Patent Application
20100142756
This application claims the right of priority under 35 U.S.C. §119 based on Australian Patent Application No. 2008255227, filed 10 Dec. 2008, which is incorporated by reference herein in its entirety as if fully set forth herein.
The current invention relates to document security and in particular to methods of detecting areas of documents which have been tampered with.
It is often desirable to ensure that an original printed document (referred to as the “original document” or the “unprotected document”) has not been copied, altered or tampered with in some unauthorized manner from the time the document was first printed. An unauthorised amendment is referred to as an example of “tampering”. An unauthorized copying is referred to as an example of an “attack”. The act of tampering is one example of an attack.
A contract that has been agreed upon and signed on some date may subsequently be fraudulently altered. It is desirable to be able to detect such tampering in detail. Similarly, documents such as cheques and monetary instruments record values, which are vulnerable to fraudulent alteration. Detection of any fraudulent alteration in such documents is also desirable. Further, it is desirable that such detection be performed automatically, and that the detection reveals the nature of any alteration.
One current way to approach this problem utilises a two-dimensional (2D) barcode or watermark printed on the original document to encode information about the original state of the original printed document. Information incorporated into a document for such purposes are referred to as ‘protection marks”. An original document into which protection marks have been incorporated is referred to as a “protected document”. The term “document” when used alone may refer to either an original document or a protected document, this being clear from the context. The advantage of the above-noted 2D protection mark approach is that the barcode encoding information about the printed document is co-located with, or close to, the document content it encodes. This makes the document largely self contained and also affords a number of security advantages making the protected document difficult to forge or alter. The 2D barcode is one example of a “security feature”, this being a term used to denote information that is printed on the document in order to facilitate detection and/or prevention of an attack.
The term “information content” (also referred to as document information content) is used in this description to denote the information content of the original document. In a more general sense, the document information content can also denote a characteristic of the document substrate, ie a characteristic of the physical medium upon which the document information content is printed. The term “protection content” is used to denote the information contained in the security feature(s).
Adding complementary security features to a document may improve the ability to detect attacks and damage to the protected document. Complementary features may take the form of a second 2D barcode, other visually observable security features such as watermarks, holograms or other high end printing processes, or may even be part of the first 2D barcode. These complementary security features typically perform some security function which complements but is different to the first security function. However, there is generally a strong relationship between the space on a document which is used by a 2D barcode, and the data capacity of the 2D barcode. While the benefits of combining multiple security features in a document are considerable, care must be taken to avoid limiting the performance of existing security features by taking up additional space on the document for additional security features.
One anti-tamper approach employs a series of low visibility protection marks, which encode information about the image information content of the document. Such methods allow the information about the image content of the document to be distributed across the entire document, making it harder to circumvent the protection afforded by the protection marks, as any damage to the page will constitute damage to the protection marks. When using this approach, however, it is difficult to add complimentary security features, as additional features which either share the protection marks and/or obscure parts of the protection marks generally result in a degradation in the overall performance of the protection.
It is an object of the present invention to substantially overcome, or at least ameliorate, one or more disadvantages of existing arrangements.
Disclosed are arrangements (referred to as Spatially Related Data Channel or SRDC arrangements) which seek to address at least some of the above problems by separating protection marks into two data channels, where one of the channels can carry arbitrary information, while the other channel encodes security anti-tamper information for those regions of the document associated with both channels. This approach obviates the need to use the first channel for the anti-tamper function, and thus minimises constraints on the use of the first channel.
According to a first aspect of the present invention, there is provided a method of creating a protected document, the method comprising the steps of:
(a) providing a document having a plurality of marks encoding a security feature of the document, the plurality of marks having a structured arrangement corresponding to a plurality of areas, each area comprising a first region for storing security data and a second region for storing information related to an anti-tamper attribute of the first region;
(b) determining, based on the structured arrangement and a predetermined mapping for each said area, a correspondence between the first and second regions; and
(c) modulating the marks in the second regions to at least encode a characteristic of the first regions, wherein the modulated marks provide anti-tamper protection for the first region to create the protected document.
According to another aspect of the present invention, there is provided a method of protecting a document containing document information content, the method comprising the steps of:
defining a grid over the document the grid having grid intersection points whose locations relative to each other are predefined;
separating the grid intersection points into a repeating pattern of points, wherein each member of the repeating pattern comprises two subsets of points having a predefined spatial relationship, said subsets of points being associated with corresponding regions of the document; and
modulating, with respect to each member of the repeating pattern, protection mark attributes of protection marks associated with one of said subsets of points, to thereby encode information about the document information content of the regions of the document associated with both said subsets of points.
According to another aspect of the present invention, there is provided a method of creating a security document, the method comprising the steps of:
(a) providing a document having a plurality of marks encoding a security feature of the document, the plurality of marks having a structured arrangement corresponding to a plurality of areas, each area comprising a first region for storing security data comprising a repeating pattern of dots, and a second region for storing information related to an anti-tamper attribute of the area;
(b) determining, based on the structured arrangement and a predetermined mapping for each said area, a correspondence between the second regions and the entire area; and
(c) modulating some marks in the second region to encode a characteristic of the area, wherein the modulated marks provide an anti-tamper protection for the area to create the security document.
According to another aspect of the present invention, there is provided a method of decoding a protected document, the method comprising the steps of:
(a) providing a document having a plurality of modulated marks encoding a security feature of the document, the plurality of marks having a structured arrangement corresponding to a plurality of areas, each area comprising a first region for storing security data and a second region for storing information related to an anti-tamper attribute of the first region;
(b) determining, based on the structured arrangement and a predetermined mapping for each said area, a correspondence between the first and second regions; and
(c) demodulating the marks in the second regions to recover an anti-tamper protection characteristic of the first regions.
According to another aspect of the present invention, there is provided an apparatus for implementing any one of the aforementioned methods.
According to another aspect of the present invention there is provided a computer program product including a computer readable medium having recorded thereon a computer program for implementing any one of the aforementioned methods.
Other aspects of the invention are also disclosed.
One or more embodiments of the invention will now be described with reference to the following drawings, in which:
Where reference is made in any one or more of the accompanying drawings to steps and/or features, which have the same reference numerals, those steps and/or features have for the purposes of this description the same function(s) or operation(s), unless the contrary intention appears.
It is to be noted that the discussions contained in the “Background” section and that above relating to prior art arrangements relate to discussions of arrangements which form public knowledge through their use. Such discussions should not be interpreted as a representation by the present inventor(s) or the patent applicant that arrangements in any way form part of the common general knowledge in the art.
As previously noted, the term “information content” (also referred to as document information content) is used in this description to denote the information content of the original document. In a more general sense, the document information content can also denote a characteristic of the document substrate, ie a characteristic of the physical medium upon which the document information content is printed. The term “protection content” is used to denote the information contained in the security feature(s).
As seen in
The computer module 101 typically includes at least one processor unit 105, and a memory unit 106 for example formed from semiconductor random access memory (RAM) and semiconductor read only memory (ROM). The module 101 also includes an number of input/output (I/O) interfaces including an audio-video interface 107 that couples to the video display 114, loudspeakers 117 and microphone 180, an I/O interface 113 for the keyboard 102, mouse 103, scanner 126, camera 127 and optionally a joystick (not illustrated), and an interface 108 for the external modem 116 and printer 115. In some implementations, the modem 116 may be incorporated within the computer module 101, for example within the interface 108. The computer module 101 also has a local network interface 111 which, via a connection 123, permits coupling of the computer system 100 to a local computer network 122, known as a Local Area Network (LAN). As also illustrated, the local network 122 may also couple to the wide network 120 via a connection 124, which would typically include a so-called “firewall” device or device of similar functionality. The interface 111 may be formed by an Ethernet™ circuit card, a Bluetooth™ wireless arrangement or an IEEE 802.11 wireless arrangement.
The interfaces 108 and 113 may afford either or both of serial and parallel connectivity, the former typically being implemented according to the Universal Serial Bus (USB) standards and having corresponding USB connectors (not illustrated). Storage devices 109 are provided and typically include a hard disk drive (HDD) 110. Other storage devices such as a floppy disk drive and a magnetic tape drive (not illustrated) may also be used. An optical disk drive 112 is typically provided to act as a non-volatile source of data. Portable memory devices, such optical disks (eg: CD-ROM, DVD), USB-RAM, and floppy disks for example may then be used as appropriate sources of data to the system 100.
The components 105 to 113 of the computer module 101 typically communicate via an interconnected bus 104 and in a manner which results in a conventional mode of operation of the computer system 100 known to those in the relevant art. Examples of computers on which the described arrangements can be practiced include IBM-PC' s and compatibles, Sun Sparcstations, Apple Mac™ or alike computer systems evolved therefrom.
The SRDC method may be implemented using the computer system 100 wherein the processes of
The software 133 is generally loaded into the computer system 100 from a computer readable medium, and is then typically stored in the HDD 110, as illustrated in
Computer readable storage media refers to any storage medium that participates in providing instructions and/or data to the computer system 100 for execution and/or processing. Examples of such storage media include floppy disks, magnetic tape, CD-ROM, a hard disk drive, a ROM or integrated circuit, USB memory, a magneto-optical disk, or a computer readable card such as a PCMCIA card and the like, whether or not such devices are internal or external of the computer module 101.
Examples of computer readable transmission media that may also participate in the provision of software, application programs, instructions and/or data to the computer module 101 include radio or infra-red transmission channels as well as a network connection to another computer or networked device, and the Internet or Intranets including e-mail transmissions and information recorded on Websites and the like.
The second part of the SRDC application programs 133 and the corresponding code modules mentioned above may be executed to implement one or more graphical user interfaces (GUIs) to be rendered or otherwise represented upon the display 114. Through manipulation of typically the keyboard 102 and the mouse 103, a user of the computer system 100 and the SRDC application may manipulate the interface in a functionally adaptable manner to provide controlling commands and/or input to the applications associated with the GUI(s). Other forms of functionally adaptable user interfaces may also be implemented, such as an audio interface utilizing speech prompts output via the loudspeakers 117 and user voice commands input via the microphone 180.
A document to be protected using the SRDC approach as described below, may be stored in an electronic file of a file-system configured within the memory 106 or the hard disk drive 110 of the computer module 101, for example. Similarly, the data read from a security document may also be stored in the hard disk drive 110 or the memory 106 upon the security document being read. Alternatively, the document to be protected may be generated on-the-fly by a software application program resident on the hard disk drive 110 and being controlled in its execution by the processor 105. The data read from a security document may also be processed by such an application program.
The digital representation of the document to be protected may be acquired by scanning using the scanner 126. Similarly, the data read from a security document may be acquired using the scanner 126.
When the computer module 101 is initially powered up, a power-on self-test (POST) program 150 executes. The POST program 150 is typically stored in a ROM 149 of the semiconductor memory 106. A program permanently stored in a hardware device such as the ROM 149 is sometimes referred to as firmware. The POST program 150 examines hardware within the computer module 101 to ensure proper functioning, and typically checks the processor 105, the memory (109, 106), and a basic input-output systems software (BIOS) module 151, also typically stored in the ROM 149, for correct operation. Once the POST program 150 has run successfully, the BIOS 151 activates the hard disk drive 110. Activation of the hard disk drive 110 causes a bootstrap loader program 152 that is resident on the hard disk drive 110 to execute via the processor 105. This loads an operating system 153 into the RAM memory 106 upon which the operating system 153 commences operation. The operating system 153 is a system level application, executable by the processor 105, to fulfil various high level functions, including processor management, memory management, device management, storage management, software application interface, and generic user interface.
The operating system 153 manages the memory (109, 106) in order to ensure that each process or application running on the computer module 101 has sufficient memory in which to execute without colliding with memory allocated to another process. Furthermore, the different types of memory available in the system 100 must be used properly so that each process can run effectively. Accordingly, the aggregated memory 134 is not intended to illustrate how particular segments of memory are allocated (unless otherwise stated), but rather to provide a general view of the memory accessible by the computer system 100 and how such is used.
The processor 105 includes a number of functional modules including a control unit 139, an arithmetic logic unit (ALU) 140, and a local or internal memory 148, sometimes called a cache memory. The cache memory 148 typically includes a number of storage registers 144-146 in a register section. One or more internal buses 141 functionally interconnect these functional modules. The processor 105 typically also has one or more interfaces 142 for communicating with external devices via the system bus 104, using a connection 118.
The SRDC application program 133 includes a sequence of instructions 131 that may include conditional branch and loop instructions. The program 133 may also include data 132 which is used in execution of the program 133. The instructions 131 and the data 132 are stored in memory locations 128-130 and 135-137 respectively. Depending upon the relative size of the instructions 131 and the memory locations 128-130, a particular instruction may be stored in a single memory location as depicted by the instruction shown in the memory location 130. Alternately, an instruction may be segmented into a number of parts each of which is stored in a separate memory location, as depicted by the instruction segments shown in the memory locations 128-129.
In general, the processor 105 is given a set of instructions which are executed therein. The processor 105 then waits for a subsequent input, to which it reacts to by executing another set of instructions. Each input may be provided from one or more of a number of sources, including data generated by one or more of the input devices 102, 103, 126, 127, data received from an external source across one of the networks 120, 122, data retrieved from one of the storage devices 106, 109 or data retrieved from a storage medium 125 inserted into the corresponding reader 112. The execution of a set of the instructions may in some cases result in output of data. Execution may also involve storing data or variables to the memory 134.
The disclosed SRDC arrangements use input variables 154, that are stored in the memory 134 in corresponding memory locations 155-158. The SRDC arrangements produce output variables 161, that are stored in the memory 134 in corresponding memory locations 162-165. Intermediate variables may be stored in memory locations 159, 160, 166 and 167.
The register section 144-146, the arithmetic logic unit (ALU) 140, and the control unit 139 of the processor 105 work together to perform sequences of micro-operations needed to perform “fetch, decode, and execute” cycles for every instruction in the instruction set making up the program 133. Each fetch, decode, and execute cycle comprises:
(a) a fetch operation, which fetches or reads an instruction 131 from a memory location 128;
(b) a decode operation in which the control unit 139 determines which instruction has been fetched; and
(c) an execute operation in which the control unit 139 and/or the ALU 140 execute the instruction.
Thereafter, a further fetch, decode, and execute cycle for the next instruction may be executed. Similarly, a store cycle may be performed by which the control unit 139 stores or writes a value to a memory location 132.
Each step or sub-process in the processes of
The SRDC method may alternatively be implemented in dedicated hardware such as one or more gate arrays and/or integrated circuits performing the SRDC functions or sub functions. Such dedicated hardware may also include graphic processors, digital signal processors, or one or more microprocessors and associated memories. If gate arrays are used, the process flow charts in
The term ‘protected document’ refers to a document with security features incorporated into the document that allow for protection of the document from attacks such as forgery, unauthorized copying or the like. Thus an original (unprotected) document (see (E) in 2902 in
The dots 208 in
Protection marks generally have a number of associated protection mark attributes including a position attribute, an intensity attribute, a shape attribute (also referred to as a symbol attribute) and so on. The described examples are based upon modulation of the position attribute. However, other modulation schemes (see (D) in 2902 in
In position based modulation, different dot positions are used to denote the value to be associated with the protection dot in question. In the modulation scheme depicted in
Each protection dot 202 is located in the vicinity of a corresponding grid intersection point 203 of the reference grid. In one SRDC arrangement the reference grid is a regular square grid 205 formed by horizontal lines 201 and vertical lines 204. It is noted that it is the protection dots 202 that provide the protection, and not the alignment dots such as 209 or the grid 205. The grid 205 is depicted purely to provide a frame of reference for describing the location of the alignment dots 209 and the protection dots 202, and accordingly the grid 205 may be considered to be a “virtual” grid.
A grid cell refers to a single grid intersection point (having a corresponding grid intersection point location coordinates) with (i) an associated protection dot, (ii) a series of associated values and (iii) an associated assigned value. Accordingly, a grid cell can be represented, in one SRDC arrangement, by the following data structure:
(x1,y1) grid intersection point location [1]
(a) assigned value [2]
(x3,y3) protection mark location [3]
(aa1, aa2, . . , aan) associated values [4]
where an “assigned value” is the value by which the protection dot is to be modulated, and an “associated value” is one of possibly a number of intermediary values which are used to calculate the assigned value and may include ancillary binary data.
The protection dot associated with a particular grid cell is directly observable on the protected document 200, meaning that the protection mark can be observed and measured directly and need not be derived from other properties of or information in the document. It is noted that the protection marks may be visible to a person (in order for example to announce that the document is protected and thus deter unauthorised amendments). However, the protection marks may also be invisible to a person, and yet are directly observable in that they are detectable (by the appropriate detection devices) and can be detected by a decoding system. The associated values and the assigned values are typically not directly observable on the protected document 200, but are merely associated with the grid cell in question. The associated values and the assigned values serve to describe the encoding/decoding processes.
Grid cells may be interchangeably viewed as either data structures which may be stored on a computer containing these values, or as physical entities on a page consisting of the grid intersection point together with (i) the associated protection dot, (ii) the series of associated values and (iii) an associated assigned value.
In use in the examples described, the positions of the protection dots 202 in the array 206 of protection dots are spatially modulated relative to their corresponding grid intersection points of the grid 205. The result of this modulation, having regard to a particular protection dot, is to move the protection dot (such as 302 in
The example described with reference to
While the described arrangements make use of rectangular, and preferably square, regular grid arrangements, other grid arrangements are possible provided that the grid intersection points of the grid can be estimated. For example, grid arrangements having hexagonal or parallelogram grid shapes can be used. Furthermore, a grid formed by concentric circles and radii, which may be considered regular in terms of r and θ, can also be used. What is required is that the relative locations of the grid intersection points (ie the positions upon which or about which unmodulated protection marks are situated) be predefined in a known manner, thereby forming a basis for determining the positions of modulated protection marks depending upon the type of encoding used. Accordingly, once the grid 400, or the manner in which the grid 400 is formed, is known, then given the modulation scheme, the marks on an encoded protected document 200 may be decoded.
In a subsequent step 603 the protection dots 402 are separated (ie allocated) into two separate “channels” where the term “channel” is used to denote the fact that each channel can carry a certain amount of information (see (B) in 2902 in
In one SRDC example the first channel consists of a first pattern of protection dots that are not available to the second channel. In other words, the protection dots used for the first channel are distinct from the protection dots used for the second channel. This first channel contains a first security feature, and the protection dots 402 belonging to the first channel are disposed on the document 715 in a regular or otherwise predictable pattern, this allowing the location of the protection marks 402 to be predicted. The protection dots 402 belonging to the first channel can be located in an area of the page 715 in which the protection dots 402 are obfuscated (ie rendered difficult to interpret) by page content such as printed images in some known fashion. For example, a document may contain a number of full colour images which will obfuscate dots of the first channel. If the locations of these images are known to both the encoding and decoding sides of the process then the pattern by which the protection dots are disposed may be deduced from the pattern of dot loss.
In this SRDC example the first channel encodes a first security feature that takes the form of a repeating tiled pattern each pattern being used to store an identical message (referred to elsewhere as an LDD Message). This results in a redundantly stored message that is repeated across the protected document.
The second channel consists of a second pattern of protection dots that encodes a second security feature that encodes information about the information content of the original document. The protection dots 402 of the second channel, and the document content which is the subject of the second security feature, are located in distinct respective areas of the document whose relative locations are defined by a predefined spatial relationship. The second channel encodes a second security feature that takes the form of a repeating tiled pattern.
Another way of looking at the tiled arrangement is as a repeating pattern (ie set) of points (this pattern corresponding to the large tiles), where each member of the repeating pattern comprises two subsets of points (where the two subsets correspond, having regard to a particular large tile containing a small tile, to the points in the small tile and the residual points in the large tile) having a predefined spatial relationship, said subsets of points being associated with corresponding regions of the document.
One such tile 701 and the corresponding representation 718 in the tiled grid structure 717 is depicted by a dashed arrow 717. As will be described below, a first channel which encodes a first security feature comprises protection dots in the repeating pattern of the small tiles such as 707. Each small tile contains an identically modulated set of protection dots which make up the first channel and the first security feature. The second channel which encodes a second security feature comprises protection dots in the repeating pattern formed by the residual area of each large tile after excluding the small tile contained in each large tile. Each of the aforementioned residual areas associated with the second security feature contain a modulated set of protection dots which make up the second channel and the second security feature.
In one example the first security feature is a code which can be recognized by a suitably equipped photocopier which disables the copying function of the photocopier upon detection of the first security feature unless a suitable password is manually entered into the photocopier keypad. The second security feature contains protection dots which relate to the information content of both the residual areas of the large tiles and to the information content of the small tiles. In this example, the first security feature is related to the prevention of unauthorised copying of the document of which 713 is a fragment. The second security feature is related to anti-tamper capability, ie prevention of tampering to the document, and performs this function both in relation to tampering with the information content of the small tiles such as 707, and tampering with the information content in the residual areas of the large tiles such as 711.
The predefined relative spatial relationship between the small tiles and the residual areas of the large tiles is depicted by the predefined geometric relationships between these areas on the fragment 713 of the page shown in
Returning to a more detailed description of
Examples 700 of the LDD channel tiles shown in
The LDD channel tiles are tiled redundantly across the grid 400 at a spacing of HDD tile spacing 714, also in units of grid cells. The LDD channel tiles are embedded in the HDD channel tiles 709, 710, 711 and 712. The HDD channel tiles 709, 710, 711 and 712 have dimensions of HDD tile size as indicated at 714, and are tiled redundantly across the grid at a spacing of HDD tile size. The term “tiled redundantly” (in regard to LDD tiles, as HDD tiles are not tiled), means that each tile contains the same protection information comprising a set of identically modulated protection dots.
Areas 709, 710, 711 and 712 constitute the HDD channel, which is present across the grid 400 on the fragment 713 of the page in question. The HDD channel consists of areas in the tiles which are not designated as LDD channel tiles 705, 706, 707 and 708. Grid cells which fall within the LDD channel area are classified as belonging to the LDD channel and are referred to herein as LDD channel grid cells or first channel grid cells. Likewise, grid cells which fall within the HDD channel area are classified as belonging to the HDD channel and are referred to herein as HDD channel grid cells or second channel grid cells.
Although the illustrated tiles are of a specific shape (ie square in the present example), other shapes can be utilised for the HDD or LDD channels, provided a suitable pre-defined regular or otherwise predictable geometric arrangement can be formulated.
Returning to
Error Correction Codes (ECCs) such as Reed-Solomon or Low Density Parity Check (LDPC) can be used during encoding of the LDD message into the document in question. ECCs are used in digital communication systems to overcome channel errors introduced between the encoding and decoding stages. Utilisation of a strong ECC can make the protection content associated with a set of protection marks highly robust against errors which may otherwise be introduced by folding, wrinkling, staining, tearing and defacement of the document carrying the protection content. LDPC is used during encoding, due to its iterative error correction properties.
Using ECC during encoding is optional to the encoding process, but is used in the first SRDC arrangement. To use ECC during encoding, ECC encoding is applied to the original LDD message to obtain a final coded LDD message.
The coded LDD message is then converted into 3 bit digital code values (also referred to as “intervals”). This involves dividing the final coded LDD message into groups of 3 bits and converting each 3 bit group into its corresponding digital code value. While 3 bits are used in the first SRDC arrangement, a simple extension is to use a modulation scheme with more or less than 8 values, and hence a different number of bits per interval.
In a subsequent step 802 the one dimensional array of intervals is arranged in a 2-dimensional array of size LDD tile size by LDD tile size, which is tiled across the grid 716 with a spacing of HDD tile size into the tiled LDD Channel tile areas defined in step 603 and the interval values become the values assigned to their corresponding grid cells. The process is then completed at 803. In other words, the successive intervals (ie the digital code values) associated with each successive group of 3 bits in the coded LDD message are used as the values for the successive protection dots which are mapped and encoded, according to the predefined modulation scheme (see (D) in 2902 in
The first security feature can be used, as noted above, as a means of preventing unauthorized copying of the document in question by suitably equipped photocopiers which are capable of decoding the first security feature when the document is placed on the copier platen for copying.
Returning to
One such property, and the property used in the first SRDC arrangement is based on average intensity in an area of the document in question and is described below with reference to
The average pixel intensity of an annular area 1002 around each grid intersection point 1001, i.e. the grid sampling area, is then determined across the entire partially protected document 715, for both LDD grid cells and HDD grid cells. Ideally the area 1002 overlaps with corresponding grid sampling areas around other grid intersection points. In the present example, the grid sampling area 1002 encompasses part of a letter ‘E’ 1003. The average pixel intensity is determined for the grid sampling area 1002, and this average pixel intensity is scaled, using a suitable scale factor (see (F) in 2902 in
In regard to the example in
The average pixel intensity sampled around each grid intersection point becomes the associated image data value for the grid cell to which that grid intersection point belongs.
The average pixel intensity sampled around each grid intersection point is thus information which is used to modulate protection dots in the second channel in order to encode the selected property (ie average pixel intensity) of the original information content on the original unprotected document for comparison with the corresponding property of the received protected document upon decoding.
Returning to
In the first SRDC arrangement, the dimensions in units of grid cells of the 2D array 1100 of pseudo-random values Wrg×Hrg are larger than the likely max dimensions of the tiled grid structure 716 in
Wrg=600 grid cell units [5]
Hrg=600 grid cell units [6]
As noted in regard to
Arbitrary offsets in grid cell units in the x and y directions —Xoffset and Yoffset offset respectively (see (I) in
Returning to
In a following step 906, the values associated with the grid cells (ie the values [1]-[4]) are shuffled so as to be associated with new protection dots. This step is explained in further detail with reference to
Although each grid cell has its own grid intersection point, there is no need for a grid cell's associated image data value be the image data value which is sampled around its own grid intersection point 1202. In fact, it is advantageous in some applications that the image data value associated with a grid cell in the second channel area 1204 be the image data value 1206 sampled around some other grid intersection 1205 in the first channel area 1207. In the example in
A number of methods for choosing which image data value is associated with a grid cell can be used. The first SRDC arrangement employs a shuffling technique to pseudo-randomly re-associate the information associated with each grid cell to another grid cell. In this SRDC arrangement, relationships between image data values, pseudo-random data values and data values are maintained, so all these three values [2]-[4] are shuffled together to be thus associated with the same new grid cell.
The term ‘of interest’ is used to indicate the fact that generally not all of the values associated with grid cells can be encoded. In the present example this is because there are (HDD tile size2) tile size grid intersection points per tile and only (HDD tile size2−LDD tile size2) available encodable grid intersection points. In other words, the number of encoding cells per tile is limited to total grid cells in a HDD tile[HDD tile size2 where an example of HHD tile size is depicted by 714 in
It will be appreciated that the pattern 1400 in
A following step 1304 assigns a unique index value to each grid cell in the second channel area of the tile, and these unique indices are arranged into a second 1D array, herein referred to as the tile index array, in a following step 1305. This generates a 1D array of length encoding cells per tile.
In a following step 1306, a relationship is established between the two arrays, such that the 0th entry of the associated value array is related to the 0th entry of the tile index array, the 1st entry of the associated value array is related to the 1st entry of the tile index array, and so on. A pseudo-random shuffle, such as a basic Knuth Shuffle is then applied to the tile index array in a following step 1307. The entries of the associated value array maintain their relationship with the positions of the tile index array, and not the entries originally contained at those indices. In this way, each grid cell in the second channel of the tile (identified by its index in the tile index array) is pseudo-randomly associated with the associated values from one of the grid cells of interest (i.e. the associated value in the associated value array). The value re-associated with each second channel grid cell is found by taking the original index assigned to the grid cell, finding it in the tile index array and taking the related value in the associated value array.
The assigned value is calculated as the sum of the associated values in the related associated value array. The modulus 8 of the re-associated value is taken in the case that the number of possible modulation positions is 8. In other SRDC arrangements, where the number of possible modulation positions in the dot modulation scheme is n, modulus n+1 is taken.
This re-association method based, in the present example, on the shuffle performed in the step 1307, affords a number of advantages. Firstly, as the associated values from a grid cell belonging to either a first channel or second channel grid cell may be re-associated with a grid cell in the second channel, information is encoded about regions of the document which are inside both first channel or second channel areas i.e. information is sampled from grid points in both the LDD Region 705 and the HDD Region 709. This means that there is no bias in terms of protection to either the first channel or second channel areas. Secondly, as the re-association of values is pseudo-random, it is less likely that burst noise resulting in the destruction of a number of protection dots in close spatial relationship will result in a loss of samples in close spatial relationship. Thirdly, as protection dots are easily obscured by foreground feature areas, it is preferable that protection dots which are encoding information about such important areas are spatially disjoint from the areas i.e. dot and encoding area pairs are chosen so then they are not close to one another within the tile, while the SRDC arrangement maintains the correspondence between the protection dots and the associated areas.
Returning to
Accordingly, for each grid cell in the second channel, if the grid cell is a data carrying cell then the assigned value [2] is the associated ancillary data value [4], plus its associated pseudo-random value and its sampled image value. In contrast, for a non-data carrying cell the assigned value [2] is the sum of the associated pseudo-random data value and the associated sampled image value of the current grid cell. The modulus 8 of each assigned value is then taken. In some SRDC arrangements which use a modulation scheme with a number of modulation positions other than 8, the modulus n of the assigned value is taken, where there are n possible modulation positions. This process continues until there are no more grid cells in the second channel to be processed. The process 900 then terminates at 908.
Returning to
The grid 301 is, in the example shown, regular in the sense that it is definable and machine detectable and forms a set of reference locations (i.e. intersection points 305) in regard to which modulation may be imposed upon corresponding protection marks. As per the example illustrated in
The regular grid 301 may be conceptually viewed as a “carrier” signal for the modulated protection dots and, like a carrier wave in radio frequency communication, is not directly observable. The horizontal and vertical distance by which the modulation positions are offset from the grid intersection point 305′ is referred to as a modulation quantum 304, herein abbreviated as “mq”. The locations of the eight modulation positions such as 303, relative to the corresponding grid intersection point 305′, can be defined as a list of (x, y) vectors where x indicates the horizontal direction 307 and y indicates the vertical direction 308. Using the convention that rightward offsets 307 are positive with respect to x and downward offsets (ie opposite to 308) are positive with respect to y. The vectors are represented by the following set of values:
The above described arrangement uses an base-eight modulation scheme with a three by three (3×3) array of modulation positions. Alternate modulation schemes with a smaller or larger number of modulation positions can also be used. These alternate schemes can include base-4 (2×2), base-16 (4×4), base-25 (5×5), base-36 (6×6), base-49 (7×7), and so on. Modulation schemes based upon rectangular grids can also be used. For example, base-6 (2×3), base-12 (3×4), base-20 (4×5), base-30 (5×6), and base-42 (6×7) may be used if desired.
Modulation schemes of other shapes (e.g. circular) can also be used. Another alternative is shown in
Each protection dot, both in the first channel and the second channel is modulated according to the above scheme based on the assigned values [2] determined in steps 604 and 606 of the process 600 depicted in
The purpose of encoding a protected document as described above is so that when the protected document is scanned by a scanner 126, a verification step may be performed which validates the originality of the protected document, prohibits further reproduction of the protected document, provides evidence of tampering of the protected document or some other security function.
The method 1600 commences with a start step 1601, which accepts as input a digital greyscale scan image 2907 of the protected document 2910. In one arrangement, the scan takes the form of an 8 bit greyscale JPEG image scanned at 600 dpi. The method then proceeds to a step 1602 where the digital greyscale scan of the protected document 2910 is processed by the processor 105 under the control of the SRDC application 133 to detect dots and recover the values encoded in them. This step is further detailed in
During a following step 1703, a priority-based flood-fill algorithm is used to fit suitable grids over the locations of the dots that were located in the step 1702. In one case, the output of the step 1703, ie fitting a grid over the locations of the dots that were located in the step 1702, is a single grid that covers the entire digital grayscale scan of the protected document 2910. In other cases, multiple grids of different spacing and orientation cover the digital grayscale scan. For example, if the digital grayscale scan contains two or more barcodes (ie two or more sets of protection marks) that are disjoint, have different spacing or different orientations, a separate grid is output for each barcode detected. The process 1700 then terminates at a step 1704.
Returning to
Generally, the output of the step 1804 is a single region defining a basis structural cell covering the grid. A 2D array of 3-bit numbers ‘intervals’ 19B01 (see
In special cases, multiple regions can be found. For example, if the grid contains two barcodes (ie sets of protection marks) that were not successfully separated during the step 1703, at this step 1806 they are correctly separated into two regions. Accordingly, the output from the step 1806 is two identified regions.
During a next step 1805, the data of the repeated pattern in each region is processed to define a single tile. The data of sections 705-708, illustrated in
In
During a next step 1806, the aggregated tile is serialised into the LDD channel, any errors are corrected using the error correcting code, and the LDD Channel is decoded. The output of the step 1806 is the LDD message. The process 1605 finishes at a step 1807.
In another arrangement, a further output step may involve interpreting the binary sequence as a security message which contains information about the time, place and by whom the document was printed, or possibly some description of the security status of the document, which may ultimately dictate whether the document is able to be reproduced or not. The message to be stored in this channel should generally be of considerable importance, so as to take advantage of the high redundancy of the LDD channel.
A next step 1606 determines the average pixel intensity in an area (eg 1002 in
With LDD step size and LDD offset extracted, the relationship between grid cells of the second channel and the areas they encode can be established. As described in step 905 grid cells 1208 are, on encoding, assigned a sample of the average pixel intensity 1206 from an area around the grid intersection point 1205, a pseudo-random data value and a possible a data value of a second pseudo-randomly selected grid cell 1212. Hence, each of the second channel protection dots output by step 1605 have been modulated by an image data value, a pseudo-random data value, and possibly the data value originally associated with some other grid cell within the same tile.
Returning to
In another SRDC arrangement, a shuffling scheme (906 and
In one arrangement, an error corrected message containing a seed may be encoded using dots from the second channel in each tile. On the encode step a seed may be chosen and used to perform the shuffle. The seed with its corresponding error correcting code may then be encoded as part of the second channel (709, 710 etc.). On the decode step, the seed is error corrected and recovered from the second channel. The seed is then used to generate the inverse shuffle operation that may then be performed to un-shuffle the interval array (2304).
In another arrangement, a seed may be generated for each tile from the values encoded in the second channel contained in adjacent tiles (i.e. the seed for the shuffle of the second channel in 701 may be generated from the values encoded in the dots of 702, 703, 704 or a combination thereof). For a starting tile, a known key may be used to generate the shuffle operation. This key may be encoded in the second channel message as per the method used in the arrangement outlined in the previous paragraph. Following that, the key for the adjacent tile (where the definition of adjacent is arbitrary but may—for example—be the tile to the left of the current tile in raster order) is chosen to be a hash of the second channel message of the current tile. A soft-hash is ideal in the case that the channel is noisy. As an extension, a number of tiles within the tiled grid structure may be chosen to be shuffled using the known key, rather than a key generated by a hash of adjacent tiles. This allows the decoding step to recover from the loss of a number of tiles.
Both of the above approaches serve to obscure the encoded data from a malicious user.
In another SRDC arrangement, the shape of the sampling area (1002) used to sample the pixel intensity around each grid point (1001) may be varied based on its location within the tile. For example, the radius of the annular ring may be increased based on the proximity of the sampling point to the first channel region of the tile (e.g. 705) i.e. the closer the sampling point is to the first channel region, the larger the radius of the sampling area. The rules for deciding the size of the filter may be chosen to maximize the evenness of anti-tamper coverage across each tile.
Returning to
One technique for doing this alignment is by treating the pseudo-random numbers in the grids as intensities in images. Techniques for image alignment, such as phase correlation, can then be used to align the grids. Another technique for alignment is to take the pseudo-random numbers in all the rows of both grids, and append them together to create two strings of numbers. By searching for a fragment of one string in the other, the alignment can be found. There may be some small discrepancies between the encoded values and the pseudo-random grid if the previously described data-embedding scheme is used, meaning that a simple string comparison will not suffice.
Once the extracted pseudo-random value grid 2400, as illustrated in
The demodulated values of grid cell (ie the data values for data cells and the data carrying cells values for non-data carrying cells) are then determined by taking the grid cells aggregate associated value and then subtracting the grid cells associated pseudo-random data value, adding 8 if the result is less than 0 (or n in the case that some other modulation scheme is used, where the maximum encodable value is n−1).
Returning to
Returning to
Document tampering is then detected. At each grid intersection point, the image data value of the grid cell is mapped to an expected value using the calibration map constructed in the step 1609. The difference is found between the expected value extracted from the dot and the image intensity value measured in the step 1606, giving an error at each grid intersection point. A greyscale bitmap image of the same size as the protected document is created to represent the tampering, with all pixels initialized to 0. Pixels in the aforementioned tamper image corresponding to each grid intersection point on the protected document are set to the error calculated for the grid cells to which those grid intersection points belong. A filter function (e.g. Gaussian blur) is applied to the tamper image so that the pixels containing errors are spread into their local areas. Preferably, this filter function is a similar shape and size to the area 1002 illustrated in
At this stage the tamper image has areas of 0 intensity representing untampered areas, areas which have negative values representing areas where content has been deleted, and areas with positive values representing areas where content has been added. By choosing a threshold value greater than 0, and setting all pixels below this to a threshold representing white, and all pixels above this threshold to a value representing black, the tamper image clearly displays areas where content has been added. It is possible to superimpose the tamper image onto the protected document, ideally converted to a conspicuous colour. An example result 2700 is shown in
In a similar way, a negative threshold can be chosen, and all pixels in the tamper image below this threshold set to a value representing black, and all pixels above this threshold set to a value representing white. The tamper image clearly displays areas where content has been deleted. This tamper image can also be superimposed onto the protected document, ideally converted to a conspicuous colour.
Returning to
In one form, the aforementioned positive, negative & missing dots thresholds can be chosen interactively, e.g. by movable sliders on a graphical user interface. In this way, modifying the values of the thresholds changes the sensitivity of the detection process.
It is worth noting here that a number of the preceding steps can be performed together to avoid multiple iterations over the grid, but are explained in a stepwise fashion here for ease of understanding.
The arrangements described are applicable to the computer and data processing industries and particularly for secure document processing.
The foregoing describes only some embodiments of the present invention, and modifications and/or changes can be made thereto without departing from the scope and spirit of the invention, the embodiments being illustrative and not restrictive.
| Number | Date | Country | Kind |
|---|---|---|---|
| 2008255227 | Dec 2008 | AU | national |
