OA19921A - Digital file anti-forgery protection. - Google Patents

Abstract

The invention relates to securing of a digital file content against forgery and falsifying, and particularly of digital data relating to its belonging to a specific batch of digital files, while allowing offline or online checking of the authenticity of a secured digital file and conformity of its digital data with respect to that of a genuine original digital file.

Description

BACKGROUNDART

The problems of counterfeiting and tampering digital files are well known, serions, and growing. The example of falsifying data marked on an original digital 10 document such as a digital identity document or a digital version of a diploma is well known, and the concern is even worse if considering a digital copy of the original (possibly genuine) digital document. Simply keeping track of identifïers such as serial numbers, or even including some digital watermarks, is in general an insufficient response, because counterfeiters can easily copy such numbers or digital watermarks as well.

Ahto Buldas et al: Efficient Record-Level Keyless Signatures for Audit

Logs”, International Association for Cryptologie Research, vol. 20140718:122633, pages 113, July 15, 2014, discloses a log signing scheme that enables vérification of the integrity of the whole log, and présentation of any record, along with a compact proof that the record has not been altered since the log was signed, the log being an ordered sequence of blocks, 2 0 where each block in tum is an ordered sequence of records.

US 2012/125,997 Al discloses an approach that leverages public key infrastructure (PKI) digital signature and barcode technology in providing a passport that can be validated for authenticity and data integrity when in printed form. There is a barcoding tool that includes a data retrieving component; a data concatenating component;

a digital signature generating component; and a barcode generating component. Also, there is a barcode reading tool that includes reading the identity data and digital signature barcode symbols using a barcode reader; displaying the identity data and digital signature on a display device; verifying the digital signature; and displaying vérification results on a display device. One other drawback of most conventional methods for insuring the 3 0 authenticity of digital files, or securing their digital data, is that they tend to view files in isolation, even if they are members of a well-defined group such as a batch of digital documents for example. This ignores valuable authenticating information.

It is therefore an object of the invention to secure a digital file against forgery and falsifying of its associated data, and particularly of data relating to its belonging to a spécifie batch of digital files. It is also an object of the invention to allow offline checking of the authenticity of a digital file secured according to the invention and conformity of its digital data content with respect to that of a genuine digital file.

SUMMARY OF THE INVENTION

One aspect of the invention relates to a method of securing a given original digital file of a batch of a plurality of original digital files against forgery or tampering, each original digital file of the batch containing its own digital data, characterized by comprising 10 the steps of:

- for each original digital file of the batch, calculating by means of a one-way function an associated digital file signature of its digital data;

- calculating a reference aggregated digital signature corresponding to the batch of original digital files from ail the digital file signatures of the original digital files of the batch by 15 means of a one-way accumulator of said digital file signatures, and making available to a user the reference aggregated digital signature;

- determining a digital file vérification key corresponding to the digital file signature of said given original digital file by means of a partial one-way accumulator of the other digital file signatures used for calculating the reference aggregated digital signature, whereby a 2 0 candidate digital file signature corresponds to that of an original digital file of the batch only if the reference aggregated digital signature is retrieved from the one-way function of said candidate digital file signature and corresponding digital file vérification key; and - including in the given original digital file a corresponding machine readable digital security marking containing a représentation of its digital data and its corresponding 2 5 digital file vérification key, thereby obtaining a marked original digital file of which digital data are secured against forgery or tampering.

The reference aggregated digital signature associated with the batch of 3 0 original digital files may either be published in a media accessible to the user, or stored in a searchable aggregated signature database accessible to the user, or stored in a blockchain, or in a database secured by a blockchain, accessible to the user.

The marked original digital file further may include aggregated signature access data containing information sufficient to access to the reference aggregated digital signature corresponding to the batch of original digital files, said information being a link to an aggregated signature acquisition interface of, respectively, one of the following: - the media wherein the reference aggregated digital signature is published, the media being accessible to the user via said aggregated signature acquisition interface opérable to receive from the user an aggregated signature request containing digital data, or a digital signature of said digital data, obtained from a digital security marking of a marked original digital file, and send back a reference aggregated digital signature of associated batch;

- the searchable aggregated signature database wherein the reference aggregated digital signature is stored, the aggregated signature database being accessible to the user via said aggregated signature acquisition interface opérable to receive from the user an aggregated signature request containing digital data, or a digital signature of said digital data, obtained from a digital security marking of a marked original digital file, and send back a reference aggregated digital signature of associated batch;

- the blockchain, respectively the database secured by the blockchain, wherein the timestamped aggregated digital signature is stored, the blockchain, respectively the database secured by the blockchain, being accessible to the user via said aggregated signature acquisition interface opérable to receive from the user an aggregated signature request containing digital data, or a digital signature of said digital data, obtained from a digital security marking of a marked original digital file, and send back a reference aggregated digital signature of associated batch.

According to the invention, a virtual digital file may be counted as belonging to the batch of original digital files, said virtual digital file having corresponding virtual digital data, and an associated virtual digital file signature obtained by means of the one-way function of its virtual digital data, said virtual digital file being not real but only used for generating the associated virtual digital file signature from the corresponding virtual digital data; and the reference aggregated digital signature associated with said batch of original digital files being calculated from ali the digital file signatures of the original digital files of the batch, including the virtual digital file signature, by means of the one-way accumulator.

The one-way function may be a hash function and a digital file signature of an original digital file may be a sequence of a given plurality of bits of lower weights selected from the bits of a hash value of the corresponding digital data.

In the above method, additional digital data corresponding to the digital data associated with the marked original digital file may be stored in a searchable information database accessible to the user via an information database interface opérable to receive from the user an information request containing digital data, or corresponding digital file signature data, obtained from a digital security marking of a marked original digital file, and send back corresponding additional digital data.

Moreover, the digital data of the marked original digital file may include reference characteristic digital data CDD of a corresponding unique physical characteristic of an associated object or individual.

Another aspect of the invention relates to a method of verifying the authenticity of a digital file secured according to the above method, or the conformity of a copy of such secured digital file with respect to the original one, comprising the steps of, upon processing a test file being said digital file or said copy of the digital file by means of a processing unit connected to a memory:

- having stored in the memory the test file;

- reading a représentation of digital data and of a test file vérification key on a digital security marking in the stored test file, and extracting respectively corresponding digital data and test file vérification key from said read représentation;

- having stored in the memory a reference aggregated digital signature of a corresponding batch of digital files, and having programmed in the processing unit the one-way function and the one-way accumulator;

- verifying that the extracted digital data and test file vérification key indeed correspond to the stored reference aggregated digital signature by performing the steps of:

calculating a digital signature of the extracted digital data with the one-way function; calculating a candidate aggregated digital signature from the calculated digital signature of the extracted digital data and the extracted test file vérification key with the one-way accumulator; and checking that the obtained candidate aggregated digital signature matches the stored reference aggregated digital signature, whereby, in case said aggregated digital signatures match, the digital data of the test file are that of a genuine original digital file.

The vérification method, wherein the digital file is secured by storing the reference aggregated digital signature associated with batch of original digital files in a searchable aggregated signature database accessible to the user, and wherein the processing unit is further connected to a communication unit opérable to send and receive 10 back data via a communication link, may comprise the preliminary steps of:

- sending with the communication unit via the communication link a request to said aggregated signature database, and receiving back the reference aggregated digital signature associated with batch of original digital files; and

- storing the received aggregated digital signature in the memory.

In said vérification method, wherein the marked original digital file further includes aggregated signature access data containing information sufficient to access to the reference aggregated digital signature corresponding to the batch of original digital files, said information being a link to an aggregated signature acquisition interface, and wherein 20 the processing unit is further connected to a communication unit opérable to send and receive back data via a communication link, may comprise the preliminary steps of: - reading the aggregated signature access data included in the test file;

- sending with the communication unit via the communication link an aggregated signature request to said aggregated signature acquisition interface containing the digital data, or a 2 5 digital signature of said digital data, obtained from the digital security marking in the test file, and receiving back a corresponding reference aggregated digital signature of associated batch; and

- storing the received aggregated digital signature in the memory.

In the above vérification method, the original digital file may be secured with additional digital data stored in a searchable information database accessible to the user via an information database interface as explained above, and the processing unit may further be connected to communication means opérable to send to the information database interface an information request containing digital data, or corresponding digital file signature, obtained from the digital security marking in the test file, and receive back corresponding additional digital data.

Moreover, in the above vérification method, in case the digital data of the marked original digital file include reference characteristic digital data CDD of a corresponding unique physical characteristic of an associated object or individual, and the processing unit is connected to a sensor opérable to detect a unique physical characteristic of an associated object or individual, the processing unit being programmed to extract corresponding unique physical characteristic digital data from a détection signal received from the sensor, the processing unit may further hâve stored in the memory reference characteristic digital data CDD corresponding to said unique physical characteristic of the associated object or individual, and comprise the further steps of, upon viewing a subject being, respectively, said associated object or individual:

- detecting a unique characteristic of the subject and extracting corresponding candidate characteristic digital data CDD^c;

- comparing the obtained candidate characteristic digital data CDD^c with the stored reference characteristic digital data CDD; and

- in case the candidate characteristic digital data CDD^c is similar to the stored reference characteristic digital data CDD, within a given tolérance criterion, the subject is considered as genuine.

Another aspect of the invention relates to a marked digital file belonging to a batch of a plurality of original digital files and secured against forgery or tampering according to the above described securing method, wherein each original digital file of the batch has its own digital data, said batch having a corresponding reference aggregated digital signature, the marked digital file comprising a machine readable digital security marking including a représentation of its digital data and a corresponding digital file vérification key. Moreover, the digital data of the marked digital file may further include reference characteristic digital data CDD of a corresponding unique physical characteristic of an associated object or individual.

According to still another aspect, the invention relates to a system for verifying the authenticity of a marked original digital file secured according to the above mentioned securing method, or the conformity of a copy of such digital file with respect to the original one, comprising a processing unit with a memory, the memory storing a reference aggregated digital signature of a corresponding batch of digital files, and the oneway function and the one-way accumulator being programmed in the processing unit, the

System being opérable to:

- acquire a test file being said digital file or a copy of the digital file and store the acquired test file in the memory;

- read a représentation of digital data and of a test file vérification key on a digital security marking in the stored test file, and extract respectively corresponding digital data and test file vérification key from said read représentation;

- verify that the extracted digital data and test file vérification key indeed correspond to the stored reference aggregated digital signature by executing the steps, programmed in the processing unit, of:

calculating a digital signature of the extracted digital data with the one-way function; calculating a candidate aggregated digital signature from the calculated digital signature of the extracted digital data and the extracted test file vérification key with the one-way accumulator; and checking that the obtained candidate aggregated digital signature matches the stored reference aggregated digital signature, whereby, in case said aggregated digital signatures match, the digital data of the test file are that of a genuine original digital file and the System is opérable to deliver an indication that the digital data on the test file is that of a genuine original digital file.

Said system for verifying a digital file secured according to the above mentioned securing method, or the conformity of a copy of such digital file with respect to the original one, in case the digital data of the marked original digital file include reference characteristic digital data CDD of a corresponding unique physical characteristic of an associated object or individual, may further be equipped with a sensor connected to the processing unit and opérable to detect a unique physical characteristic of an associated object or individual, and the processing unit be programmed to extract corresponding characteristic digital data from a détection signal received from the sensor, the system having stored in the memory reference characteristic digital data CDD corresponding to said unique physical characteristic of the associated object or individual, the system being further opérable to:

- detect with the sensor a unique physical characteristic of a subject being said associated object or individual, and extract corresponding candidate characteristic digital data CDD^c;

- compare the obtained candidate characteristic digital data CDD^c with the stored reference characteristic digital data CDD; and

- in case the candidate characteristic digital data CDD^c is similar to the stored reference characteristic digital data CDD, within a given tolérance criterion, deliver an indication that the subject is considered as genuine.

The présent invention will be described more fully hereinafter with reference to the accompanying drawings in which prominent aspects and features of the invention are illustrated.

BRIEF DESCRIPTION OF THE DRAWINGS

Fig.l is a schematic view of a general concept of securing a batch of digital files according to the invention.

Fig.2A illustrâtes a secured digital biométrie passport as an example of digital biométrie identity document secured according to the invention.

Fig.2B illustrâtes a control of an individual having the secured digital biométrie passport of Fig.2A by an authorized officer.

Fig.3 illustrâtes a batch of components of an aircraft secured according to the invention.

DETAILED DESCRIPTION

The présent disclosure is here described in detail with reference to nonlimiting embodiments illustrated in the drawings.

Figure 1 illustrâtes a general concept of the invention relating to securing a batch of digital files and a method of computing an encoding of verifying information that may be associated with each digital file. Figure 1 illustrâtes a group or batch of digital files Ai,A₂ A₃,... containing a digital représentation of a machine readable security marking 110 (here illustrated by a 2D barcode). In what follows, the expression digital security marking 110” in fact means digital représentation of a machine readable security marking 110.

A batch of digital files might, for example, relate to a common manufacturing run, items delivered by a particular supplier, items made or shipped during a time period, a set of related images, a group of people, a flock or herd, or any other userdefined grouping of any objects for which digital file A, (having digital content Di) can be defined. Figure 1 also shows a virtual digital file A_v, which is an optional software construct that may be included to enable encoding of selected data. This is explained further below. By way of example only, virtual digital file A_v will be assumed to be included, and will be treated below, as other (real) digital files Ai, A₂ A₃,..., since it may be processed substantially in the same way (although it does not correspond to a real file, for example stored in a memory). Of course, a plurality of virtual digital files A_vl,A_v2, ...,A_vk can be used for encoding digital data and produce more robust digital signatures (see below).

For each digital file A_1#A₂ A₃,... A_v, respective digital data Di,D_2/D₃, ...,D_V are associated or extracted (or, in the case of virtual digital file A_v, created) using any appropriate method. This data might be some measure of physical characteristics, textual data such as completed form or product information, a serial number or other identifier, indications of content, a digital représentation of an image, or any other information that the System designer chooses to associate with a file. The digital data Di of a digital file Ai may be extracted from human readable représentation of data (e.g. alphanumeric data) by means of a reader capable to produce a corresponding digital data file. Further digital data can be associated with the extracted data to constitute the digital data Di contained in file Ai.

For the virtual digital file A_v, the associated digital data D_v may include, for example, a batch identification number, a (pseudo-) random number for the sake of increasing security by increasing data entropy, date and/or time information, etc. One other form of associated digital data might be indications of allowable or non-permissible operations rules, expiration dates, etc. In short, the digital data D_v may be anything that can be represented in digital form.

For each digital file, its respective digital data D!,D₂,D₃,...,D_V are preferably transformed mathematically in such a way that they are essentially concealed, although this is not an absolute requirement for any embodiment. This transformation applied to the digital data D, of a digital file A, serves to create a corresponding digital signature Xi. This digital signature is produced by means of a one-way function (i.e. a function easy to compute but hard to invert, see S. Goldwasser and M. Bellare Lecture Notes on Cryptography, MIT, July 2008, http://www-cse.ucsd.edu/users/mihir).

One such advantageous transformation is, for example, applying a hash function H( ) = hash( ) to the digital data, which generally has the property that it returns an output of a known bit length regardless of the size of the input: this technical effect is particularly useful for creating a digital signature of digital data associated to a digital file, regardless of the size of the associated digital data and that of the batch of corresponding digital files. The Hash function is a well-known example of a one-way function. If a cryptographie hash function such as the SHA (Secure Hash Algorithm) class of functions, for example, SHA-256, is used, then there are the additional benefits that the function is practically irréversible and collision résistant, that is, the probability is negligible that two different inputs will lead to the same output. As will be understood from the description below, this is also not a requirement of the invention, although it is advantageous for the same reasons as in other applications. As shown in Figure 1, the values xi, X2, X3,—, Xv are the hash values, i.e. the associated digital file signatures, of the respective digital data of the digital files, that is, Xj = H(Dj), for j=l, ...,v. Just for the sake of succinctness, X (capital) is used here and in Figure 1 to indicate the set of hashed data values; thus X = (xi, X2, ..., x_v) (if Virtual digital file A_v is included; otherwise, the element x_v may be omitted).

In order to shorten the signature, the digital file signature xj of digital file Aj may even be just a sequence of a given plurality of bits of lower weights selected from the bits of the hash value H(Dj): for example, with the SHA-256 hash function of the SHA-2 family, it suffices to retain only the 128 bits of lower weights from the 256 bits of the signature to still hâve a robust signature with respect to codebreaking attack.

An aggregated digital signature, or batch value, B is then computed over X by means of a (quasi-commutative) one-way accumulator (see the article of Josh Benaloh and Michael de Mare One-Way Accumulators: A Decentralized Alternative to Digital Signatures, Advances in Cryptology - Eurocrypt’ 93, LNCS, vol.765, pp. 274-285, SpringerVerlag, 1993). In general, for a set of μ signatures x_n x₂,.... χ_μ (possibly including digital file signatures of one or more Virtual digital files), the corresponding accumulated value f(xi,x₂, ...·Χμ), abbreviated as f(X) with X = (x^x^ ... .χ_μ), given by a one-way accumulator f is:

f(Xi,X₂, ....Χμ) = f(f(f(...f(f(f(Xi),X₂) ... X₃), ..., Χ_μ_₂), Χμ—i), Χμ).

In general, it is possible to write f(x_1;x₂) = x_x®x₂, where ® is an associated operator preferably chosen such that f(X) is sufficiently difficult to invert that the computational burden is too high in practical implémentations. This concept of computational impracticality as used in embodiments is explained further below. According to the invention, a one-way accumulator is chosen for calculating aggregated signatures in view of the constraint of limiting the size of B. Indeed, such accumulator has the technical effect of producing a digital value of which size (i.e. number of bits) does not dépend on the size of its arguments.

As a trivial example, the batch value may be a function f(X) such as the commutative addition modulo a given modulus m, i.e. f(x) = x mod m and f(x, y) = x®y, with the associated commutative operator ® defined by x®y = (x + y) mod m. Thus, here we hâve:

f(x,y) = f(x) + f(y) (i.e. f(x,y) = f(x)®f(y)).

This one-way accumulator has the following commutativity property (although only quasicommutativity is necessary for the invention):

B = f(X) = Χ₁®Χ₂®Χ₃® ...®Χμ = Χ-,®(Χ₂®Χ₃® ... ®Χμ) = X₂®(Xi®X₃® ...®Χ_μ), etc...

Now let X‘ be the set of ail éléments of X except χ,. For example, with i = 1, X¹ = (x₂,x₃, ...χ_μ). Assuming for simplicity that f(X) is commutative with respect to the éléments of X, and given the property of f(X) above, this leads to the following:

B = f(X) = XiOfCX¹) = fCX¹)® Xi = (x₂®X₃® ... ®Χ_μ)®Χι = ki®Xi with the vérification key ki = (x₂®x₃® ...®χ_μ) = fCX¹).

According to the invention, the aggregated digital signature B of the batch of digital files is made immutable, and thus forgery-proof, by being published in a (public) media accessible to a user having to check the authenticity of a digital file (or its associated data), or stored in a searchable aggregated signature database accessible to the user, or, in a preferred mode, stored in a blockchain accessible to the user. The user may then store the value B acquired from these available sources.

For each digital file Aj, a corresponding digital file vérification key ki is then computed by means of a partial one-way accumulator of the other digital file signatures xj (with j^i), i.e. the one-way accumulator of the digital file signatures x_lt ...x_i_₁,Xi₊₁ ....χ_μ or ίζΧ¹)· For example, in the module 120 of Fig.l, the digital file vérification key ki of digital file A, is calculated as kj = f(X‘), and the operation of checking that the digital data Dj and the vérification key ki of digital file Aj indeed correspond to digital data of a genuine digital file belonging to the batch having the batch value B only nécessitâtes verifying that k₅0 f(H(Di)) = B, i.e. ki0 x, = B. The obtained compact (due to the accumulator property) vérification key ki, as part of vérification information Vj = (Dj, k,) necessary for calculating B, is included in the digital security marking 110 in digital file Ai together with the digital data Dj of Ai. This is an important aspect of the invention as space available for data on a digital security marking is generally limited, particularly to perform offline checking of the authenticity of a secured digital file, and offline checking of conformity of its associated data with respect to that of a genuine original digital file. The one-way accumulator type for f is precisely chosen in view of the technical problem of reducing the size of the vérification key data to be included in a digital security marking. Indeed, the property of quasicommutativity (or, a fortiori, commutativity) of such accumulators allows signing data of a given digital file belonging to a batch of digital files without having to further include data relating to an ordering of the digital files in the batch or a rank of said given digital file according to the ordering in the batch. Moreover, the vérification operations would be much more computer intensive without said quasi-commutativity property.

A computation module 120 is preferably included within a securing system 100 to execute the code provided for performing the computations for f(X), for the key values ki for the different digital files, and for the common (aggregated) B value. The securing system 100 may also include suitable modules for inputting (pre-programmed) values corresponding to the digital data D_v of the virtual digital file A_v. Hashing of digital data D, of digital file Aj to yield the corresponding digital file signature Xi may also be performed, for example, in the computation module 120. It would also be possible to perform the digital file-related hashing computations externally (e.g. on a connected distant server), for example, wherever the digital files are created, so as to avoid having to transmit raw digital data D, over a network from that site (or sites) to the securing system 100, if that is a concern.

For each digital file Aj, corresponding vérification information Vj is compiled and is encoded in some form of machine readable security marking 110 that is then associated with the respective digital file.

For any virtual digital file A_v, its corresponding vérification information V_v may be associated internally with it by the securing system 100. The vérification information generally at least includes, for any file Aj of a batch of digital files, the corresponding digital data D, and the corresponding digital file vérification key kj:

Vj = (Dpkj)· According to the invention, the encoding of data D, and that of data ki may differ (which provides an additional level of strength with respect to codebreaking attacks).

Additional digital data may further be associated with a digital file and may include, for example, the batch value B or any other information the system designer chooses to include, such as a file serial number, batch ID, date/time information, content name, a URL that points to other, online information associated with either the individual file (such as a digital image of a corresponding article, etc.), or the batch, or a téléphoné number one may call for vérification, etc. The additional digital data may be stored in a searchable information database accessible to a user (via an information database interface).

Once the vérification k, of an original digital file Aj has been calculated, and included (i.e. via encoding or any chosen data représentation), together with the corresponding digital data Dj, in the machine readable digital security marking 110 added to the original digital file, the resulting marked original digital file and its associated digital data is in fact secured against forgery and tampering. An advantage of the invention is that no encoding/decoding key is included in the digital security marking.

There are many known methods for encoding information in a way that it can be displayed as a digital image of a machine readable pattern. Any such method may be used in implémentations of any embodiment of this invention. One common form of image of a digital marking is a well-known QR code. As is well known, for a given displayed area, the more data a QR code is able to encode, the higher the module density (roughly, density of black/white squares) it has and the greater resolution it requîtes to print and read. In addition to its density (in number of modules squared), QR codes are also generally classified depending on what level of error correction they include. At présent, the four different standard levels, L, M, Q, and H, each representing the degree of damage, that is, data loss, the QR code image can sustain and recover from. The levels L, M, Q, and H can sustain roughly 7%, 15%, 25% and 30% damage, respectively. The following table shows at least approximate values for different QR code versions:

Version	Size (in modules)	Number of encodable bits
ECC level L	ECC level H
10	57x57	2192	976

25	117x117	10208	4304
40	177x177	23648	10208

Not ail of the bits may be used to encode a data load, however, since some modules are used for scan targets, a mask pattern, and the error-correction modules. There is thus a trade-off between the amount of information that a QR code (or whatever marking 110 is used) can encode, and how much information is included in a vérification information V and must be encoded.

For a chosen type of digital security marking 110 (such as a QR code), with a limited encoding capacity, a suitable encoding function f(X) should therefore also be chosen: a function of which output is too large in terms of required bits may be impossible to use at ail, and a function of which range is too small may not be secure enough. Moreover, in many applications, scalability may be an issue. For example, some data security schemes involve signatures that grow as the number of members of a batch increases, and that could impermissibly limit the size of a batch from the perspective of how many bits the digital security marking 110 can encode. This is why, according to the invention, the type of function chosen is the one-way accumulator.

In one illustrative embodiment, the one-way accumulator function f(X) is chosen to be a mere (commutative) modular multiplication, that is f(x) = x mod m, and f(x, y) = x®y = x * y mod m.

Thus, here we hâve f(x,y) = f(x) * f(y) and:

μ / ^μ \ f(X) = j”[ x, mod m = I Xj j mod m i=l \i=l / i .e. f(X) = x₁®x₂® ...®χ_μ , where m is the modulus and X corresponds to the μ digital file signatures of the μ digital files in the batch X = (Xi, ...,χ_μ). The modular multiplication is a very simple example of one-way accumulator (not only quasi-commutative but also commutative), although not robust. Thus, in words, the batch value B = f(X) is computed by multiplying ail the digital file hash values Xi together, and then taking the remainder of this product after division by the modulus m. In some cases, this might lead to an impractically large product. For example, assume that there are 1000 digital files in a batch, and each hash value xi is 256 bits long (as obtained with a SHA-256 hash function). To do 999 multiplications and store the resuit, and then hâve to do the division by m to get the remainder, would be possible, but clumsy, and require unnecessary computational effort in the form of storing values without truncation. Instead, the system may make use of the property of modulo operations that the resuit may be computed iteratively, pairwise, as illustrated in the following pseudocode:

B = 1

For j = 1 to μ

B := [B * x(j)] mod m

Next j

The value B may thus be computed without ever having to multiply more than two hash values before determining the product modulo m.

Of course, any other method may be used to compute f(X) using the product-modulo-m method shown above. A similar algorithm may be used to compute the vérification keys kj - to compute key kj, simply skip the step in which j=i.

There are several advantages of using the product-modulo-m method for determining the batch value B and the vérification keys. One advantage is that the bit 15 length will not be greater than m, which may be chosen by the user. Moreover, the computations require no floating-point operations and thus there will be no errors due to truncation - note that a change of a single bit in a digital file signature will produce a totally different batch value.

The choice of the integer modulus m also reflects a trade-off between 2 0 security and size, both of the number of bits that the digital security marking 110 can encode, and of the number of files in a batch. To illustrâtes, assume a highly simplified example of batch that includes only three digital files, having digital file signature hash values x_t, x₂, x₃. Now assume that m > max(x₁₍ x₂, x₃), then:

5 Xi mod m = x₂ mod m = x₂, and x₃ mod m = x₃

In other words, with this choice of m, there is no security for single values of H. On the other hand, unless m is chosen to be m » max(x!,x₂,x₃), then it is unlikely that the 3 0 product of any two of the hash values modulo m will stay the same value, and it is even less likely that the product of ail three will. The more files and thus hash values in a batch, the more the total product will wrap around the modulus m (hâve a non-zero divisor) and the more difficult it will be to use a brute force attack to find a fake multiplicand (digital file hash value) that, multiplied by a known key value, will yield the same batch value, modulo m. As a very simple example, assume that χ_η x₂, X3 and m are 3,6,8 and 10.

mod 10 = 3, mod 10 = 6, and mod 10 = 8 but

B = 3x6x8 mod 10 = 144 mod 10 = 4

If the vérification key for the first digital file is given as 6x8 mod 10 = 8, and the batch value B = 4, in order to guess the digital data hash value 3, one would still need to guess over a set of ten possibilities. The complexity will of course grow as the bit lengths of Xj and m grow. Especially for batches of more than ten digital files, or more than 100 digital files, with m set to be m > max^x,), for example, to the maximum value that can be represented for a given bit length (such as 256 for an implémentation that uses a SHA-256 hash function), it will be computationally inefficient for a malicious actor to try to fake the hash value for each signature of a batch of digital files, especially in implémentations in which importance, or even financial value, of each digital file in the batch is too low to justify attempting such an attack. In other words, using this embodiment, it is simply not worth the effort to try to fake the information encoded in the marking.

The choice m > max(x!,x₂, ....χ_μ) has the advantage that there is an équivalence property for ail the hash values (xjmod m = x,), but this is not necessary. Rather, any value may be chosen, in particular, to provide a desired bit length for B. It is also not necessary for m to be constant across ail implémentations of the invention, or even for ail batches. As one example, an administrator, service provider, etc., could choose a different modulus m for different batches. These could be stored in a database either in the securing system 100, or elsewhere, or be delivered via some other channel to a user, such as a récipient of the digital files, to enable only that récipient to easily verify digital files from their digital security marking 110.

To avoid having to maintain modulus values in a database, it would also be possible to compute m itself per-batch, for example, as a function of the hash values Xi. As just one example, m could be chosen asm = [max^^,....χ_μ)] +1. The module 120 could then détermine the modulus m before performing the other calculations such as f(X), kj and B.

The module 120 could also input a user-selected encoding size (such as a QR code version) and détermine an appropriate modulus (and thus a bit size) to ensure that the encoded data (Djkj) in the digital security marking will fit, i.e. the data necessary to retrieve x, = H(Dj) and calculate the batch value B from:

^XiOX¹) = XjO^XO = f(X*)®Xj = kj®Xi.

A user, récipient of a digital file such as Ai for example, may then scan (or otherwise read) with a reader the digital security marking on Ai and extract the digital data D_x and the vérification key k_n (and any other information that may hâve been encoded into the digital security marking). An example of reader is a computer with a display For the sake of vérification of the marked file the user must first retrieve the vérification information ^(D^kO from the digital security marking on Aj and thus, calculate the digital file signature Xi from the extracted digital data Dj: to do that the user must know the one-way function to be used for calculating a digital file signature, here the hash function HQ, and then perform the operation X! = H^) to obtain the full data (x^kj necessary to calculate a corresponding candidate aggregated digital signature B^c. The user may for example receive the one-way function securely (for example, using a public/private key pair) or by requesting this from the digital file provider or whichever entity having created the signatures and keys, or having it already programmed in a user’s processing unit of its reader.

Next, in order to calculate such candidate aggregated digital signature B^c, the user will need to further know the type of one-way accumulator f() to be used for that, here the user needs to know the modulus m of the modular multiplication (or similar information if some other function f was used). Assuming that a standard modulus is not used, for example, for ail digital files from the provider, the user may then receive the modulus in any known manner, either securely (for example, using a public/private key pair) or simply by requesting this from the digital file provider or whichever entity created the vérification data, or having it already programmed in the user’s processing unit.

With the modulus m, the user may then compute a candidate aggregated digital signature B^c = kjQXi, which should then be equal to the available (or published) B value: this value may hâve been previously acquired by the user and/or already stored in a memory of the reader's processing unit, it could also be a value that the récipient requests and receives from the System administrator in any known manner. If the candidate B^c and the available aggregated digital signatures B match, this computation then vérifiés the information in the secure digital marking 110 and confirms that the digital file A! is from the correct batch.

A link to access the batch value B for the batch corresponding to the digital file A_x could be included in the digital security marking 110 (for example, a web address, if

B can be retrieved on a corresponding web site), although it is not a preferred variant.

In some implémentations, récipients of a digital file A, may be capable of visually extracting the data corresponding to the digital data Dj directly from the digital file. For example, the data might be textual, such as a serial number, or text in a descriptive writing, or some alphanumerical encoding and human readable from the digital files themselves. Récipients of digital files could also be provided with appropriate software, such as a module in a reader device such as a smart phone, a computer or a tablet, that either inputs data, or reads data, and which then computes x, = H (DJ for the digital file at hand. For example, with a digital security marking 110 on digital file Ai being a standard QR code, a user could easily obtain by decoding the QR code with a computer, using a standard QR code decoding application running on the computer, the digital data D_x and digital file vérification key k_lf a vérification application in the user’s computer could then compute x_x = H(D_X) and B^c = f(X) = f(xx® X¹) = xx® f(X^x) = f(X^T) ®x_x = and compare this value with the available batch value B, as explained above. For example, if the operator ® corresponds to the modular multiplication, then k_x® x_x = (k_x * x_x) mod m.

Preferably, the aggregated digital signature (i.e. batch value) B is stored in a searchable aggregated signature database that can be accessed (via a communication link) by the user by means of its computer equipped with a communication unit, as this is the case with the above example of a smart phone. The user having to verify the digital file Ai can just send a request with its smart phone to the address of the database, via a signature acquisition interface of the database, the request containing the digital data D_x read on the digital security marking 110 in A_x (or the calculated digital file signature x_x = H (Di)) allowing to retrieve the corresponding batch value B, and the acquisition interface will return the aggregated digital signature B to the smart phone (or computer). The database may be secured by a blockchain in order to strengthen the immutability of the stored aggregated digital signatures. An advantage of the invention is to make the link between a physical object, i.e. an original digital file (as stored in a memory, for example), and its attributes, i.e. the associated digital data and its belonging to a batch of digital files, practically immutable through the corresponding aggregated digital signature.

The above mentioned vérification process of a digital file Aj may also serve to authenticate human readable data content of Aj on a corresponding printed version of the digital file A,. Indeed, a user can read on a display of a computer the corresponding digital data Dj as decoded from the digital security marking in the digital file Aj by the imager, and visually check that the displayed information is consistent with the printed data on the printed version of the digital file.

In a preferred embodiment, the digital data Dj further include characteristic digital data (CDD) of corresponding unique physical characteristic of an object, or an individual, associated with the marked original digital file Aj that can be used for (materially) authenticating the associated object, or the associated individual, by comparing the characteristic digital data extracted from the digital security marking and corresponding détection data of the unique physical characteristic obtained from a suitable sensor. Thus, with the characteristic digital data corresponding to the unique physical characteristic in a digital file Aj being CDD,, the corresponding unique physical signature data UPSi can be obtained by encoding of CDDj (preferably by means of a one-way function): for example, by taking a hash of the characteristic digital data CDD,, i.e. UPSj = H(CDDj). However, any other known encoding could be used instead: for example, in order to hâve a short signature, it is possible to use an elliptic curve digital signature algorithm. As an illustrative very simplified example of characteristic digital data CDDi corresponding to a unique physical characteristic of an object OBJi associated with a digital file Aj, we consider a mere digital image obtained by imaging the object OBJj (or a spécifie zone on OBJi), for example by means of the caméra of a smartphone, the corresponding unique physical signature data UPSi being, for example, a hash of the digital image, UPSj = H(CDDj). The characteristic digital data CDDi having generated the signature UPSj is the reference characteristic digital data for A, and the obtained signature UPSi is the corresponding reference unique physical signature data for Aj. Preferably, UPSj, i.e. the reference unique physical signature data for digital file Aj, is stored in a searchable database or in a blockchain (or in a database secured by a blockchain) accessible to the users (for example, via a request containing the digital data Dj read on the digital security marking in the digital file Aj, or its corresponding digital file signature Xj). Thus, the stored UPSj acquires an immutable character. A copy of CDDi may be further stored in the memory of the user’s smartphone (or reader or computer). In a variant ofthe embodiment, a copy of UPSj may also be further stored in the memory of the user’s smartphone (or reader or computer) to allow offline checking operation.

A check of authenticity of the digital file Ai may be performed by extracting candidate characteristic digital data CDD^ from the digital data Di read (here, with a decoding application running on the smartphone) on the digital security marking included in the digital file Ai, and comparing it with the reference characteristic digital data CDDi 5 stored in the memory of the smartphone: in case of matching CDDj^C = CDD,, the digital file Aj is considered as genuine (its digital content corresponds to that of a genuine marked original digital file). If the reference characteristic digital data CDDi is not stored in the memory of the smartphone, but instead the reference unique physical signature data UPSi is stored in the memory of the smartphone (with the advantage of taking up much less 10 memory compared with CDD), then the authenticity of Ai can still be checked by verifying that the candidate unique physical signature data UPS,⁰ obtained by calculating the hash value of the candidate characteristic digital data CDDj^C extracted from the digital data Di, i.e. UPSj^C = H(CDDj^C), matches the reference unique physical signature data UPSi stored in the memory.

A user may further check the authenticity of a received digital file Aj, still via offline (self-verifying) process, by detecting said unique physical characteristic on the object or individual associated with the digital file A,, by means of a sensor capable to perform such measurement (here, the caméra of the smartphone), and obtaining a candidate characteristic digital data CDD^ from the detected characteristic (here, a digital 20 image taken by the smartphone). Then, the user can compare (via the image processing unit of its smartphone, or visually on a display of the smartphone) the obtained CDDj^C with a copy of the reference CDD, (stored in the memory of the smartphone): in case of reasonable matching CDD,⁰ « CDDi (i.e. the two digital data agréé within some given tolérance or similarity criterion), the digital file A, is considered as genuine (i.e. its digital 2 5 content corresponds to that of a genuine marked original digital file).

Moreover, the user may also further calculate the corresponding candidate unique physical signature data from the copy of the reference CDDi stored in the memory of the smartphone as UPSi^C = H (CDD,), and compare it with the reference physical signature data UPSi stored in the memory of the smartphone: in case of matching UPSj^C = UPSi, the 3 0 digital file A; is confirmed as being genuine with an even higher degree of confidence (as merely one bit of différence is enough to cause a mismatch). Moreover, in case of matching, the digital data Dj associated with Aj, which has been verified as corresponding to that of a genuine digital file, as explained above by retrieving the corresponding batch value B from the read vérification information (D^kj) stored in the digital security marking in Aj, is also authenticated.

In a variant of the embodiment, the checking of authenticity of a digital file Aj by a user may be performed via online process. In this case, the reference data, i.e. the characteristic digital data CDDi and/or the reference unique physical signature data UPSi, are stored in a searchable database accessible to the user wherein the reference data relating to a digital file Aj are stored in association with, respectively, the corresponding digital data Dj (included in the digital security marking in Aj) or with the corresponding digital file signature x, (that can be calculated by the user once the data Dj is extracted from the digital security marking via the operation Xj = H(Dj)): the reference data can be requested by sending to the database a query containing, respectively, D, or Xj.

A conventional way of securing an object is to apply on it a material-based security marking (possibly tamperproof), i.e. a marking having détectable intrinsic physical or Chemical property that is very hard (if not impossible) to reproduce. If an appropriate sensor detects this intrinsic property on a marking, this marking is then considered as genuine with a high degree of confidence, and thus also the corresponding marked object. There are many examples of such known authenticating intrinsic properties: the marking can include some particles, possibly randomly dispersed, or has a spécifie layered structure, having intrinsic optical reflection or transmission or absorption or even émission (luminescence, for example, or polarization or diffraction or interférence...) properties, possibly détectable upon spécifie illumination conditions with light of spécifie spectral content. This intrinsic property can resuit from the spécifie Chemical composition of the material of the marking: for example, luminescent pigments (possibly not commercially available) can be dispersed in an ink used for printing some pattern on the object and are used to émit spécifie light (for example, in a spectral window within the infrared range) upon illumination with a spécifie light (for example, with light in the UV spectral range). This is used for securing banknotes, for example. Other intrinsic properties can be used: for example, the luminescent particles in the marking can hâve a spécifie luminescence émission decay time after illumination with an appropriate excitation light puise. Other types of intrinsic properties are the magnetic property of included particles, or even a fingerprint” property of the object itself such as, for example, the relative positioning of inherently randomly dispersed fibers of a paper substrate of a document, in a given zone on the document, which, when observed at sufficient resolution, can serve to extract a unique characterizing signature, or some random printing artefacts of data printed on the object which, viewed with sufficient magnification, can also lead to a unique signature etc.... The main problem with an inhérent fingerprint property of an object is its robustness with respect to aging or wear. However, a material-based security marking does not always allow also securing data associated with the marked object: for example, even if a document is marked with a material-based security marking like a logo printed with a security ink in some zone of the document, data printed on the remaining part of the document can still be falsified. Moreover, too complex authenticating signatures often necessitate significant storage capabilities involving external databases, and communication links for querying such databases, so that offline authentication of an object is not possible. According to the invention, an object marked by means of a materialbased security marking and associated with a (digitally) marked digital file is secured by the entanglement resulting from the fact that the characteristic digital data corresponding to the unique physical characteristic of the marked object, or its corresponding unique physical signature data, is immutably (thanks to the publication or storage of the aggregated digital signature in a blockchain) and forgery-proof linked with the digital data in the digital security marking being part of the associated digital file. The invention can thus be used for both securing a batch of objects and a corresponding batch of associated digital files.

Of course, any other known intrinsic physical/chemical property can be used to obtain the characteristic digital data CDD, relating to a unique physical characteristic of an object OBJi associated with a digital file Aj, and the corresponding unique physical signature data UPS,. As another illustrative example, it is possible to print a 2D barcode forming a material-based security marking on an object with a security ink including a luminescent pigment having its characteristic decay time constant as well as its light excitation wavelength window and its luminescence émission wavelength window: the resuit is an ink having a spécifie reference decay time value τ that serves as a material fingerprint” of the ink. It suffices to illuminate the barcode with excitation light in an illumination wavelength window covering the pigment excitation wavelength window, and collect a resulting luminescence light from the barcode with a sensor capable to detect light intensity within the luminescence émission wavelength window in order to authenticate the barcode, and thus the object. For example, a user’s reader may be equipped with a flash capable to deliver the excitation light to the barcode, a photodiode capable to collect the corresponding luminescence light intensity profile I(t) (over a détection time interval) from the barcode, and the reader’s CPU being programmed to calculate a decay time value from the collected intensity profile I(t). For example, the excitation wavelength window may be within the UV (ultra violet) band and the émission wavelength window within the IR (infra red) band. If, during vérification of the object, the luminescence light intensity collected by the user’s imager shows a characteristic decay over time corresponding to a candidate decay time t_c, then the ink, and consequently the object, is considered as genuine if t_c ~ τ (within a given range of tolérance). In this case, the characteristic digital data CDD, of a marked object OBJj includes at least the reference decay time value τ (and possibly data relating to the excitation wavelength window and the émission wavelength window). As it is clear from the above examples, including reference (unique) characteristic digital data in the vérification information of a digital security marking of an associated digital file Ai has the technical effect of providing a forgery-proof link between the digital data of the digital file and the authentication data of its associated object.

Instead of the product modulo m of the above illustrative example, any other known (commutative or quasi-commutative) one-way accumulator may be used (with its corresponding operator ®). For example, the quasi-commutative one-way accumulator defined by f(x) = f(I; x) = I^x mod m (i.e. exponentiation modulo m), or by the équivalent symbolic operator notation I®x, where I is a given number (integer) and m is the given modulus. Thus, f(x,y) = f(I;x,y) = f(f(I; x), y) = f(I;x)®y = (I^x mod m)^ymod m = I^x*^ymod m = I®x * y. The aggregated digital signature B for a batch of μ digital files A_X,A₂ ....Α_μ (that may include Virtual files) of which respective digital data are D_1; D₂ .... ϋ_μ, with corresponding associated digital file signatures χ₁,χ₂....χ_μ, is calculated for X = (x_nx₂ ....χ_μ), as B = f(I; X), i.e.:

B = f(f(f(... f(f(f(I,X₁),X₂),X₃), ..., Χ_μ_₂), Χ_μ-ι), Χ_μ) , which can be reduced, based on the quasi-commutativity of f, to:

B = f(X) = f(I; X) = (ΐ^Πχ>) mod m = I® Π ^xi, where Π Xj désignâtes the product from i=l to ϊ=μ of the digital file signatures components Xi,x₂, ...Χμ of X, i.e. Π^χΐ = ^xi * ^x2 * - * ^χμ· Indeed, the quasi-commutativity of this one-way accumulator allows writing (for ail I and ail x, y): f(f(I;x),y) = f(f(I;y),x), with the above mentioned resulting advantage that the vérification step does not necessitate having additional ordering information of the signatures Xj.

The digital file signatures xj are calculated, as explained above, by means of any known one-way function. Preferably, the digital file signature Xj is obtained by a hash function of the corresponding digital data Dj: x, = H(Dj) (for above mentioned reasons).

The digital file vérification key kj corresponding to the digital file signature Xj of the digital data Dj of a digital file Aj from a batch of μ digital files is thus calculated as: kj = l(n^xi/^xj)_mOd m, with (ΠΧΐ/Xj) =Xi*x₂ * - * Xj-i * Xj+i - * χ_μ, or with the symbolic notation kj = I®x_x * x₂ * ... * Xj-i * Xj₊i... * χ_μ·

With the notation X^j = (xj * x₂ * ... * Xj__x * Xj₊₁... * χ_μ), we hâve the more compact formula 10 kj = f(XQ, with (Hxi/Xj) = Xi *x₂ * * Xj-i * Xj+i -*Χμ being the product of the components ofXL

Consequently, the operation of checking that the digital data Dj and the digital file vérification key kj from a digital security marking of a digital file Aj indeed correspond to the data of a genuine digital file belonging to the batch having the batch value B only 15 nécessitâtes calculating the digital file signature Xj as Xj = H(Dj) and then verifying that Xj and kj allow retrieving the aggregated digital signature B via:

kj^⁰^ mod m = kj^Xj mod m = B (or kj ® Xj = B) .

0 Preferably, the (integer) modulus m is chosen to hâve a size of at least 2048 bits in order to provide good robustness with respect to codebreaking attacks.

The above exponentiation operator (and ail its known variants, like the Naccache operator f(x) = I^xC^x-1mod m, for any given numbers I and C, for example) is just another example of one-way accumulator given here for illustrative non-limitative purpose.

Another illustrative embodiment of the invention relates to a batch of digital biométrie identification documents, e.g. digital biométrie passports, as shown on Fig.2. Each digital passport, as a digital file, is associated with a corresponding individual, i.e. the owner of the passport. For clarity reason, the digital data of Al is represented on 30 Fig.2 as équivalent textual and alphanumerical information (i.e. human readable), for example, as it could be displayed from a digital pdf (Portable Document Format) file, and the digital security marking is shown as équivalent conventional QR code two-dimensional pattern.

In this example we still use a hash function as a one-way function for signing the passport digital data, preferably a SHA-256 hash function in view of its well-known robustness. Indeed, in view of a given size of the batch, the hash function that is selected (having its known bucket listing) for the purpose of signing the passport digital data is thus an example 5 of a one-way encryption function such that each distinct digital passport has its distinct digital passport signature, which thus make the signature unique. The domain of a hash function (i.e. the set of possible keys) being larger than its range (i.e. the number of different table indices), it will map several different keys to a same index which could resuit in collisions: such collisions can be avoided, when the size of the batch is known, by 10 considering the bucket listing associated with the hash table of a hash function and retaining only a function giving zéro collisions, or by independently choosing a hash-table collision resolution scheme (for example, such as coalesced hashing, cuckoo hashing, or hopscotch hashing).

Fig.2A shows an example of digital biométrie passport Ai secured with a 15 machine readable digital security marking 210 (here a QR code) encoded in Ai, and comprising passport digital data 230 containing conventional passport data, e.g. digital data representing a title of the document 230a (Passport”), a set of biography data of the owner of the passport 230b: last name (“Doe), first name (John), gender (M), date of birth (March 20,1975), citizenship (USA), origin (Des Moines), place of birth (Oakland), a 20 date of émission of the passport 230c (February 24, 2018) and a validity period 230d (February 23, 2020). These passport digital data may further comprise some (unique) serial number(s) 235 assigned by the authority delivering the passport (here 12345). The passport digital data further comprise biometry data of the owner of the passport as characteristic digital data (CDD) corresponding to a unique physical characteristic of an 25 individual associated with the digital passport. A machine readable représentation 230e (e.g. an alphanumeric one) of data characterizing said unique physical characteristic (not shown), corresponding to said biometry data, is associated with the passport digital data 230. A représentation of digital data is to be understood in a broad sense of the term: this représentation of data only needs to enable retrieving the original digital data. The machine 30 readable data représentation 230e, i.e. the biometry data, of the unique physical characteristic may correspond, for example, to fingerprint identification data or iris identification data of the owner of the digital passport. For example, biometry data 230e corresponding to a fingerprint of a person may resuit from an analysis of a set of spécifie minutia features of fmgerprint ridges like ridge ending, bifurcation and short ridges (according to the conventional Henry System of Classification).

Thus, for a given digital passport Aj of the batch of μ delivered digital biométrie passports, here with μ = 1024, the associated passport digital data Dj includes the above mentioned digital data 230a-230e. Preferably, additional passport digital data are associated with the above mentioned passport digital data 230. For example, a digital image of the fmgerprint pattern of the owner of the passport, or a digital identity photograph etc. In a variant of the embodiment, these additional passport digital data are stored in a searchable information database 250 that can be searched via an information request containing some passport data (for example, the name of the owner or the biometry data or data from the security marking or the unique serial number 235) to retrieve the corresponding fingerprint pattern data and receive it back. Preferably, a link to the information database 250 is included, as information access data 240, in the digital passport: here this information access data is encoded in a digital représentation of a QR code containing a reference index to retrieve corresponding additional data in the information database 250. However, in a variant of passport control operation involving access to a distant information database (online operation), the QR code could contain, for example, the URL of the information database that is accessible via the web.

A digital passport signature with a one-way hash function of the passport digital data Dj corresponding to the passport digital data 230a-230e ofthe digital passport Aj is then calculated by means, for example, of the above mentioned robust SHA-256 hash function to obtain the corresponding (unique) passport digital signature Xj = H(Dj). In a same way, the passport digital signatures of ail the digital passports in the batch, for ail the different owners, are calculated.

From ail the digital signatures of the digital passports in the batch, an aggregated digital signature B is calculated with a one-way accumulator. For example, in this embodiment, the aggregated signature for the batch is obtained by means of the above mentioned exponentiation modulo m one-way accumulator defined by f(x) = I^x mod m, where I is a given integer number and m is the modulus. Thus, the aggregated digital signature B for a batch of μ digital biométrie passports A₁,A₂ ....Α_μ (that may include virtual digital passports) of which respective passport digital data are Di, D₂.... ϋ_μ, and with corresponding associated passport digital signatures Xi = H(Di), x₂ = H(D₂),..., χ_μ = Η(ϋ_μ), is calculated for X = (xi,x₂, - ,Χμ), as:

B = f(X) = (ΐΠ^χί) mod m, where Π*ΐ désignâtes the product from i=l to i= μ of the passport digital signatures Χι,χ₂,Χμ , i.e. Πχΐ =Xi * X2 * -*Xp and the size of the modulo m is chosen to be of 2048 bits, for example. As explained above, with the notation X^ = (Xi,x₂,... * Xj-i,Xj₊i, ...,χ_μ), the vérification key kj for a digital passport Aj is calculated as the partial one-way accumulator kj = f(X’), and the vérification information (Dj, Kj) is included in the digital security marking 210 of the passport Aj. The operation of checking that the passport digital data Dj and the vérification key kj of a digital biométrie passport Aj indeed correspond to digital passport data of a genuine digital biométrie passport belonging to the batch of digital biométrie passports having the batch value B only nécessitâtes calculating the passport digital signature Xj = H(Dj) and verifying that Xj and the vérification key kj allow retrieving the available corresponding batch value B via: kpmodm = B (or kj®Xj = B). Thus, a digital biométrie passport secured according to the invention provides both a forgery-proof link between the personal data and the “biometry data of its holder, and a unique and a forgery-proof link between the physical person of the holder and the holder's identity.

Fig.2B illustrâtes a control process of the secured digital biométrie passport Ai of Fig.2A, with its passport digital data 230 corresponding to a certain John Doe, with its biometry data 230e corresponding to John Doe’s fingerprint, and with additional passport digital data corresponding to a digital identity photograph 255 of John Doe that is accessible via the link to the information database 250 included in the information access data 240. The passport data further comprises the unique serial number 235 assigned by the authority having delivered the passport. The digital security marking 210 of the digital passport contains the vérification information (D^k-J, with passport digital data Di corresponding to the passport data 230a-230d, the biometry data 230e and the unique serial number 235, and the vérification key k₄ corresponding to f(X^x), with notation X¹ = (x₂, ...,Xi₀₂₄), Xj = H(Dj) i = 2,...,1024 and f being the exponentiation modulo m (with given values of the integers I and m). The batch value B is obtained from ail the passport digital signatures (Xi,—,Xio24) as B = f(X), with (X = x₁₍ ...,x₁₀₂₄). The calculated aggregated digital signature B may further be time-stamped and stored in a blockchain 260. In this example, the biometry data 230e of the respective holders of the digital biométrie passports of the batch are also stored in the blockchain 260 in association with, respectively, their corresponding unique serial numbers (so as to make these data immutable). The stored biometry data of John Doe can be retrieved by sending a request to the blockchain 260 indicating the unique serial number 235 mentioned on his digital passport. The authorities in charge of controlling identity of people (for example, the police, the customs etc.) can access the blockchain 260 via a communication link, and, in this illustrative embodiment, hâve also local storage capabilities for storing the (published) aggregated digital signatures of ail the delivered batches of digital biométrie passports. In the example shown on Fig.2B, the information database 250 is local (i.e. directly accessible to the authorities, without having to use a public communication network). Moreover, these authorities are equipped with fingerprint scanners 270 to capture the fingerprints of individuals and calculate corresponding machine readable représentations of data characterizing the captured fingerprints, i.e. biometry data 230e.

During an identity control of John Doe, say by a police or a customs officer, the officer receives the secured digital biométrie passport Ai of John Doe, reads and décodés the vérification information (D^k-D stored in the digital security marking 210 of the passport by means of an appropriate reader, that may be for example a suitably programmed computer 290, the computer being connected to the local storage capabilities 250. If John Doe has only a material, i.e. paper, biométrie passport (marked with a printed security marking corresponding to the digital security marking 210), the officer can obtain the associated digital biométrie passport Ai by taking a digital image of the document with a scanner 280 connected to the computer 290, image processing the digital image to transform its data content into corresponding digital data, and storing the extracted digital data in the computer 290 as a digital file corresponding to a digital biométrie passport Ai of John Doe. Having read the passport digital data D_x and the vérification key kjand sent it to the computer 290, a dedicated application (with programmed hash function H and oneway accumulator) running on the computer 290 calculâtes the passport digital signature x_r (as x_x =H(D₁)) and a candidate batch value B^c as k^mod m = B^c. Then, the computer can, for example, search in the local information database 250 a batch value B matching the value B^c: in case there is no matching, the digital passport is a forged one and John Doe (i.e. the screened individual claiming that his name is John Doe) may be arrested. In case B^c matches some stored batch value B, the digital passport is considered as genuine and the officer may perform additional security checks:

- the officer retrieves the digital identity photograph 255 stored in the information database 250, by sending a request via the computer 290 containing the serial number 235 in A_x, receives it back and display the received identity photograph 255 on a screen of the computer 290: the officer can then visually compare the displayed visage (i.e. that of a certain John Doe) with that of the individual being checked and estimate if the two visages are similar or not; and

- the officer retrieves the biometry data 230e on the digital passport A_x by reading these data on the digital security marking 210 with the computer 290, and scans the individual’s fingerprint by means of a fingerprint scanner 270 connected to the computer 290 and obtains the corresponding individual's biometry data: the officer then checks by means of a program running on the computer 290 if the retrieved biometry data 230e is similar (within a given margin of error) to the obtained individual's biometry data.

If the two visages and the biometry data are judged similar, everything is ail right and the checked individual is indeed John Doe, the owner of the genuine digital biométrie passport A_x (and thus possibly, also of the material biométrie passport from which Ai has been obtained).

In case of any one of the above additional security checks fails, clearly, the individual in front of the officer is not the true holder of the genuine digital biométrie passport A_x and has probably stolen the passport of a certain John Doe. Thus, with a secured digital biométrie passport according to the invention a mere offline check can quickly detect any fraud.

In fact, it is even possible to reduce a digital biométrie passport document to a mere digital file with just a digital représentation of a 2D barcode (like the above example of a QR code) including the vérification information V = (D,k): with V comprising the holder's biography data and (unique) biometry data, like the holder’s fingerprint (within the passport digital data D) and the vérification key. Indeed, according to the invention, even this reduced secured digital passport takes full advantage of the above mentioned forgery-proof link created between the personal biography data and the biometry data of the passport holder, and the unique and forgery-proof link between the physical person of the holder and the holder’s identity.

Another illustrative embodiment of the invention relates to components of an aircraft, as shown on Fig.3. Due to the very high price of certain critical components from which failure could affect the security of the aircraft, like some parts of the reactors (e.g. turbine blades, pumps...) or ofthe landing gear, or batteries etc...., counterfeiters are interested to produce copies of these components but of course without complying with the required safety technical requirements due to their generally lower quality. Even if an aircraft component is generally marked with a corresponding unique serial number to identify it, that sort of marking may be easily counterfeited. These counterfeit airplane parts are generally defective and can cause severe damages or even plane crashes. This is a growing security problem today. Moreover, even if the components are genuine, they may not be convenient for certain versions of a same type of aircraft, and there is a serious risk that an inappropriate component is inadvertently used for repairing a given aircraft for example. It is thus important to secure at least the critical genuine components that are allowed for given aircraft.

Generally, each component has a corresponding (possibly digital) technical data sheet indicating e.g. the component technical name, the component unique serial number, the component manufacturer name, the manufacturing date of the component and certification information. Moreover, for a given aircraft, a corresponding record contains ail the (digital) technical data sheets of its respective components. However, counterfeited components may hâve their corresponding fake digital technical data sheet and thus, it is not obvious (unless by performing technical tests, for example) to detect fraud. For example, how to be sure that a digital technical data sheet corresponds well to a component mounted on a spécifie aircraft (and vice versa)?

According to an illustrative embodiment of the invention, the allowed parts to be used for manufacturing or repairing a given aircraft, or that are mounted on the aircraft, are considered as belonging to a batch of components (or objects) for that very aircraft.

In the spécifie illustrative embodiment shown on Fig.3, each component of an aircraft batch, i.e. each allowed aircraft component for mount or repair on a given aircraft, has a corresponding aircraft component digital identification document AC-ID that contains the same component digital data as in a conventional technical data sheet (e.g. the aircraft ID code, the aircraft manufacturer name, the component technical name, the component unique serial number, the component manufacturer name, and the manufacturing date of the component) together with additional digital data corresponding, to the aircraft ID code, the aircraft manufacturer name, the assembly date of the component on the aircraft, the name of the technician in charge of performing the conformity check together with the date of the conformity check, and the corresponding (unique) digital signature of the checker. Moreover, each aircraft component digital identification document AC-ID is secured by means of a machine readable digital security marking added to it. For clarity reason, the digital data of AC-ID:Ai25 is represented on Fig.3 as équivalent textual and alphanumerical information (i.e. human readable), and the digital security marking 310 is shown as équivalent conventional QR code two-dimensional pattern.

Preferably, each time a component or a set of components are replaced on the aircraft, corresponding secured digital AC-ID documents are created and a corresponding updated version of the aircraft batch is also created, with the above mentioned corresponding additional digital data (relating to the new mounting operations).

Thus, ail the (critical) mounted components on a spécifie aircraft (here, having the aircraft ID reference HB-SNO), belong to a corresponding batch of mounted components (here, having a total of μ components) and are documented in a corresponding batch of associated μ digital files, i.e. the digital identification document AC-ID. A digital security marking 310 (here in the form of a 2D représentation of a QR code) is included in each aircraft component digital identification document, for example AC-ID:Ci25, that is associated with the corresponding aircraft component, here C₁₂₅, mounted on the aircraft HB-SNO. Fig.3 particularly shows the component C₁₂₅ of the aircraft batch being a turbine blade adapted to the reactor type mounted on the aircraft HB-SNO and marked with a unique manufacturing serial number (here, 12781, generally engraved by the manufacturer). The component digital data D₁₂₅ in the digital security marking 310 of the aircraft component identification document AC-ID:Ci25, associated with component C₁₂₅, comprises the digital data corresponding to that of the technical data sheet of C125: the aircraft ID code 330a (here, HB-SNO), the aircraft manufacturer name 330b (here, AeroABC), the component technical name 330c (here, turbine blade - l^st ring), the component serial number 330d (here, 12781), the component manufacturer name 330e (here, PCX), the manufacturing date of the component 330f (here, November 13, 2017), the assembly date of the component on the reactor 330g (here, February 24, 2018), the name of the technician in charge of performing the conformity check 330h (here, the checker is Martin White) together with the date of the conformity check 330i (here, March 20, 2018), and the (unique) digital signature of the checker 33Oj (here, 2w9s02u).

A digital file signature x₁₂₅ of the digital data D₁₂₅ of the digital file ACID: C₁₂₅ of component C₁₂₅ is calculated by means of a one-way hash function H as x₁₂₅ ⁼ H(D₁₂₅). In the same way, ail the digital file signatures Xj of the digital data Dj of digital file AC-ID: Cj of component Cj are calculated by means of the one-way hash function H as Xj = H(Dj) (here, i = 1,...,μ). Let X correspond to the whole set of component digital signatures X = (xi,x₂,... ,χ_μ), and let X¹ correspond to the whole set of component digital signatures with the exception ofthe signature Xj, i.e. X¹ = (x_t,x₂, — * Xî-i.Xî+i, — Αμ) · As already explained, an aggregated digital signature B for the batch of μ aircraft component digital identification documents AC-ID:CiAC-ID:C_R (digital files), of aircraft components C!, ...,C_R, is calculated by means of a one-way accumulator f as B = f(X). The aggregated digital signature is then stored in a searchable database (preferably a blockchain) accessible to technicians in charge of controlling or changing the mounted components.

For a given digital file AC-ID: C, of the batch, a corresponding digital file vérification key kj is calculated by means of the corresponding partial one-way accumulator as k, = ί(Χ’). For each component C, mounted on the aircraft HB-SNO, the associated digital data D, and the corresponding vérification key kj are embedded in the digital security marking included in the corresponding aircraft component digital identification document AC-ID: Q. For example, in case of a control operation of a component on the aircraft HB-SNO, a technician may send a request to the searchable database containing the component serial number 12781 read on the digital file ACID: A₁₂₅ of component C₁₂₅ to be controlled, or its vérification key k₁₂₅ as read on the digital security marking 310 of the AC-ID: A₁₂₅ document with an appropriate reader, as for example a computer programmed for decoding the content of the digital security marking, and will receive back the corresponding batch value B. However, in a preferred variant allowing complété offline checking, the technician’s computer has a memory storing ail the aggregated digital signatures relating to the aircrafts to be controlled. In this latter variant, the technician can then check if the component is genuine by reading the component digital data D₁₂₅ on the digital security marking 310, checking that the unique serial number 330d (here, 12781) extracted from D125 matches the serial number physically marked on the mounted aircraft component C125, calculating the corresponding component digital signature x₁₂₅ (for example, by running a programmed application on a CPU of the computer which calculâtes the signature x₁₂₅ = H(D₁₂₅) from the read digital data D₁₂₅), calculating a candidate batch value B^c via the one-way accumulator function programmed on the computer's CPU as B^c = k125® x125 (the operator ® corresponding to the one-way accumulator f), and checking that the candidate batch value B^c matches one of the batch values stored in the computer's memory (i.e. B, corresponding to the batch of digital files for the aircraft HB-SNO). In case of full matching (i.e. the serial numbers match and B^c = B), the component C125 is considered as genuine and belongs to the (up-to-date) aircraft batch of allowed components of the HB-SNO aircraft, if B^c does not match a stored batch value B, or if the serial numbers do not match, the component C₁₂₅ is possibly counterfeit, or is a genuine component not allowed for the aircraft HB-SNO (e.g. C₁₂5 does not belong to the right batch for this aircraft), and must be changed.

In a same way, the invention would allow detecting fraud (or errors) from batches of secured AC-IDs of replacement parts stored in a warehouse by verifying the authenticity of the markings on the stored parts and checking that the component serial number from the digital security marking matches that marked on the corresponding component. In case of a highly critical component, a tamperproof material-based security marking may further be applied on the component, while the characteristic digital data CDD relating to the corresponding reference unique physical characteristic (for example, as captured by a suitable sensor when applying the material-based security marking) of this marking is preferably made part of the component digital data D in the digital security marking of the aircraft component digital identification document for this component, and a corresponding reference unique physical signature data UPS is calculated (for example, by taking a hash of the characteristic digital data CDD, i.e. UPS = H(CDD)) and may also be part of the component digital data D. This additional level of security improves the security provided by the unique serial number marked on the component by its manufacturer. Preferably, the reference CDD and UPS are stored in the blockchain (to make them immutable) and are accessible to the technician. Moreover, these reference values may also be further stored in the memory of the technician's computer in order to allow offline authentication of the material-based security marking on the highly critical component.

The further offline operation of authentication of this material-based security marking may comprise measuring the unique physical characteristic on the component, by means of a suitable sensor connected to the computer, and obtaining a candidate characteristic digital data CDD^C from the measured characteristic (for example, via a spécifie application programmed in the CPU of his computer). Then, the technician (or the CPU of his computer, if suitably programmed) compares the obtained CDD^c with the copy of the reference CDD stored in the memory of the computer: in case of reasonable matching CDD^C « CDD (i.e. within some predefined error tolérance criterion), the materialbased security marking, and thus the component, are considered as genuine.

As above mentioned, a copy of the reference physical characteristic digital data CDD, instead of being stored in the memory of the technician’s computer, is part of the digital data D included in the digital security marking in the aircraft component digital identification document AC-ID:C of the component C and can be obtained by direct reading on the digital security marking. The technician may then read the candidate CDD^C on the digital security marking and check that the signature UPS stored in the memory of the computer matches the candidate signature UPS^C calculated from the read candidate CDD^c by computing UPS^C = H(CDD^c): in case of matching UPS^C = UPS, the material-based security marking, and thus the component and its associated component digital identification document, are confirmed as being genuine.

In a variant of the embodiment, the checking of authenticity of a component digital identification document, and of its associated component, by a technician may alternatively be performed via online process in a similar way as already explained with the first detailed embodiment of the invention, and will not be repeated here.

According to the invention, it is possible to verify the authenticity of an aircraft component digital identification document, AC-ID: C₁₂₅ for example, with respect to the original genuine secured digital file. Indeed, if a technician in charge of control (or repair) operations has access to the digital file AC-ID: C₁₂₅ on its computer (which may also be, for example, a smartphone suitably programmed), he can check that the component digital data correspond to that of the original document by performing the following operations of:

- reading the component digital data D₁₂₅ and the vérification key ki25 on the digital security marking 310 of the component digital identification document AC-ID: C₁₂₅;

- acquiring a reference batch value B of the batch corresponding to the document ACID: C₁₂₅; this reference value may be already in the memory of the computer or may be acquired via a communication link from a database storing the reference batch values of aircraft component digital identification documents in case the computer is equipped with a communication unit, by sending a request containing, for example, the component (unique) serial number or merely the key k₁₂₅ read on the digital security marking 310, and receiving back the corresponding reference batch value B;

- calculating (with the programmed one-way function H) a digital file signature x₁₂₅ from the read component digital data D₁₂₅, with x₁₂₅ = H(D₁₂₅);

- calculating a candidate batch value (by means of the programmed one-way accumulator and its corresponding operator ®) B^c with B^c = k₁₂₅® x₁₂₅; and

- verifying that the candidate batch value B^c matches the reference batch value B.

According to the above detailed description, the invention is clearly compatible with offline and local checking operations for verifying the authenticity of a secured digital file or conformity of data of a copy of a secured digital file with respect to the data content of the original secured digital file. However, the invention is also compatible with online vérification process, for example by receiving (via a communication link) a reference batch value form an external source (e.g. server or blockchain), or performing some or ail the calculation steps involving the one-way function or the one-way accumulator via external computing means (e.g. operating on a server), or even performing the vérification that a candidate aggregated digital signature matches a reference aggregated digital signature (and just receiving the resuit).

The above disclosed subject matter is to be considered illustrative, and not restrictive, and serves to provide a better understanding of the invention defined by the independent claims.

Claims (17)

1. Method of securing a given original digital file of a batch of a plurality of original digital files (Ai, A2, A3) against forgery or tampering, each original digital file of the batch containing its own digital data (Di, D2, D3), characterized by comprising the steps of:

for each original digital file of the batch, calculating by means of a one-way function an associated digital file signature (χι,Χ2, X3) of its digital data;

calculating a reference aggregated digital signature (B) corresponding to the batch of original digital files from ail the digital file signatures of the original digital files of the batch by means of a one-way accumulator of said digital file signatures, and making available to a user the reference aggregated digital signature;

determining a digital file vérification key (ki) corresponding to the digital file signature of said given original digital file by means of a one-way accumulator of ail the other digital file signatures used for calculating the reference aggregated digital signature, whereby a candidate digital file signature corresponds to that of an original digital file of the batch only if the reference aggregated digital signature is calculated by means of a oneway accumulator of said candidate digital file signature and corresponding digital file vérification key; and including in the given original digital file a digital représentation of a machine readable security marking (110) containing a représentation of the digital data of the given original digital file and its corresponding digital file vérification key, thereby obtaining a marked original digital file of which digital data are secured against forgery or tampering.

2. Method according to claim 1, wherein the reference aggregated digital signature associated with the batch of original digital files is either published in a media accessible to the user, or stored in a searchable aggregated signature database accessible to the user, or stored in a blockchain (260), or in a database secured by a blockchain, accessible to the user.

3. Method according to claim 2, wherein the marked original digital file further includes aggregated signature access data containing information sufficient to access to the reference aggregated digital signature corresponding to the batch of original digital files, said information being a link to an aggregated signature acquisition interface of, respectively, one of the following:

- the media wherein the reference aggregated digital signature is published, the media being accessible to the user via said aggregated signature acquisition interface opérable to receive from the user an aggregated signature request containing digital data, or a digital signature of said digital data, obtained from the digital représentation of a machine readable security marking of a marked original digital file, and send back a reference aggregated digital signature of associated batch;

- the searchable aggregated signature database wherein the reference aggregated digital signature is stored, the aggregated signature database being accessible to the user via said aggregated signature acquisition interface opérable to receive from the user an aggregated signature request containing digital data, or a digital signature of said digital data, obtained from the digital représentation of a machine readable security marking of a marked original digital file, and send back a reference aggregated digital signature of associated batch;

- the blockchain, respectively the database secured by the blockchain, wherein the timestamped aggregated digital signature is stored, the blockchain, respectively the database secured by the blockchain, being accessible to the user via said aggregated signature acquisition interface opérable to receive from the user an aggregated signature request containing digital data, or a digital signature of said digital data, obtained from the digital représentation of a machine readable security marking of a marked original digital file, and send back a reference aggregated digital signature of associated batch.

4. Method according to any one of claims 1 to 3, wherein a virtual digital file (A_v) is counted as belonging to the batch of original digital files, said virtual digital file having corresponding virtual digital data (D_v), and an associated virtual digital file signature (x_v) obtained by means of the one-way function of its virtual digital data, said virtual digital file being not real but only used for generating the associated virtual digital file signature from the corresponding virtual digital data; and the reference aggregated digital signature associated with said batch of original digital files being calculated from ail the digital file signatures of the original digital files of the batch, including the virtual digital file signature, by means of the one-way accumulator.

5. Method according to any one of claims 1 to 4, wherein the one-way function is a hash function (H) and a digital file signature of an original digital file is a sequence of a given plurality of bits of lower weights selected from the bits ofa hash value ofthe corresponding digital data.

6. Method according to any one of claims 1 to 5, wherein additional digital data corresponding to the digital data associated with the marked original digital file are stored in a searchable information database (250) accessible to the user via an information database interface opérable to receive from the user an information request containing digital data, or corresponding digital file signature data, obtained from the digital représentation of a machine readable security marking of a marked original digital file, and send back corresponding additional digital data.

7. Method according to any one of claims 1 to 6, wherein the digital data of the marked original digital file include reference characteristic digital data CDD (230e) of a corresponding unique physical characteristic of an associated object or individual.

8. Method of verifying the authenticity of a digital file secured according to the method of any one of claims 1 to 7, or the conformity of a copy of such secured digital file with respect to the original one, characterized by comprising the steps of, upon processing a test file being said digital file or said copy of the digital file by means of a processing unit connected to a memory:

having stored in the memory the test file;

reading a représentation of digital data and of a test file vérification key on a digital représentation of a machine readable security marking in the stored test file, and extracting respectively corresponding digital data and test file vérification key from said read représentation;

having stored in the memory a reference aggregated digital signature of a corresponding batch of digital files, and having programmed in the processing unit the oneway function and the one-way accumulator;

verifying that the extracted digital data and test file vérification key indeed correspond to the stored reference aggregated digital signature by performing the steps of:

calculating a digital signature of the extracted digital data with the one-way function;

calculating a candidate aggregated digital signature from the calculated digital signature of the extracted digital data and the extracted test file vérification key with the one-way accumulator; and checking that the obtained candidate aggregated digital signature matches the stored reference aggregated digital signature, whereby, in case said aggregated digital signatures match, the digital data of the test file are that of a genuine original digital file.

9. Method according to claim 8, wherein the digital file is secured by storing the reference aggregated digital signature associated with batch of original digital files in a searchable aggregated signature database accessible to the user according to the method of claim 2, and the processing unit is further connected to a communication unit opérable to send and receive back data via a communication link, comprising the preliminary steps of:

sending with the communication unit via the communication link a request to said aggregated signature database, and receiving back the reference aggregated digital signature associated with batch of original digital files; and storing the received aggregated digital signature in the memory.

10. Method according to claim 8, wherein the digital file is secured according to the method of claim 3 and the processing unit is further connected to a communication unit opérable to send and receive back data via a communication link, comprising the preliminary steps of:

reading the aggregated signature access data included in the test file;

sending with the communication unit via the communication link an aggregated signature request to said aggregated signature acquisition interface containing the digital data, or a digital signature of said digital data, obtained from the digital représentation of a machine readable security marking in the test file, and receiving back a corresponding reference aggregated digital signature of associated batch; and storing the received aggregated digital signature in the memory.

11. Method according to any one of claims 8 to 10, wherein the digital file is secured according to the method of claim 6 and the processing unit is further connected to communication means opérable to send to the information database interface an information request containing digital data, or corresponding digital file signature, obtained from the digital représentation of a machine readable security marking in the test file, and receive back corresponding additional digital data.

12. Method according to any one of claims 8 to 11, wherein the digital file is secured 5 according to the method of claim 7 and the processing unit is connected to a sensor opérable to detect a unique physical characteristic of an associated object or individual, the processing unit being programmed to extract corresponding unique physical characteristic digital data from a détection signal received from the sensor, the processing unit having stored in the memory reference characteristic digital data CDD corresponding to said 10 unique physical characteristic of the associated object or individual, comprising the further steps of, upon viewing a subject being, respectively, said associated object or individual:

detecting a unique characteristic of the subject and extracting corresponding candidate characteristic digital data CDD^c;

comparing the obtained candidate characteristic digital data CDD^c with the stored 15 reference characteristic digital data CDD; and in case the candidate characteristic digital data CDD^C is similar to the stored reference characteristic digital data CDD, within a given tolérance criterion, the subject is considered as genuine.

2 0

13. Marked digital file belonging to a batch of a plurality of original digital files and secured against forgery or tampering according to the method of any one of claims 1 to 7, each original digital file of the batch having its own digital data, said batch having a corresponding reference aggregated digital signature, comprising:

a digital représentation of a machine readable security marking including a 2 5 représentation of digital data of the marked digital file and a corresponding digital file vérification key.

14. Marked digital file according to claim 13, wherein the digital data of the marked digital file include reference characteristic digital data CDD of a corresponding unique physical 3 0 characteristic of an associated object or individual.

15. Marked digital file according to claim 14, wherein the unique physical characteristic of the associated object is that of a material-based security marking applied on the associated object.

16. System for verifying the authenticity of a marked original digital file secured according to the method of any one of claims 1 to 7, or the conformity of a copy of such digital file with respect to the original one, comprising a processing unit with a memory, the memory storing a reference aggregated digital signature of a corresponding batch of digital files, and the one-way function and the one-way accumulator being programmed in the processing unit, opérable to:

acquire a test file being said digital file or a copy of the digital file and store the acquired test file in the memory;

read a représentation of digital data and of a test file vérification key on a digital représentation of a machine readable security marking in the stored test file, and extract respectively corresponding digital data and test file vérification key from said read représentation;

verify that the extracted digital data and test file vérification key indeed correspond to the stored reference aggregated digital signature by executing the steps, programmed in the processing unit, of:

calculating a digital signature of the extracted digital data with the one-way function;

calculating a candidate aggregated digital signature from the calculated digital signature of the extracted digital data and the extracted test file vérification key with the one-way accumulator; and checking that the obtained candidate aggregated digital signature matches the stored reference aggregated digital signature, whereby, in case said aggregated digital signatures match, the digital data of the test file are that of a genuine original digital file and the system is opérable to deliver an indication that the digital data on the test file is that of a genuine original digital file.

17. System according to claim 16, for verifying a digital file secured according to the method of claim 7, or the conformity of a copy of such digital file with respect to the original one, further equipped with a sensor connected to the processing unit and opérable to detect a unique physical characteristic of an associated object or individual, and the processing unit is programmed to extract corresponding characteristic digital data from a détection signal received from the sensor, the system having stored in the memory reference characteristic digital data CDD corresponding to said unique physical characteristic of the associated object or individual, the System being further opérable to:

detect with the sensor a unique physical characteristic of a subject being said associated object or individual, and extract corresponding candidate characteristic digital

5 data CDD^c;

compare the obtained candidate characteristic digital data CDD^c with the stored reference characteristic digital data CDD; and in case the candidate characteristic digital data CDD^c is similar to the stored reference characteristic digital data CDD, within a given tolérance criterion, deliver an indication that 10 the subject is considered as genuine.