for the generation of unique strings in a quantity which is sufficient to cover an entire batch of goods to be protected, for the subsequent storage of said strings in a data bank, and the possibility, for each string owner, to obtain information and checks exclusively for the amount of unique strings reserved for him.

Checking, i.e., the authenticity verification function intended to confirm the originality of one of the goods mentioned above, can be assigned by the owner of the strings to employees or third parties, for example to cooperatives for checking accesses to shows, to law- enforcement authorities, to the end consumer or user who wishes to check personally the originality of the product.

The string owner, or other requesting parties authorized by said owner, may further become aware of all access attempts related to a specific string on the part of authorized and unauthorized users, obtaining an objective tool for analysis, investigation and/or research.

Therefore, a coherent set of items of information, entered mainly by the manufacturer of the goods, is associated with a unique string. This information can be the characteristics of the item of goods declared by the manufacturer of said item of goods and can be information constituting the chain of responsibility over the item of goods, for example the set of authorizations that have carried the item of goods from the manufacturer to the distribution chain to the end user.

In this manner, by checking the string associated with a product, the user can check that said product matches the characteristics stated by the manufacturer and simultaneously that said product belongs to the batches actually manufactured and distributed according to a chain which is legitimate or authorized by the manufacturer or by his rightful claimant.

A string is guaranteed to be authentic first of all if it is identified and recognized and then if there is a match with the description of the item of goods attached to it and if the item of goods belongs the chain of responsibility from the manufacturer to the end user.

The method according to the invention preferably uses the following data communications means for sending the request for verification and for receiving the reply: personal computers, fixed or mobile telephones, handhelds and PDAs.

The queries and replies can take place via an Internet connection (via HTTP/HTTPS/SSL) or via WAP, via e-mail, via SMS messages, via voice command or by way of any other type of message that can be used by means of telephone or data-communications networks in general.

If the requesting party is the buyer/consumer of the end product, he/she may characterize the ownership of the product by registering additional data (personal data or others), preferably via said communications means. The server, which for the sake of convenience will be identified hereinafter as a Web server, comprises a memory which stores instructions for performing the method according to the invention. In particular, the Web server is adapted to receive the querying or data analysis requests received via the communications network and optionally suitable interfacing or gateway means. Preferably, the Web server is provided with a redundancy system, which ensures a duplication' of the strings and of the data so as to take over immediately, in case of problems affecting the main data bank, with a copy in so-called mirroring mode. The data bank is- adapted to store the generated strings and to authorize the reply of the system to the user depending on exclusive access privileges thereof by way of the available communications means. The data bank is associated preferably with means for automatic identification of the data communications address from which the verification request is being made, means for acquiring automatically the encrypted alphanumeric string provided by way of the communications means, and logging means, which are adapted to trace each authorized or unauthorized request in order to provide support for investigation.

During the query, the Web server allows access to the data bank preferably in order to: check and record whether the requesting party has the privileges required for the query and otherwise prevent access thereof; check whether the unique string being examined belongs to the data bank dedicated thereto and, if the code does not match, report this to the requesting party; log the number of requests made on each string, in order to be able to manage a progressive number which, if exceeded, may cause its locking and report to the requesting party any multiple requests to which it has been subjected.

Further, the requesting party can query a registry or log file in which all the access attempts made by authorized users are logged. Brief description of the drawings

Further characteristics' and advantages of the invention will become better apparent from the description of a preferred but not exclusive embodiment of the method according to the invention, illustrated by way of non-limiting example in the accompanying drawings, wherein: Figure 1 is a block diagram of a system for performing the method according to the invention;

Figure 2 is a flowchart of a method according to a preferred embodiment of the invention. Ways of carrying out the invention Hereinafter, the word "user" designates the person who requests information regarding a certain string or code; the word "client" is used to designate the company (for example the manufacturer) that requests analysis of the strings on its own products by means of the method according to the invention; and the word "provider" designates the party that offers the strings, the method according to the invention, and the associated services.

With reference to Figure 1, a system for providing the method according to the invention comprises data communications means 1, which are adapted to send a request for verification and to receive a corresponding reply, selected from a group which comprises a mobile telephone 11, a personal computer 12, a fixed telephone 13, or another similar device.

Each data communications means 11, 12, 13 is provided with one or more respective communications tools 2 for accessing at least one communications network 6 for the exchange of messages with a remote Web server 5. The communications network can comprise one or more among the

Internet, the GSM mobile network, and the PSTN fixed telephone network. Of course, any alternative communications network not listed here can be used in the present invention, provided that it is suitable to carry messages requesting verification and corresponding replies from the data communications means 1 to the remote server 5.

In particular, the communications tools 2 comprise an SMS message exchange tool 21, a program for exchanging electronic mail messages 22, an Internet browser 23, a voice communications tool 24, and a telephone tone communications tool 25. . . The SMS message exchange tool is commonly installed in all mobile telephones and can also be installed in personal computers provided with a card for communications over a mobile network and in some types of fixed telephone. By means of SMS messages it is possible to manually enter and send requests for verification and receive the corresponding replies. Another communications tool which can be used in the present invention is WAP navigation, also available in many mobile telephones.

However, if the data communications means 1 used by the user is the personal computer 12, it is preferable to use any Web browser. In this case, the requests for verification and the corresponding replies are transmitted over the Internet preferably via HTTP/HTTPS or SSL queries and by using suitable forms provided with fields which can be filled in by the user.

The system of Figure 2 further comprises an interface means or gateway 4, which is adapted to convert the request for verification received from the network 6 by the data communications means for the necessary checks within the Web server 5. The interface means is provided substantially by way of a software code in various programming languages and is preferably implemented in the Web server 5 in order to format the received strings, for example in order to check the length aiid integrity of the data item. The code in the gateway also determines the behavior to be used according to the privileges of the requesting party, for operations such as accepting the reply, increasing a counter used at the log file, notifying violations to the client, and so forth.

A data bank 3 is connected, or in any case is accessible via a communications network, to the Web server 5. The data bank 3 is installed in suitable memory means and comprises a table 31, which contains the list of the security strings divided by client (manufacturer) and by product category of the same client, preferably in progressive order, and is provided with a column providing totals and with a block column.

The data bank 3 further comprises a table 32 with the list of passwords or information regarding access privileges on the part of a client or user. Administrator privileges allow to choose the service to be provided to each client or string owner. Supervisor privileges are usually granted to the client, who can thus establish user management, the time period allowed for queries of the data bank 3 by a client, and the connection method that is allowed (Web, SMS, e-mail, touch-tone telephone, voice telephone). User privileges only allow to query the data bank 3.

In the data bank 3 there is also a table 33 which contains all the query events of the data bank, which is updated by the Web server 5.

Optionally, another table 34 contains personal data regarding the user or end buyer of the item of goods whose string has been reported to the Web server, in order to expose any receiving of stolen goods.

The database also includes respective tables which contain client details, provider details, details of recognized monitoring authorities (Financial Police, Office against Adulteration of Foodstuffs, inspectors, customs, et cetera), sets of enabled or non-expired codes, definitions of the service, associations between a set of codes and the corresponding product, the association between the description of a product and the distribution of a particular batch of strings, fields describing the product in various languages, associations among nation, telephone codes and preferred language. These tables are updated or generated dynamically depending on the specific customization required by the client and as a function of the services that he/she has requested.

The Web server 5. is also connected to means 51 for identifying automatically the data communications- address from which said communication is performed, means 53 for acquiring automatically the encrypted alphanumeric string supplied by means of said communication, and logging means 52, which are adapted to trace each authorized or unauthorized request entered in the log files while the transaction is in progress, in order to provide optional investigation support. Since all the means described so far can be implemented by means of hardware and software components which are known to the person skilled in the arts, their description will not be dwelt upon in detail.

Table 1, given below, summarizes possible paths from the query to the corres ondin re l b usin the means 1 2 4 and 5:

Table 1

Users can be provided with particular privileges by means of which they can perform checks in the data bank 3 via any data communications means 1 listed above or via dedicated channels.

The operation of the invention, illustrated with reference to an exemplifying and non-limiting embodiment, is as follows.

The provider generates a batch of codes or strings to be applied to an item of goods, starting from a progressive code which is preferably encrypted by means of an algorithm of the multiple DES (Data Encryption Standard) type. In the encryption process, two digits are inserted which contain a parity code and the length of the final encrypted code, which is not fixed.

The string can be purely numeric, so as to facilitate its entry by the user who uses a telephone-like keypad, or can contain alphanumeric characters in general and is divided preferably into four parts.

The first part has an information content which is sufficient to manage the size of the customer base: for example, in order to manage 9999 clients, three alphanumeric characters or four numeric characters are needed. The second part is intended to identify the type of product on which the string has been applied for each individual client: for example, in order to manage 999 different products per client, two alphanumeric characters or three numeric characters are needed.

The third part comprises a check digit in the calculation algorithm performed on the entire string and a numeral which identifies the algorithm used to generate the string. This part is intended to prevent a user or an ill- intentioned individual from obtaining positive replies from the system by keying a random sequence of symbols.

The fourth part contains the identification serial number of the string. It is unique and not repeatable and represents the uniqueness of the certificate, product or service to be verified. An example of some alphanumeric strings provided according to the system mentioned above is

Table 2

The client and the data associated therewith are therefore stored in the respective tables of the data bank 3, as indicated above.

The client uses the strings that the provider has generated and optionally printed, applying them directly to products, documents, certificates or services, so that a user can see them and use them for verification.

When a user purchases the item of goods provided with a security string, he/she can decide to check the authenticity of the product, the match of the product with its description, and the chain of responsibility from the manufacturer to the final consumer, by sending a request for verification to the Web server 5, via the communications means indicated in the information that accompanies the item of goods or available from the manufacturer. This information is also stored in the data bank 3, so that the user can send requests for verification and receive the corresponding replies only via the means of communication provided by the client. For example, said information can comprise a telephone number to which an SMS can be sent in order to request the verification.

In step 100, this request is sent to the Web server. In particular, the user sends a message requesting verification by way of his own data communications means 1 and the request is translated and routed, by way of the interface means 4, to the Web server 5 which is connected to the data bank 3. The request message contains the string as it appears on the purchased item of goods, which is a string to be checked.

In step 105, the Web server 5 receives the request and, via the identification means 51, the address of the requesting party is identified (step 1 10). For example, the (fixed or mobile) telephone number associated with the message, a unique number associated with the SIM installed in the mobile telephone of the user, or the e-mail address of the sender of the message or the data communications address from which the request is received via the Web browser 23, are extracted. Step 110 optionally checks whether the user is entitled to make the request via the logging means 52.

If no errors are found, step 115 logs the address of the requesting party in the log file together with the time of day when the request was received, optionally together with an indication as to the existence of an authorization to send a response to said address.

At the same time, the security string is acquired and decrypted by way of the means 53. Then the Web server 5 checks/verifies the string in step 125, comparing it with the contents of table 31, and logs the request in the corresponding log file. If the string does not exist, the request is considered denied (step

130), the statistics table at the data bank 3 is updated accordingly (attempt at forgery or input error), and a denial message is sent to the address of the user (step 135), preferably via the same means of communication 2 used during the request. In this case, the user who receives the denial message obtains a confirmation that the information that he expected (for example, the manufacturer, model, name of the shop where the product was purchased) does not match the purchased product.

Optionally, the procedure according to the invention entails that a verification having a negative outcome in steps 125, 130 and 135 is repeated a certain number of times, so as to give the user at least one other chance to enter an authorized string by sending him a suitable reply message. In this case, the final denial message is an alarm message and is sent to the user when said number of times for which the verification has a negative outcome is exceeded.

Otherwise, in step 140, the reply message is generated at the Web server 5 or at the data bank 3, confirming the existence of the code and optionally the description of the product associated with the specific code and supplied during registration to the service by the client or manufacturer. Optionally, the message can also contain information regarding the fact that checks on the requested string have already been performed, so that the user can draw the appropriate conclusions.

The description of the product is given in a default language and optionally in another language, which depends on the country-related information which can be obtained from the address of the calling user.

The data communications reply message is then sent to the user (step 145), preferably via the same communication means 2 used during the request, and the procedure ends (step 150).

It has thus been shown that the present method and system achieve the proposed aim and objects. In particular, it has been shown that the method and system described allow control with a high degree of security regarding the authenticity of the goods or services circulated by a manufacturer.

It is evident that numerous modifications are clear and can be performed promptly by the person skilled in the art without abandoning the scope of the protection of the appended claims. For example, it is obvious for the person skilled in the art to replace one communications network with an equivalent one, depending on the requirements of the players involved in the system and of the technology made available on the market. It is also evident that the inventive concept on which the present invention is based is independent of the actual implementation of the software modules, which can be provided in any language and on any hardware platform, and likewise the string generation method is non- limiting for the purposes of the invention. All the details may further be replaced with other technically equivalent ones.

Therefore, the scope of the protection of the claims must not be limited by the illustrations or by the preferred embodiments illustrated in the description as examples, but rather the claims must comprise all the characteristics of patentable novelty that reside within the present invention, including all the characteristics that would be treated as equivalent by the person skilled in the art.

The disclosures in Italian Patent Application No. TS2005A000005, from which this application claims priority, are incorporated herein by reference.

Claims

1. A method for analyzing security codes or strings applied to goods, comprising the steps of: a) generating a plurality of strings; b) associating uniquely each of said strings with a respective item of goods and storing said strings at a data bank; c) applying each of said strings to the respective item of goods; d) receiving from a data communications means of a user a request which comprises a string to be checked; e) checking, at a server which communicates with said data bank, whether said string to be checked matches a string of said plurality of strings stored at the data bank; f) sending a data communications message which contains the outcome of the check.

2. The method according to claim 1, wherein said confirmation message comprises a description of the respective item of goods associated uniquely with the string to be checked.

3. The method according to claim 1 , further comprising the steps of: g) if said string to be checked does not match a string of said plurality of strings, sending a data communications reply to the user which comprises a message requesting the communication of a new string to be checked; h) waiting for a request on the part of the data communications means of the user which, comprises a new string to be checked.

4. The method according to claim 3, comprising the step of repeating said steps g) and h) a preset number of times and if, at the end of said repetition step, said new string to be checked does not match a string of said plurality of strings, sending an alarm message to the user.

5. The method according to one or more of the preceding claims, wherein said step f) further, comprises the step of storing the reception of said request that has occurred in step d) in association with said string.

6. The method according to claim 1 or 5, further comprising the step of checking whether said steps d) and f) are repeated more than a certain number of times for a same string to be checked and, if so, generating an alarm message and sending it to the user or to a manufacturer of the item of goods associated with said string.

7. A system for analyzing security codes or strings applied to goods, comprising means for generating a plurality of strings which can be associated uniquely with respective goods and means for applying each of said strings to the respective goods, wherein said system further comprises:

- a data bank, which stores said strings and, for each one of said strings, a description of the respective goods;

- a communications network;

- a Web server connected to said communications network and said data bank;

- data communications means for sending to said Web server, via ^■ tf said communications network, a request which comprises a string to be checked and for receiving a data communications reply; said Web server comprising a memory which stores instructions for checking whether said string' to be checked matches a string of said plurality of strings stored at the data bank and for sending to said data communications means a data communications reply which contains the outcome of the check.

8. The system according to claim 7, wherein said memory of said Web server further comprises instructions for performing the method according to one or more of claims 2 to 6.

9. The system according to claim 7, wherein said Web server comprises, or is connected to, a gateway which is adapted to access said communications network.

10. The system according to claim 7, wherein said plurality of strings is stored in said data bank in a first table, which contains the list of strings divided by manufacturer of the item of goods and by product category of the same manufacturer, and a second table, which contains the respective descriptions of the goods associated with each one of said plurality of strings.

11. The system according to claim 10, wherein the data bank further comprises a table which comprises a list of passwords or information on the access privileges on the part of said manufacturer or said user via said data communications means.

12. The system according to one or more of claims 7 to 11, wherein the data bank further comprises a table which can be updated and contains all the query events of the data bank on the part of said user via said data communications means.

13. The system according to claim 7, wherein the data communications means are selected from a group which comprises a mobile telephone, a personal computer, or a fixed telephone.

■ 14. The system according to claim 7, wherein each data communications means , is provided with one or more respective communications tools for accessing said communications network in order to exchange messages with said Web server, said communications tools comprising an SMS message exchange tool, a program for the exchange of e-mail messages, an Internet browser, a voice communications tool, and a telephone tone communications tool.