GB2626208A

GB2626208A - A method of authenticating an optically readable security element

Info

Publication number: GB2626208A
Application number: GB2309990.6A
Authority: GB
Inventors: Campos De Lima Abreu Daniel; Ian Howarth David; Speed Phillip; James Young Robert
Original assignee: Quantum Base Ltd
Current assignee: Quantum Base Ltd
Priority date: 2023-06-30
Filing date: 2023-06-30
Publication date: 2024-07-17
Also published as: WO2025003674A1; GB202309990D0

Abstract

There is described a method of authenticating an optically readable security element 20 (e.g. a hologram, bar code or QR code) using an image capturing device 10 (e.g. a smartphone). The method comprises illuminating (S1) the security element with electromagnetic radiation and reading (S2) the security element based on its response to the illumination. At least one of the illuminating and the reading is non-deterministic (random) in nature. The frequency, wavelength or intensity of the illumination could be non-deterministic, in that it could be varied in an apparently random manner (Figure 3B). If a random illumination pattern has been used before it could be avoided in future readings. The aim of the invention is to mitigate the risk of replay or simulation attacks.

Description

A METHOD OF AUTHENTICATING AN OPTICALLY READABLE SECURITY

ELEMENT

TECHNICAL FIELD

The present disclosure relates to a method of authenticating an optically readable security element using an image capturing device, an image capturing device configured to illuminate an optically readable security element and a system comprising an optically readable security element and an image capturing device.

BACKGROUND

Security elements or tags are used to provided security in relation to an object to which they are attached. These security elements provide security in relation to the object by labelling the object. For example, a security element may be encoded with a unique identity that can be extracted from the security element, thereby enabling authentication of the object.

However, reading of the security element is conventionally performed in a predefined and repeatable manner. As a result, the security element or tag is vulnerable to, for example, replay or simulation attacks. Predefined and repeatable reading may also promote systematic errors.

Hence, there is a desire to provide a method of authenticating an optically readable security element that mitigates the risk of replay or simulation attacks.

SUM MARY

It is one aim of the present disclosure, amongst others, to provide a method of authenticating an optically readable security element which at least partially obviates or mitigates at least some of the disadvantages of the prior art, whether identified herein or elsewhere, or to provide an alternative approach. For instance, it is an aim of embodiments of the invention to provide a method of authenticating an optically readable security element that mitigates the risk of replay or simulation attacks.

According to the present invention there is provided a method of authenticating an optically readable security element, as set forth in the appended claims. Other features of the invention will be apparent from the dependent claims and the description that follows.

According to a first aspect, there is provided a method of authenticating an optically readable security element using an image capturing device. The method comprises illuminating the optically readable security element with electromagnetic radiation and reading the optically readable security element based on a response of the optically readable security element to the illuminating. At least one of the illuminating and the reading is non-deterministic.

Illuminating the optically readable security element with electromagnetic radiation may comprise illuminating the optically readable security element with a sequence of the electromagnetic radiation.

An optical property of the electromagnetic radiation may be non-deterministic.

The optical property may be at least one of: frequency, wavelength, polarisation and intensity.

The sequence may be non-deterministic. The electromagnetic radiation may be pulsed The optically readable security element may comprise one or more optical emitters arranged to be read via emission radiation emitted therefrom and arranged to be excited by excitation radiation, and reading the optically readable security element may comprise reading the optically readable security element via the emission radiation emitted therefrom in response to the illuminating. The illuminating may be performed by the image capturing device.

The method may comprise monitoring whether the at least one of the illuminating and the reading corresponds has been used before and, in the event that the at least one of the illuminating and the reading has been used before, changing the at least one the illuminating and the reading.

The at least one of illuminating and reading non-deterministically may comprise changing at least one of a relative position of the image capturing device with respect to the optically reading security element, a relative orientation of the image capturing device with respect to the optically readable security element, a filter for filtering the illuminating or reading of the image capturing device, a strain applied to the optically readable security element and a duration of the illuminating.

The method may further comprise fitting a trend to the response of the optically readable security element to the illuminating or reading and removing systematic error based on the trend.

The method may further comprise extracting an identity from the optically readable security element based on the response of the optically readable security element to the illuminating.

Extracting the identity may comprise retrieving an expected response from a data store and comparing the expected response with the response of the optically readable security element to the illuminating.

The method may further comprise generating at least one of the illuminating and the reading based on the output of a non-deterministic source.

According to a second aspect, there is provided an image capturing device configured to illuminate an optically readable security element with electromagnetic radiation and read the optically readable security element based on a response of the optically readable security element to the illuminating. The image capturing device is arrangeable such that at least one of the illuminating and the reading is non-deterministic.

According to a third aspect, there is provided a system comprising an optically readable security element and an image capturing device. The image capturing device is configured to illuminate the optically readable security element with electromagnetic radiation and read the optically readable security element based on a response of the optically readable security element to the illuminating. At least one of the illuminating and the reading is non-deterministic.

BRIEF DESCRIPTION OF DRAWINGS

For a better understanding of the invention, and to show how embodiments of the same may be brought into effect, reference will be made, by way of example only, to the accompanying Figures, in which: Figure 1 shows a flowchart for a method of reading an optically readable security element using an image capturing device; Figure 2 shows an image capturing device and an optically readable security element in a field of view of the image capturing device; Figures 3A and 3B show deterministic illuminating and non-deterministic illuminating; 30 and Figure 4 shows components of the image capturing device of Figure 2. DETAILED DESCRIPTION Figure 1 shows a flowchart for a method of authenticating an optically readable security element using an image capturing device. The method of Figure 2 is best understood in conjunction with Figure 2, which shows a system comprising an image capturing device 10 and an optically readable security element 20, the optically readable security element 20 being a field of view 30 of the image capturing device 10.

The method comprises illuminating Si the optically readable security element 20 with electromagnetic radiation. The electromagnetic radiation may be light in the visible spectrum or infrared light, for example.

Illuminating Si the optically readable security element 20 with electromagnetic radiation may comprise illuminating the optically readable security element 20 with a sequence of the electromagnetic radiation (i.e., a series of discrete events during which the optically readable security element 20 is illuminated). For example, the optically readable security element 20 may be illuminated with a first intensity of electromagnetic radiation for a first period followed by a second intensity of electromagnetic radiation for a second period. The first intensity and the second intensity may be the same or different intensities, and the first period and the second period may be the same or different lengths of time.

The method also comprises reading S2 the optically readable security 20 element based on an optical response of the optically readable security element 20 to the illuminating Si. The optical response may be specular reflection or emission of light, for instance, depending on the particular optically readable security element 20 used. Reading Si may be performed using sensors, such as image or video sensors (e.g., those typically included in image capturing devices, such as a camera). By optically challenging (i.e., illuminating Si) the optically readable security element 20 to stimulate the response, the optically readable security element 20 is read.

As part of the reading S2, for example, the method may comprise extracting an identity from the optically readable security element 20. Specifically, the identity may be extracted from the response by the image capturing device 10, as described in more detail below in relation to the data store. Advantageously, extracting the identity enables the optically readable security element 20, and hence an object to which the optically readable security element 20 may be attached or proximal, to be authenticated.

Importantly, at least one of the illuminating Si and the reading S2 is non-deterministic. In existing (prior) approaches a challenge, for example, is deliberately predictable and deliberately a repeatable (i.e., the same challenge as used previously). This approach introduces a weakness in the method or system. In contrast, non-deterministic illuminating Si and/or reading 32 introduces deliberate unpredictability and/or deliberate unrepeatability. In other words, the illuminating Si and/or reading S2, advantageously, is not able to be definitely ascertained, calculated or identified by an external or third party.

Illuminating Si and/or reading 32 may be implemented using the output of a non-deterministic source (e.g., an algorithm or piece of hardware), whereby the output is not known and is probabilistic. In other words, the output of the non-deterministic source may be used to generate non-deterministic illuminating Si and/or reading S2.

Preferably, illuminating Si and/or reading S2 non-deterministically is implemented using a random number generator (RNG). Details of RNGs are not provided here, as RNGs are well-known across a number of technical fields. Advantageously, non-deterministic illuminating Si and/or reading S2 makes fraudulent attempts to authenticate the optically readable security element 20 more difficult and so increases the security of an object to which the optically readable security element 20 may be attached or proximal. For example, even if someone trying to circumvent security has access to input-output (challenge-response) characteristics or pairs, they would not know or be able to predict a non-deterministic order or sequence of such input-output (challenge-response) characteristics or pairs. This non-deterministic approach brings subtle but significant benefits.

This non-deterministic approach can be understood through Figures 3A and 3B. In each of Figures 3A and 3B, the abscissa corresponds to time and the ordinate corresponds to intensity of illumination of the optically readable security element 20.

Figures 3A shows how, conventionally, in illuminating Si the optically readable security element 20 with a sequence of electromagnetic radiation, the intensity of successive events monotonically (i.e., deterministically) changes. Figure 3A shows the illumination profile for continuous illumination. Illuminating Si as shown in Figures 3A is straightforward to replicate, meaning that the optically readable security element 20 is vulnerable to replay attacks.

Figure 3B shows an example of non-deterministic illuminating Si. The illumination profile shown in Figure 3B includes a pulsed sequence of electromagnetic radiation which does increase or decrease monotonically, for instance. Rather the sequence in Figure 3B comprises unpredictable random intensities. Therefore, the sequence is, advantageously, more difficult for a nefarious party to replicate. Further, advantageously, environmental changes during the illuminating Si are mitigated against by varying the intensity randomly in time (i.e., if there is a drift in environmental conditions the drift will be averaged out).The RNG may be part of the image capturing device 10 or part of an external apparatus (e.g., a server) in electronic communication with the image capturing device 10, in the latter case, advantageously, facilitating a compact image capturing device 10. For example, non-deterministically illuminating Si the optically readable security element 20 may mean optically challenging the optically readable security element 20 based on a request transmitted (either internally, or externally to the external apparatus) by the image capturing device 10 including a set of parameters defining the illuminating Si and/or reading S2.

In an example of illuminating Si non-deterministically, a duration or period of time (e.g., one or more of a duration of the first period, a duration of the second period, a duration of a time between the first period and the second period and a duration of a total illumination time) of the illuminating Si is performed may be non-deterministic.

Illuminating Si the optically readable security element non-deterministically may also be realised by an optical property of the electromagnetic radiation, such as one or more of frequency, wavelength, polarisation and intensity (as shown in the example of Figure 3C), being non-deterministic. For instance, a wavelength of the electromagnetic radiation used to illuminate the optically readable security element 20 may be non-deterministic. Advantageously, illuminating Si non-deterministically is difficult for an observer to discern and, therefore, replicate.

In an example of reading 52 non-deterministically, a position of the image capturing device 10 during the reading S2 may be non-deterministic. For instance, a view finder of the image capturing device 10 may non-deterministically guide a user to position the image capturing device 10. In other words, a user may be prompted to change the relative configuration (i.e., position and/or orientation) of the image capturing device 10 and the optically readable security element 20. In another example, the time after the illuminating 51 when the reading S2 takes place may be non-deterministic. Advantageously, reading S2 non-deterministically is typically less expensive energetically compared with illuminating Si non-deterministically.

At least one of the illuminating Si and the reading S2 being non-deterministic may also be realised by changing a filter. For example, non-deterministically changing the filter of the image capturing device 10 may cause an electromagnetic field, resulting from the electromagnetic radiation, across the image capturing device to change. Similarly, at least one of the illuminating Si and the reading S2 being non-deterministic may be realised by changing a strain applied to the optically readable security element 20 or a temperature across the image capturing device 10. For example, a user may be prompted to strain (e.g., flex) the optically readable security element 20 to different extents or a temperature control device (e.g., a heater) may heat the optically readable security element 20 to different extents, thereby changing a property of the optically readable security element 20 that determines its response to illuminating Si.

The electromagnetic radiation may be pulsed, as mentioned above in relation to Figure 3B. In other words, during illuminating Si the optically readable security element 20, the electromagnetic radiation may be modulated or emitted in short bursts.

Advantageously, pulsed electromagnetic radiation avoids overheating of the optically readable security element 20. Varying the duty cycle of pulsed electromagnetic radiation and/or the response during the "off" period may be used to normalise the response to account for changes in environmental conditions.

The optically readable security element 20 may comprise a hologram, bar code, OR code or similar. Preferably, the optically readable security element 20 comprises one or more optical emitters. The optical emitters may be arranged to be read via emission radiation emitted therefrom and arranged to be excited by excitation radiation. As alluded to above, the excitation radiation may be provided, for example as part of the illuminating Si, by the image capturing device 10. Thus, reading S2 the optically readable security element 20 may comprise reading 52 the optically readable security element 20 via the emission radiation emitted therefrom in response to the illuminating Si.

The one or more emitters may serve as the component that provides or serves as the identity. Advantageously, the optically readable security element 20 being read via emission emitted therefrom provides a more robust barrier to fraudulent reading, more readily preventing spoofing or copying by, for instance, simply replicating (e.g., by printing) a bar code, OR code or similar. This advantage is particularly true when one or more (e.g., hundreds, thousands or millions or more) of emitters are distributed randomly. For instance, this effect may be achieved using quantum dots, flakes of 2D materials, (e.g., small) molecules, atomic defects or vacancies, plasmonic structures or similar.

The image capturing device 10 may be a terminal device, such as a smartphone. The image capturing device 10 may be configured to emit excitation radiation to excite the at least one optical emitter (e.g., from an electromagnetic radiation source, such as a

B

flash or LED). By being configured to emit excitation radiation, the image capturing device 10, advantageously, facilitates the aforementioned robust security. Further, emitting the excitation radiation from the image capturing device 10, advantageously, allows convenient control of excitation of the at least one optical emitter The system shown in Figure 2 may comprise a data store. The data store may be part of the image capturing device 10 or remote from the image capturing device 10 but in electronic communication therewith. Advantageously, the data store being remote from the image capturing device 10 facilitates a compact image capturing device 10. In one example, the optically readable security element 20 comprises a hologram, bar code, OR code or similar, and such engineered components may comprise information relating to the expected response. In other words, the data store may be part of the optically readable security element 20 in the form of an engineered component.

The data store stores an expected response for a given non-deterministic illuminating and/or reading S2. For instance, in the case of the optically readable security element 20 comprising optical emitters, illuminating Si the optically readable security element with electromagnetic radiation of a particular wavelength results in a particular optical response (e.g., wavelength of light emitted by the optically readable security element 20). This optical response can be compared with an expected optical response retrieved from the data store. Resultingly and advantageously, the authenticity of the optically readable security element 20 may be verified. In another example, reading S2 the optically readable security element 20 at particular relative configuration of the image capturing device 10 and the optically readable security element 20 results in a particular intensity of an optical response from the optically readable security element. By comparing this intensity with an expected intensity, the authenticity of the optically readable security element 20 can be verified. The identity comprises all expected responses (for different non-deterministic illuminating Si and/or reading S2), and the optically readable security element 20 can be authenticated using one of these expected responses by which the optically readable security element 20 is identifiable as authentic.

The response of the optically readable security element may be verified as authentic if the response is within a predetermined range of the expected response (e.g., within 95% of the expected response). Advantageously, in this way, false positives may be avoided while maintaining practicality.

The method may further comprise monitoring whether the at least one of the non-deterministic illuminating Si and the reading 32 has been used before. To this end, the method may comprise storing parameters defining each previous illuminating Si and/or reading 32 used in the data store and comparing parameters defining the (new, e.g., proposed) illuminating Si and/or reading 32 therewith. In the event that the at least one of the illuminating Si and the reading 32 has been used before, the illuminating Si and/or the reading 32 may be changed (i.e., not used). In other words, the illuminating Si and/or reading S2 may be implemented using previously unused (i.e., unique) parameters. Unique illuminating Si and/or reading S2, advantageously, is more secure than mere non-deterministic illuminating Si and/or reading 32 because of its inherent resistance to replay attacks.

The method may further comprise fitting an expected trend to the response of the optically readable security element 20 to the illuminating Si or reading S2 and removing systematic error based on the expected trend. By removing systematic error, advantageously, greater accuracy of authentication of the optically readable security element 20 may be achieved. The data store may store the expected trend, the expected trend having been previously determined according on the physics of the system or based on measurements in a controlled environment. By applying a fitting function to the distribution of the response (e.g., a linear or an exponential function), small deviations (e.g., those caused by environmental changes) from the expected trend are smoothed out.

Figure 4 shows the image capturing device 10 of Figure 2 in more detail. The illuminating Si of the optically readable security element 20 is performed by an illumination unit 11. The reading 32 of the optically readable security element 20 is performed by a reader 20, which could include or be a sensor as discussed above. As discussed above, the image capturing device may include an RNG and/or a data store. In the case of the image capturing device 10 not comprising the RNG and the data store, the image capturing device may include a communication unit to communicate therewith. The image capturing device 10 may comprise a controller or processor to control the image capturing device 10, either alone or in combination with a server in electronic communication with the controller.

In summary, the present disclosure has described a method and system that hinders a nefarious party from simulating a response of an optically readable security 20 element by non-deterministic illuminating Si and/or reading 32 in order to authenticate the optically readable security element 20.

Although preferred embodiments have been shown and described, it will be appreciated by those skilled in the art that various changes and modifications might be made without departing from the scope of the invention, as defined in the appended claims and as described above.

The optional features set out herein may be used either individually or in combination with each other where appropriate and particularly in the combinations as set out in the accompanying claims. The optional features for each aspect or exemplary embodiment of the invention, as set out herein are also applicable to all other aspects or exemplary embodiments of the invention, where appropriate. In other words, the skilled person reading this specification should consider the optional features for each aspect or exemplary embodiment of the invention as interchangeable and combinable between different aspects and exemplary embodiments.

Claims

CLAIMS1. A method of authenticating an optically readable security element using an image capturing device, the method comprising: illuminating the optically readable security element with electromagnetic radiation; and reading the optically readable security element based on a response of the optically readable security element to the illuminating, wherein at least one of the illuminating and the reading is non-deterministic.
2. The method of claim 1, wherein illuminating the optically readable security element with electromagnetic radiation comprises: illuminating the optically readable security element with a sequence of the electromagnetic radiation.
3. The method of claim 1 or 2, wherein an optical property of the electromagnetic radiation is non-deterministic.
4. The method of claim 3, wherein the optical property is at least one of: frequency, wavelength, polarisation and intensity.
5. The method of any of claims 2 to 4, wherein the sequence is non-deterministic.
6. The method of any preceding claim, wherein the electromagnetic radiation is pulsed.
7. The method of any preceding claim, wherein the optically readable security element comprises one or more optical emitters arranged to be read via emission radiation emitted therefrom and arranged to be excited by excitation radiation, and wherein reading the optically readable security element comprises: reading the optically readable security element via the emission radiation emitted therefrom in response to the illuminating, optionally wherein the illuminating is performed by the image capturing device.
8. The method of any preceding claim, further comprising: monitoring whether the at least one of the illuminating and the reading has been used before, and in the event that the at least one of the illuminating and the reading has been used before, changing the at least one the illuminating and the reading.
9. The method of any preceding claim, wherein the at least one of illuminating and reading non-deterministically comprises: changing at least one of a relative position of the image capturing device with respect to the optically reading security element, a relative orientation of the image capturing device with respect to the optically readable security element, a filter for filtering the illuminating or reading of the image capturing device, a strain applied to the optically readable security element and a duration of the illuminating.
10. The method of any preceding claim, further comprising: fitting a trend to the response of the optically readable security element to the illuminating or reading; and removing systematic error based on the trend.
11. The method of any preceding claim, further comprising: extracting an identity from the optically readable security element based on the response of the optically readable security element to the illuminating.
12. The method of claim 11, wherein extracting the identity comprises: retrieving an expected response from a data store; and comparing the expected response with the response of the optically readable security element to the illuminating.
13. The method of any preceding claim, further comprising: generating at least one of the illuminating and the reading based on the output of a non-deterministic source.
14. An image capturing device configured to illuminate an optically readable security element with electromagnetic radiation and read the optically readable security element based on a response of the optically readable security element to the illuminating, wherein the image capturing device is arrangeable such that at least one of the illuminating and the reading is non-deterministic.
15. A system comprising: an optically readable security element; and an image capturing device configured to illuminate the optically readable security element with electromagnetic radiation and read the optically readable security element based on a response of the optically readable security element to the illuminating, wherein at least one of the illuminating and the reading is non-deterministic.