Authentic barcodes using digital signatures (Verisign) - Patent Application - PRIOR ART REQUEST

Question

QUESTION - Have you seen anything that was published before Apr 13, 2011 that discusses digitally signing of barcodes ? (as opposed to signing documents, images etc)

TITLE: Authentic barcodes using digital signatures

Publication Number: PCT/US2012/032964

Assignee: Verisign, Inc.

Prior Art Date: Seeking prior Art predating Apr 13, 2011

Open for Challenge at USPTO: N/A

A computer-implemented method of verifying the authenticity of a barcode

• Inputting graphical data representing a barcode pattern into memory
• Translating the graphical data into barcode information according to a standard for translating a particular type of barcode pattern into barcode information
• Extracting a message and a digital signature from the barcode information
• and determining whether the message is authentic by determining whether the digital signature matches the message

In English this means:

Creating the barcode: Signing some text with a private key, then generating a signature of this text, combining both the signature and text and encoding as a barcode. The text may also identify the author/keypair... (so the public key can be known if the validation must support multiple authors/issuers)

Validation: Scanning a barcode, converting it into a message. Extracting the signature and text and using the associated public key to verify the signature.

This link shows the signing/creation process http://patentimages.storage.googleapis.com/US20120308003A1/US20120308003A1-20121206-D00004.png

2D barcodes, (QR Codes, PDF417, Aztec etc) can encode a lot of text... so can support a digital signature, and therefore the industry standards techniques for signing, encryption and so on can be used.

Good prior art would be evidence of a system that did each and every one of these steps prior to Apr 13, 2011.

You're probably aware of ten pieces of art that meet this criteria already...

IATA have published standards for bar coded boarding passes... their Resolution 792 document mentions "The Bar Code format also permits an airline to include its own proprietary data, and a digital signature alongside the required Bar Code information"

Would this count as prior art to this application? Are there earlier and/or better examples?

Answer 1

This blog post seems to describe something similar. Published Jan of 2011, the system would create user accounts based on a QRCode, a random shared secret key and the website being accessed. A similar process was used to log on to a website. There is a working demo linked on the site, along with the research relied on to help build it (most citations are from 2010).

In the workflow section, it describes the account creation process. It is quite long so I haven't included it here, but to my slightly-trained eye it seems to fit all of the steps in this claimed patent.

Answer 2

Although I cannot access the original standard document, I'm pretty certain from the abstract and from what I know about its use, that UIC 918.3 (home printable railway tickets, published 2007, based on Aztec code) also includes a digital signature which would be verified on a (mobile) device differing from the generating device.

Answer 3

Yes. Pitney Bowes had a system to do this in the late 1980s or early 1990s. The system involved digital signatures on identity cards, with a verification station. The system was marketed.

See http://www.five-ten-sg.com/risks/risks-21.16.txt for a discussion of the system from 2000.

There is a complete description on p. 84 of Garfinkel's Web Security and Commerce (first edition):

6.1.4.2 Veritas: digital signatures for physical credentials

An interesting twist on using public key technology to prove identification is the Pitney-Bowes Veritas system, which uses digital signatures to authenticate photographs and other information stored on physical documents (such as a driver's license). The Pitney-Bowes system stores a high-density two-dimensional bar code on the back of a plastic card. This bar code contains a digitized photograph, a copy of the driver's signature, and information such as the driver's name, age, and address. All of the information stored in the bar code is signed with a digital signature. The private key used to create this signature belongs to the card's issuing authority.

To verify the digital signature stored on the back of the plastic card, it is necessary to have a Veritas reader. This reader scans in the two-dimensional bar code, verifies the digital signature, and then displays a copy of the photograph on a small screen. A liquor store might use such a system to verify the age of people attempting to purchase alcohol, as well as to verify the names of people writing checks.

Veritas was first tested in 1994 to issue IDs for 800 students at the University of New Haven. In 1995, Veritas was tested at the Special Olympic World Games in Connecticut. Approximately 7,000 athlete credentials were issued and used for the games. These credentials contained a photograph of the athlete, biographical data, and medical information. Pitney-Bowes reported a 100 percent read rate on the cards. At one point, the event's network went down, and the offline data retrieval capability of Veritas enabled officials to retrieve medical data in life-saving situations.

Answer 4

I developed a digital signature standard for 2D barcodes in 2007 for the TSA to verify the authenticity of boarding passes. IATA took this work and carried it forward as a standard across airlines. https://www.dhs.gov/sites/default/files/publications/privacy_pia_tsa_bpss_0.pdf