Method and apparatus for article authentication

• US 20030059050A1
• Filed: 06/06/2002
• Published: 03/27/2003
• Est. Priority Date: 08/24/2001
• Status: Active Grant

• Current Assignee: Zebra Technologies Corporation
• Original Assignee: ZIH Corp. (Zebra Technologies Corporation)
• Inventors: Tsirline, Boris Y., Hohberger, Clive P.
• Granted Patent: US 7,137,000 B2
• Time in Patent Office: Days
• US Class Current: 380/270
• CPC Class Codes: B41J 17/36 Alarms, indicators, or feed-disabling devices responsible to material breakage or exhaustion
• CPC Class Codes: B41J 35/36 Alarms, indicators, or feed disabling devices responsive to ink ribbon breakage or exhaustion
• CPC Class Codes: G07D 7/0047 using checkcodes, e.g. coded numbers derived from serial number and denomination
• CPC Class Codes: G07F 7/08 by coded identity card or credit card or other personal identification means without personal verification means G07F7/02
• CPC Class Codes: G07F 7/12 Card verification
• CPC Class Codes: H04L 2209/805 Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3236 using cryptographic hash functions

Abstract

An authentication method for authenticating an article in a device includes the steps of a) reading an identification number stored on the article, b) reading an authentication number stored on the article, c) determining an input number based at least in part on the identification number, d) applying an authentication function to the input number to calculate an output number, e) determining that the article is authentic only if the authentication number corresponds to the output number, and f) permitting use of the article in the device if the article is authentic, and disabling use of the article in the device if the article is not authentic.

Claims

1. An authentication method for authenticating an article in a device, the method comprising the steps of:

reading an identification number stored on the article;

reading an authentication number stored on the article;

determining an input number based at least in part on the identification number;

applying an authentication function to the input number to calculate an output number;

determining that the article is authentic only if the authentication number corresponds to the output number; and

permitting use of the article in the device if the article is authentic, and disabling use of the article in the device if the article is not authentic.

2. The authentication method according to claim 1 wherein the authentication function is an encryption transformation of the input number.

3. The authentication method according to claim 1 further comprising the step of reading a media type number stored on the article.

4. The authentication method according to claim 3 further comprising the step of determining the input number based at least in part on the media type number.

5. The authentication method according to claim 2 wherein the step of applying the encryption transformation further comprises the steps of:

providing a first prime number, Q;

providing a second prime number, M;

the second prime number being a primitive element of the prime Galois Field of the first prime number; and

calculating the output number according to the formula;

output number=M^N MOD Q, where N is the input number.

6. The authentication method according to claim 5 wherein the second prime number is selected such that the second prime number is greater than 0, the second prime number is not equal to 1, and the second prime number is not equal to one-half of, the first prime number minus 1.

7. The authentication method according to claim 5 wherein determining the output number further comprises the steps of:

a) initializing a partial product by;

setting a multiplier equal to the second prime number;

setting the partial product equal to 1 if the least significant bit of the input number is equal to 0;

setting the partial product equal to the multiplier modulo the first prime number if the least significant bit of the input number is equal to 1;

b) from the least significant bit to the most significant bit of the input number, for each such bit, iteratively evaluating the partial product by;

doubling the multiplier;

resetting the partial product equal to the prior partial product modulo the first prime number if a next unevaluated bit of the input number is equal to 0;

resetting the partial product equal to (a) the prior partial product times the modulo of the multiplier over the second prime number (b) modulo the second prime number, if said next unevaluated bit of the input number is equal to 1; and

c) concluding said iterative evaluation of the partial product after evaluating the partial product for the most significant bit of the input number.

8. The authentication method according to claim 1 further comprising the steps of:

providing a counter on the article, the counter configured to be read by the device;

periodically updating an article usage value in the counter as the article is used to reflect an

extent of usage or depletion of the article;

reading the article usage value by the device;

determining that the article is authentic only if the article usage value is greater than a predetermined value; and

permitting use of the article in the device if the article is authentic, and disabling use of the article in the device if the article is not authentic.

9. The authentication method according to claim 8 further comprising the steps of:

providing a table accessible by the device, the table containing the identification numbers

corresponding to a plurality of the articles used in the device;

each identification number having an associated entry in the table corresponding to a last read article usage value of each article used in the device;

determining that the article installed in the device is authentic only if its article usage value is less than the last read article usage value for the corresponding identification number in the table; and

permitting use of the article in the device if the article is authentic, and disabling use of the article in the device if the article is not authentic

10. The authentication method according to claim 1 further comprising the step of mounting an RFID transponder on the article wherein the identification number and the authentication number are stored in the RFID transponder.

11. The authentication method according to claim 1 further comprising the step of mounting an RFID transceiver on the device.

12. A device configured to authenticate an article installable in the device, the device comprising:

a reader adapted to read an identification number stored on the article, the identification number corresponding to an identification of the article;

the reader further adapted to read an authentication number stored on the article;

a memory of the device containing a computer program configured to transform the identification number into an output number and compare the output number to the authentication number; and

the article being authenticated only if the output number is equal to the authentication number, wherein use of the article in the device is permitted if the article is authentic, and use of the article in the device is not permitted if the article is not authentic.

13. The device according to claim 12 wherein the reader is a transceiver mounted on the device.

14. The device according to claim 12 wherein the computer program that transforms the identification number into an output number comprises:

a preparatory computer program in a memory of the device configured to transform the identification number into an intermediate number;

an encryption computer program in a memory of the device configured to encrypt the intermediate number to provide the output number; and

wherein the output number is compared to the authentication number to determine the authenticity of the article in the device.

15. The device according to claim 14 in which the preparatory computer program performs a one-to-one transform so that the intermediate number is equal to the identification number.

16. The device according to claim 12 wherein the reader is configured to read a media type number stored on the article.

17. The device according to claim 15 wherein the preparatory program uses the media type number as input to calculate the intermediate number.

18. The device according to claim 14 wherein the encryption computer program is contained in a computer readable medium that calculates (a) a second prime number raised to the power of the intermediate value (b) modulo a first prime number.

19. The device according to claim 18 wherein the second prime number is selected such that the second prime number is greater than 0, the second prime number is not equal to 1, and the second prime number is not equal to one-half of, the first prime number minus 1.

20. The device according to claim 18 wherein the encryption computer program contained in a computer readable medium further comprises:

a) a computer program initialization code segment that

(i) sets a multiplier equal to the second prime number;

(ii) sets the partial product equal to 1 if the least significant bit of the intermediate number is equal to 0;

(iii) sets the partial product equal to the multiplier modulo the first prime number if the least significant bit of the intermediate number is equal to 1;

b) a computer program partial product evaluation code segment that evaluates the partial product iteratively from the least significant bit of the intermediate number to the most significant bit of the intermediate number by

(i) doubling the multiplier;

(ii) resetting the partial product equal to the prior partial product modulo the first prime number if a next unevaluated bit of the intermediate number is equal to 0;

(iii) resetting the partial product equal to (a) the prior partial product times the modulo of the multiplier over the second prime number (b) modulo the second prime number, if said next unevaluated bit of the intermediate number is equal to 1;

c) terminates an iterative evaluation of the partial product after evaluating the partial product corresponding to the most significant bit of the intermediate number; and

d) outputs the final partial product as the output number.

21. The device according to claim 20 further comprising a memory for storing a table with an entry for each bit of the intermediate number, the contents of the entry being equal to the multiplier corresponding to that bit, modulo the first prime number.

22. The device according to claim 12 wherein the computer program includes code configured to produce a plurality of output numbers, and wherein the article is authenticated only if one of the plurality of output numbers is equal to the authentication number.

23. The device according to claim 12 further including a counter on the article, the counter configured to be read by the device wherein the reader reads an article usage value in the counter, the article usage value reflecting an extent of usage or depletion of the article.

24. The device according to claim 12 wherein the memory further includes

a table accessible by the device, the table containing the identification numbers corresponding to a plurality of the articles used in the device;

and

each identification number having an associated entry in the table corresponding to a last read article usage value of each article used in the device, and wherein the computer program determines that the article installed in the device is authentic only if its article usage value is less than the last read article usage value for the corresponding identification number in the table, and permits use of the article in the device if the article is authentic and disables use of the article in the device if the article is not authentic.

25. A host device configured to authenticate an article, the host device comprising:

means for reading an identification number stored on the article;

means for reading an authentication number stored on the article;

means for determining an input number based at least in part on the identification number;

means for applying an authentication function to the input number to calculate an output number;

means for determining that the article is authentic only if the authentication number corresponds to the output number, and means for permitting use of the article in the device if the article is authentic, and disabling use of the article in the device if the article is not authentic.

26. An article adapted to be authenticated by a host device, the article comprising a memory system configured to store a first predetermined number and an authentication number, the first predetermined number corresponding to an identification of the article.

27. The article according to claim 26 wherein the authentication number is calculated by applying an authentication algorithm to the first predetermined number.

28. The article according to claim 27 wherein the predetermined number is a unique, factory installed serial number.

29. The article according to claim 26 wherein the authentication number is calculated by:

providing a first prime number, Q;

providing a second prime number, M;

the second prime number being a primitive element of the prime Galois Field of the first prime number; and

calculating the output number according to the formula;

output number=M^N MOD Q, where N is the first predetermined number.

30. The article according to claim 29 wherein the second prime number is selected such that the second prime number is greater than 0, the second prime number is not equal to 1, and the second prime number is not equal to one-half of, the first prime number minus 1.

31. The article according to claim 29 wherein the step of determining the output number further comprises the steps of:

a) initializing a partial product by;

setting a multiplier equal to the second prime number;

setting the partial product equal to 1 if the least significant bit of the first predetermined number is equal to 0;

setting the partial product equal to the multiplier modulo the first prime number if the least significant bit of the predetermined number is equal to 1;

b) evaluating the partial product iteratively from the least significant bit of the first predetermined number to the most significant bit of the first predetermined number by;

doubling the multiplier;

resetting the partial product equal to the prior partial product modulo the first prime number if a next unevaluated bit of the first predetermined number is equal to 0;

resetting the partial product equal to (a) the prior partial product times the modulo of the multiplier over the second prime number (b) modulo the second prime number, if said next unevaluated bit of the first predetermined number is equal to 1; and

c) terminating the iteratively evaluation of the partial product after evaluating the partial product for the most significant bit of the first predetermined number.

32. A computer program product comprising:

a computer readable medium containing computer program code, the computer program code providing a first prime, a second prime number that is a primitive element of the prime Galois Field of the first prime number, and an input value, the computer program code having

a) a computer program code that initializes a partial product by

(i) setting a multiplier equal to the second prime number;

(ii) setting the partial product equal to 1 if the least significant bit of the input number is equal to 0;

(iii) setting the partial product equal to the multiplier modulo the first prime number if the least significant bit of the input number is equal to 1;

b) a computer program code that evaluates the partial product iteratively from the least significant bit of the input number to the most significant bit of the input number by

(i) doubling the multiplier;

(ii) resetting the partial product equal to the prior partial product modulo the first prime number if a next unevaluated bit of the input number equal to 0;

(iii) resetting the partial product equal to (a) the prior partial product times the modulo of the multiplier over the second prime number (b) modulo the second prime number, if said next unevaluated bit of the input number is equal to 1; and

wherein

c) a computer program code that terminates an iterative evaluation of the partial product after evaluating the partial product for the most significant bit of the input number. The computer program product according to claim 0, wherein the computer program code that iteratively evaluates the partial product further includes forming a table with an entry for each bit of the input number, the contents of the entry being equal to the multiplier corresponding to that bit, modulo the first prime number, wherein iterative evaluations of the partial product access the table entries.

33. An apparatus for determining a remainder of an integer division, the apparatus comprising:

a memory;

a dividend storage location in the memory;

an exponent storage location in the memory;

a subtrahend storage location in the memory;

a divisor storage location in the memory, the quantity stored in the divisor storage location being equal to the quantity stored in the subtrahend location subtracted from two raised to the power of the quantity stored in the exponent location;

a summation algorithm stored in the memory, the algorithm summing the terms of a series equal to the quotient of the quantity stored in the dividend storage location divided by the quantity stored in the divisor storage location, the algorithm halting with the first term of the series that is less than one half; and

a modulo algorithm stored in the computer memory that computes the remainder by subtracting from the quantity stored in the dividend storage location the quantity stored in the product of the quantity stored in the divisor storage location multiplied by the integer portion of the quantity determined by the summation algorithm.

34. For use with a thermal transfer, thermal or other printer, or photographic or X-ray camera, or other media processing system, a media assembly configured to identify and disable used of counterfeit media, the media assembly comprising an anti-counterfeiting provision having a data store containing encrypted data and reference data uniquely associated with the media assembly;

and a processor configured to access the encrypted data and reference data and configured to permit usage of the media if the media is not counterfeit.

35. The apparatus defined by claim 34 wherein the data store also holds reference data.

36. The assembly defined by claim 34 wherein said encrypted data represents a secure transform function of said reference data.

37. The assembly defined by claim 34 wherein said encrypted data is derived by applying an encryption algorithm to the reference data.

38. The assembly defined by claim 34 wherein said encrypted data is derived by employing a one-way function.

39. The assembly defined by claim 34 wherein said data store also contains media type data representing a type or model of the media.

40. The assembly defined by claim 34 wherein said anti-counterfeiting provision includes an RFID transponder.

41. The assembly defined by claim 40 wherein said transponder includes a memory which constitutes said data store.

42. The assembly defined by claim 41 wherein said anti-counterfeiting provision is responsive to electromagnetic signals in the visible, infra-red or ultraviolet spectra.

43. The apparatus defined by claim 34 wherein said data store is a transponder memory.

44. The apparatus defined by claim 34 wherein said anti-counterfeiting provision includes an RFID transponder having a memory constituting said data store.

45. The apparatus defined by claim 34 wherein said media processing system is a thermal transfer printer, and wherein said media is a thermal transfer ribbon.

46. The apparatus defined by claim 34 wherein said media processing system is a thermal transfer printer, and wherein said media is a direct thermal recording media.

47. For use with a thermal transfer, thermal or other printer, or photographic or X-ray camera, or other media processor, a media holder in the form of a spool having a shaft with an axis and an end flange, on which is located an antenna.

48. The apparatus defined by claim 47 wherein said antenna comprises at least one arcuate conductor concentric with said shaft axis.

49. The apparatus defined by claim 47 wherein said antenna comprises a series of coupled concentric circular conductors supported on said end flange of said spool.

50. The apparatus defined by claim 49 wherein said conductors comprise deposited traces.

51. The apparatus defined by claim 47 wherein said antenna is connected to a data memory.

52. The apparatus defined by claim 51 wherein said data memory contains encrypted data.

53. The apparatus defined by claim 47 wherein said antenna comprises part of a wireless transponder.

54. The apparatus defined by claim 53 wherein said transponder is an RFID transponder.

55. The system defined by claim 47 wherein said media processor includes a media usage counter configured to track media usage and store a usage indication on the media assembly.

56. The system defined by claim 55 wherein said usage indication is used to reject a media assembly having a recorded usage great than or equal to a predetermined usage value.

57. The system defined by claim 55 wherein said media processor is a laser printer.

58. A thermal transfer, thermal or other printer, or photographic or X-ray camera, or other media processing system adapted to identify a counterfeit media assembly, said system including a program configured to execute an encryption algorithm employed to validate a media assembly.

59. The system defined by claim 58 wherein said algorithm is executed in a secure microprocessor.

60. The system defined by claim 58 wherein said system includes a media processor, and wherein said program resides on said media processor.

61. The system defined by claim 58 wherein said system includes a media processor and a remote processing station, and wherein said program resides on said remote processing station.

62. The system defined by claim 58 wherein said encryption algorithm operates on data stored on the media assembly.

63. The system defined by claim 62 wherein said data includes reference data and encrypted data derived from said reference data.

64. The system defined by claim 63 wherein said encrypted data is developed employing said encryption algorithm.

65. The system defined by claim 58 wherein said encryption algorithm comprises a one-way function.

66. The system defined by claim 65 wherein said one-way function utilizes modulo arithmetic in a Galois Field.