WO2002043012A2

WO2002043012A2 - Method for producing a data carrier and data carrier

Info

Publication number: WO2002043012A2
Application number: PCT/DE2001/004146
Authority: WO
Inventors: Frank Kappe; Dirk Fischer; Hermann Rübbelke; Michael Hennemeyer-Schwenker
Original assignee: Orga Kartensysteme Gmbh
Priority date: 2000-11-25
Filing date: 2001-11-07
Publication date: 2002-05-30
Also published as: WO2002043012A3; AU2002221547A1; ES2447990T3; EP1380017B1; DE10058638A1; EP1380017A2

Abstract

The invention relates to a method for producing a data carrier such as an ID card or a credit card or a document of value or a security document. The data carrier comprises at least one first item of information (3) which is optically visible,especially readable, on the data carrier and is suitable for individualizing the data carrier in relation to other data carriers.The first item of information (3) is encrypted by means of an algorithm and the result of the encryption is stored on the data carrier in order to protect the data carrier against falsifications or manipulations.

Description

Process for producing a data carrier as well as a

disk

The invention relates to a method for producing a data carrier according to the preamble of claim 1 and to a data carrier produced in particular according to the method according to the preamble of claim 11.

The above data carriers are value or security documents, in particular identity cards or credit cards, which, in addition to general information, contain individual information such as user name, user portrait, serial number or the like person-specific, card-specific or document-specific

Show information. This individual or specific information is preferably the subject of counterfeiting and manipulation and must be secured accordingly.

From EP 0 906 834 A2 a data carrier with at least one individual piece of information is known, the individual piece of information comprising a serial number consisting of a first part and a second part. The first part and the second part of the serial number can have a different color and are thus on the

Data carrier applied that the complete serial number is reproduced. By dividing the serial number and the falsification and tamper protection is to be increased by register-accurate printing of the two parts. However, the division of the serial number and the color coding of the two parts are arbitrarily determined and applied to a variety of data carriers, such as banknotes, in the same form and in the same color, so that counterfeiting and manipulation cannot be excluded.

The invention is therefore based on the object of providing a method for producing a data carrier and a data carrier which has improved protection against forgery or manipulation.

This task is characterized by the characteristics of the independent

Claims resolved. Advantageous further developments are described in the subclaims.

A central idea of the method according to the invention is that a first piece of information that is individual

Information represents how the name of the authorized user of the data carrier is encrypted using an algorithm and the result of the encryption is stored on the data carrier. The result of the encryption represents additional information that cannot be decrypted by the general public. Only authorized persons who have the algorithm are able to decrypt the additional information and determine from the additional information whether forgeries or tampering have occurred. Advantageously, at least one character of the first piece of information is marked depending on the result of the encryption. Particularly preferred markings are colored or other visually visible markings of the characters of the first information in order to make it easier to check. Additionally or alternatively, the marking of the first information can be effected by other suitable markings, whereby suitable markings are understood to mean those markings which, if they are not visually recognizable, can be detected with corresponding aids, such as detectors or similar devices. For example, fluorescent or magnetic identifications of the characters of the first information can be provided.

The algorithm on which the encryption is based can be designed such that only a single piece of information, for example the first information, is included in the algorithm and the result is a marked first piece of information. In order to achieve more complex encryption, one or more second pieces of information, such as serial numbers or the like, are provided in addition to the first piece of information and can be included in the algorithm in addition to the first piece of information. The second information need not be provided on the data carrier in a visually visible or legible manner. They can be hidden and / or encrypted in the area or outside the area of the data carrier, which increases the counterfeit or tamper protection. To carry out the encryption, in particular when checking the data carrier, the second ones stored in this way are used Information converted into machine-readable or computer-processable characters.

The algorithm is essentially carried out using operators, with a large number of operators being available for this. Operators for bit manipulations, such as exclusive OR operators, or binary arithmetic operators, such as addition operators or modulo operators, are preferably used. These operators usually require two operands or information to make one

Perform linkage. However, they can also be applied to a single operand or to a single piece of information if, for example, the other operand is assigned a constant (number) value. Before applying the operators to the encryption (s)

Information (s) are or are expediently converted into numerical or integer numerical values, for example using the ASCII character set.

On the basis of these operators, encryption can be carried out in a simple manner, without starting from the result, i.e. based on the marked first information, conclusions can be drawn about the implementation of the marking or the specific implementation of the algorithm or the information included in the algorithm.

An advantageous step of the algorithm is that a sequence of digits is obtained by applying one or more suitable operators to the first and / or second information (s). Preferably, the sequence of

Digits have a limited number of different digit values. This can preferably be done with the help of binary modulo operator, which can be used in addition or as an alternative to the above-mentioned operators. The sequence of digits expediently has at least two different digit values, such as “0” or “1”, the digits or the digit values each being assigned a specific identifier, such as a color. The digits marked in this way are assigned to the characters of the first information, so that the characters of the first information receive an identification corresponding to the assigned digit. The generated in this way

Marking the first piece of information is easy to carry out and represents an effective measure to protect against counterfeiting or manipulation.

A counterfeit or manipulated data carrier can be easily identified by a check. As part of the check, the information (s) relevant for the implementation of the encryption is / are initially recorded. The algorithm is then applied to the information (s). By comparing the marking of the first information obtained using the algorithm with the marking of the first information stored on the data carrier, unauthorized interventions can be ascertained without problems.

The invention also relates to a data carrier, such as an identity card, credit card or similar value or security document. The data carrier according to the invention is produced in particular by the method described above. A core idea of the data carrier according to the invention is that the first information is encrypted in such a way that it is stored at least partially marked on the data carrier. The marking of the first Information represents an authenticity feature. It is therefore not possible to change the marked first piece of information or parts thereof without this being recognized during a check.

Of the markings of the first piece of information described at the outset, the visually recognizable markings, such as an alternating colored or differently written design of the characters of the first piece of information, are particularly preferred. These visually recognizable markings can be very advantageously integrated into the labeling process, for example if the data carrier is labeled with a laser (in color).

Other preferred and listed below

Embodiments of the invention provide that one or more second information (s) that are used to encrypt the first information are stored inaccessible to unauthorized persons.

According to an advantageous embodiment, the second information (s) is or are contained in a storage or additional element provided on the data carrier, such as an integrated circuit, magnetic strip or the like. Additionally or alternatively, the second information (s) can be provided outside the area of the data carrier, the second (s) information (s) preferably being stored in an external memory, for example in a central database or similar storage device is or are. This constructive measure makes it easier for authorized persons to check, since the second information (s) is open are easily detectable by reading them out of the above-mentioned memories. In addition, if the second information (s) is stored in this way, second information that is uniform for all data carriers can be provided.

A further simplified possibility of checking the data carrier according to the invention results according to a further preferred embodiment in that the information (s) provided for encryption and the algorithm itself are stored in the integrated circuit of the data carrier. For this purpose, the integrated circuit preferably comprises a microprocessor chip. Microprocessor chips are extremely difficult to manipulate and therefore allow the above data to be stored inaccessible to unauthorized persons. In this embodiment, it is particularly advantageous to be able to call up the result of the encryption directly from the data carrier or from the integrated circuit for the purpose of checking.

According to a further advantageous embodiment, the second information (s) is or are contained in a pictorial representation provided on the data carrier, the second (n) information preferably being encoded and / or hidden in the pictorial representation , This constructive measure is particularly suitable for ID cards or documents on which a pictorial representation in the form of a user portrait is applied. The user portrait represents personal information that is often subjected to forgery or manipulation, for example by the original user portrait being replaced by a new user portrait is replaced. By storing encrypted and / or hidden information in the pictorial representation, such manipulations are also removed or at least changed in such manipulations so that such an intervention can be determined.

The invention is explained in more detail below, also with regard to further features and advantages, on the basis of the description of exemplary embodiments and with reference to the accompanying drawings. It shows:

1 shows a data carrier according to the invention in plan view,

2 and 3 tables to illustrate the implementation of an encryption, and

Fig. 4 is a schematically illustrated arrangement for

Checking the data carrier according to the invention.

1 shows an embodiment of a data carrier 1 which represents an identification card. Individual information, in particular person- or card-specific information, such as user name 3, serial number 5, user portrait 10, birth dates of the user and the like, information is applied in a legible or visually visible manner on the data carrier 1. This individual information can be supplemented by a number of machine-readable characters or lines, which are provided in the specific embodiment in the lower area of the data carrier 1. The data carrier 1 can have an integrated circuit 2, which is expedient comprises a microprocessor chip. Alternatively or additionally, a magnetic strip (not shown) can be provided.

The user name 3 represents a first piece of information and comprises a defined number of characters 4 which are marked on the data carrier 1 such that each character 4 has a specific color. Instead of the differently colored or changing colored design of the characters 4, other suitable visually visible markings can be provided. For example, the characters 4 can differ in terms of their typeface in that the characters 4 are alternately applied to the data carrier 1 in normal, italic or bold type. Such markings can advantageously be integrated into the labeling process, the marked one

Username 3 or other marked first information is preferably applied to the data carrier 1 by means of laser printing, laser radiation, dye sublimation printing, thermal transfer printing or inkjet printing. Another possibility of labeling includes, for example, the use of fluorescent substances or magnetic materials which can be applied to or inserted into the data carrier 1 by means of suitable methods.

In order to avoid a transparent relationship between the characters 4 of the user name 3 and their respective colors, the user name 3 to be marked is encrypted on the basis of an algorithm. The encryption of the user name 3 is described below with reference to FIGS. 2 and 3 in the

Described in detail. 2 shows a table to illustrate the encryption. User name 3, consisting of last name and first name, is arranged character by character in line 11 of the table. The user name 3 is encrypted with the serial number 5, which represents a second piece of information intended for encryption. The serial number 5 has a defined number of characters 6 and is arranged character by character in line 13 of the table.

In a first step of encryption, the characters 4 of the user name and the characters 6 of the serial number 5 are converted into numerical or integer numerical values 7 and 8 using the ASCII character set, as shown in lines 12 and 14 of the table. In a further step, the numerical values 7 of the user name 3 and the numerical values 8 of the serial number 5 are linked to one another numerically or bitwise using an exclusive OR operator XOR. The result of this link is listed in line 15 of the table. Instead of the exclusive OR operator XOR, other suitable operators for bit manipulations or binary arithmetic operators, such as addition operators +, can be applied to the numerical values 7 and 8. In a further step, a modulo operator%, which is one of the binary arithmetic operators, is applied to the result of the above link. Using the modulo operator%, a sequence of digits 9 is obtained, which is listed in line 16 of the table. The digits 9 comprise a defined number of different digit values, the number of different digit values being determined by the choice of a divisor T of the modulo operator%. Is the divisor T of

If modulo operator% is assigned the value "2", two different numerical values "0 and" 1 "are obtained, as in line 16 of the Table is shown. In a further step, the numbers 9 or the different number values in line 16 of the table are each assigned a specific color or other identification so that each number 9 represents a specific color. For example, the digits 9 with the digit value "0" are assigned the color blue, the color blue being illustrated by the symbol o. The digits 9 with the digit value "1" are assigned the color red, the color red being indicated by the symbol * is marked. The numbers 9 marked in color in this way are added to another

Step assigned to the characters 4 of the user name 3, as shown in line 17 of the table, so that the characters 4 are given a color corresponding to the assigned number 9.

The choice of the divider T of the modulo operator% essentially depends on how many colors or other markings are to be used. If you want to mark the user name 3 with 3 different colors, for example, the divider T is set to the value "3", as shown in line 18 of the table. This means that a total of three different numerical values "0", "1" and "2 "to which a specific color is assigned. A further color, for example the color green, is assigned to the newly added digit value "2", the color green being identified by the symbol Δ. In a further step, the color-coded digits 9 are assigned to the characters 4 of the user name 3, so that from this a tricolor user name 3 results, as shown in line 19 of the table.

Another exemplary embodiment for encrypting the user name 3 is shown in FIG. 3 on the basis of a second table clarified. The second user information 3 intended for encryption is provided in a modified form. The modified user name 3a comprises characters 4a and is arranged in line 13a of the table. The modified user name 3a is obtained by shifting the user name 3 arranged in line 11a to the right by one character position and placing the character “k” at the right end of the line at the beginning of the line. Alternatively, the user name 3 can be moved by several character positions or are changed in another way, so that a modified form of the user name 3 is obtained. Analogous to the previous example according to FIG. 2, the characters 4 of the user name 3 and the characters 4a of the modified user name 3a are converted into numerical or converted integer values 7 and 7a, which are shown in lines 12a and 14a, the exclusive OR operator XOR is applied to the number values 7 and 7a and the result of the combination shown in line 15a is obtained the divider T is equal to "2" (see line 16a) or alternatively the modulo -Operator% with the divisor T equal to "3" (see line 18a) is applied to the result shown in line 15a in order to obtain a sequence of digits 9. As already mentioned above, the numbers 9 have a defined number of different number values depending on the choice or value of the divider T. The assignment of defined or different colors is carried out analogously to the example described above in accordance with FIG. 2. It can be clearly seen that by using only different second information, namely by the

Use of the modified user name 3a instead of the serial number 5, a completely different marking of the User name 3 results as shown in lines 17a and 19a of the table.

Instead of the exclusive OR operator XOR, for example, the addition operator + or similar operators can be applied to the numerical values 7 of the user name 3 and to the numerical values 8 or 7a of the serial number 5 or the modified user name 3a. To achieve more complex encryption, several operators can also be applied to the numerical values 7, 8 and 7a above.

According to the invention, any visually visible, individual or first information provided on the data carrier 1 can be marked on the basis of the algorithm described above. It is not necessary that the user name 3 or other first information to be marked is always linked with the serial number 5, the modified user name 3a or some other second information. For example, the serial number 5 can be linked to the modified user name 3a in order to obtain a sequence of numbers 9.

It is essential that, as a result of the encryption, the characters 4 of the user name 3 are assigned a defined color or another identification suitable for distinguishing the characters 4, as in lines 17 and 19 of the table in FIG. 2 and in lines 17a and 19a 3 is shown in the table.

According to a further embodiment, the serial number 5, the modified user name 3a or similar second information is contained in the integrated circuit 2 of the data carrier 1. Alternatively, this information can be on a

Magnetic strips (not shown) of the data carrier 1 can be stored. Another way to increase protection against Counterfeiting and manipulation consists in the fact that, for example, the serial number 5 and / or the modified user name 3a are provided outside the area of the data carrier 1 in accordance with a further embodiment and are preferably stored in an external memory 23 (cf. FIG. 4). A central database secured against unauthorized access serves as external memory 23. With such a secure storage, for example, second piece of information for encrypting the respective user name 3 or similar first piece of information, which is uniform for all data carriers 1, can be provided.

In addition to the personal and card-specific names and inscriptions, the data carrier 1 has a user portrait 10 or another pictorial representation. According to a further advantageous embodiment, for example the serial number 5 and / or the modified user name 3a is stored in the user portrait 10 (not shown). The serial number 5 and / or the modified user name 3a can be encrypted, for example as

A barcode is present, such information being stored or stored preferably using a steganographic method.

Additionally or alternatively, the serial number 5 and / or the modified user name 3a can be hidden in the user portrait 10. The hidden arrangement of the serial number 5 and / or the modified user name 3a takes place in the form of a secondary image, for example in the form of the barcode mentioned above, the secondary image in the

User portrait 10, which is a primary image, such it is hidden that it can only be recognized by means of a decoder or the like.

An arrangement for checking the data carrier 1 is shown schematically in FIG. 4.

To check the data carrier 1, the marked user name 3 or another marked first piece of information as well as the serial number 5 intended for encryption or other second information intended for encryption is recorded and digitized by a camera 20 or an optical scanner. The recorded image data of the user name 3 and the serial number 5 are evaluated in a downstream microprocessor 21 and converted into computer-processable characters 4 and 6 by means of optical character recognition (OCR). The computer-processable characters 4 and 6 of the user name 3 and the serial number 5 are fed to a verification unit 22. In this verification unit 22, the algorithm described above is based on the characters 4 of the user name

3 and applied to the characters 6 of the serial number 5 and the marking of the user name 3 is determined again. If the determined marking of the user name 3 is identical to the marking of the user name 3 stored on the data carrier, the data carrier 1 is considered to be genuine.

If the user name 3, the serial number 5 or other first and / or second information intended for encryption are stored in the integrated circuit 2 or magnetic stripe, this information is read out via a card reader 24 and sent to the verification unit 22. Is this information If they are stored in an external memory 23 outside the area of the data carrier 1, they can be called up from the external memory 23 and fed to the verification unit 22.

According to a further embodiment, the user name 3, the serial number 5 or other information provided for encryption and the algorithm are stored in the integrated circuit 2, the integrated circuit 2 expediently comprising a microprocessor chip. In this embodiment, the data carrier 1 can be checked directly by means of the microprocessor chip.

Overall, the method according to the invention and the data carrier according to the invention are characterized by an efficient one

Protection against counterfeiting and manipulation, as well as cost-effective manufacture. The encryption described above can be made arbitrarily complex due to the large number of available operators. In addition, encryption can be used to effect a defined marking of one or more pieces of information on the data carrier, the coding of which is only accessible to authorized persons.

Reference symbol list:

1 disk

2 integrated circuit 3 user name

3a modified username

4 characters (username)

4a characters (modified username)

5 serial number 6 characters (serial number)

7 numerical value (user name)

7a numerical value (modified user name)

8 numerical value (serial number)

9 digits 10 user portrait

11 - 19 table rows lla-19a table rows

20 camera

21 microprocessor 22 verification unit

23 memory

24 card readers

XOR exclusive OR operator% modulo operator

+ Addition operator

T divider red color o blue color Δ green color

Claims

Process for producing a data carrier and a data carrier

1. A method for producing a data carrier, such as an identity card, a credit card or the like value or security document, comprising at least first information (3) that is provided and suitable for the visually visible, in particular legible on the data carrier, the data carrier from a row individualization of data carriers, characterized in that the first information (3) is encrypted by means of an algorithm and the result of the encryption is stored on the data carrier.

2. The method according to claim 1, characterized in that the first information (3) comprises a defined number of characters (4), and that the result of the encryption is stored on the data carrier such that at least one character (4) of the first information (3) is marked.

3. The method according to claim 1 or 2, characterized in that the marking of the characters (4) of the first information (3) is effected by a different, in particular visually visible, identification of the characters (4), such as a different colored or graphic design of the characters (4).

4. The method according to any one of claims 1 to 3, characterized in that at least second information (3a, 5) is provided, which is intended for encrypting the first information (3).

5. The method according to any one of claims 1 to 4, characterized in that the at least one second information (3a, 5) for encryption characters (4a, 6), in particular machine-readable or computer-processable characters (4a, 6) or to machine-readable or computer-convertible characters are converted11.

6. The method according to any one of claims 1 to 5, characterized in that the algorithm on which the encryption is based comprises the following steps:

1) converting the characters (4) of the first information (3) and / or the characters (4a, 6) of the second information (s) (3a, 5) into numerical or integer numerical values (7; 7a, 8), for example based on the ASCII character set, and 2) Apply at least one operator to the numerical values

(7) the first piece of information (3) and / or the numerical values (7a, 8) of the second piece of information (3a, 5), such that this results in a sequence of digits (9), and

3) marking the numbers (9) in such a way that at least one number (9) has a specific identification, such as a specific color, and

4) Assigning the numbers (9) with identifications to the characters of the first information (3) in such a way that at least one character (4) of the first information (3) receives an identification corresponding to the assigned number (9).

7. The method according to claim 6, characterized in that the at least one operator is selected from a group of operators, the group of operators preferably operators for bit manipulations, such as exclusive OR operators (XOR), and binary arithmetic operators, such as Addition operators (+). Modulo operators (%) or similar operators.

8. The method according to claim 6 or 7, characterized in that the sequence of digits obtained (9) has a defined number of different digit values, the number of different digit values by the choice of one

Divider of the binary modulo operator (%) is specified.

9. The method according to any one of claims 1 to 8, characterized in that the data carrier can be checked with regard to forgeries or manipulations, the algorithm on which the encryption is based being used to check the data carrier.

10. The method according to claim 9, characterized in that the checking of the data carrier comprises the following steps:

5) ascertaining or capturing the first information (3) and / or second information (s) (3a, 5) intended for performing the encryption,

6) applying the algorithm to the first information (3) and / or to the second information (3a, 5), and

7) Comparison of the marking of the first information (3) obtained from the result of the algorithm with that on the

Marking of the first information (3).

11. Data carriers, such as ID, credit card or similar value or security document, in particular according to one of the

Claims 1 to 10, with at least a first piece of information (3), which is provided visually visible, in particular legible, on the data carrier and is suitable for individualizing the data carrier from a number of data carriers, characterized in that that the first piece of information (3) is encrypted in such a way that it is stored at least partially marked on the data carrier.

12. Data carrier according to claim 11, characterized in that the first information (3) comprises a defined number of characters (4), the characters (4) being marked such that they differ in terms of their color or by other identifiable identifiers, such as typographic design, distinguish.

13. A data carrier according to claim 11 or 12, characterized in that at least second information (3a, 5) is provided, which is used to encrypt the first information (3).

14. Data carrier according to one of claims 11 to 13, characterized in that the first information (3) and / or the second (n) information (s) (3a, 5) person-, card- or document-specific names or inscriptions, such as a user name (3), a serial number (5) or the like include individual information that is provided in particular on the data carrier.

15. A data carrier according to claim 14, characterized in that the at least one second information (3a) is at least partially identical in content to the first information (3).

16. Data carrier according to one of claims 11 to 15, characterized in that the second information (s) (3a, 5) is or are contained in a storage or additional element provided on the data carrier, such as an integrated circuit (2), a magnetic strip or the like, and / or is or are provided outside the area of the data carrier, the second information (s) (3a, 5) preferably being stored in an external memory (23), for example in a central database or similar storage device.

17. Data carrier according to one of claims 11 to 16, characterized in that the encryption is based on an algorithm which in addition to the first information (3) and / or to the second information (s) (3a, 5) the integrated

Circuit (2) of the data carrier is stored, the integrated circuit (2) preferably comprising a microprocessor chip.

18. Data carrier according to one of claims 11 to 17, characterized in that the second (n) information (s) (3a, 5) is or are contained in a pictorial representation (10) provided on the data carrier, the second ( n) Information (s) (3a, 5) preferably encrypted and / or hidden in the pictorial

Representation (10) is or are stored.

19. Data carrier according to one of claims 11 to 18, characterized in that the in particular color-marked first information (3) by means of laser printing, laser radiation, dye sublimation printing, Thermal transfer printing, inkjet printing or the like printing process is applied to the data carrier.

20. Device for producing and / or checking a

Data carrier, characterized in that the device for producing and / or checking a

Data carrier has been modified according to one of the above claims.