Seal Tamper Detection

Abstract

Method and system for confirming the integrity of a tamper-evident seal based on a comparison of the value of at least one parameter describing the physical structure of a predetermined breaking point provided in the seal, which value is determined from at least one captured image of the seal, with a pre-determined reference parameter value.

Claims

1. A method for confirming an integrity of a tamper-evident seal, comprising: capturing at least one image of the seal; determining a parameter value of a parameter describing physical structure of the seal from the at least one captured image; comparing the determined parameter value with a pre-determined reference parameter valued; confirming the integrity of the seal when the compared parameter values match; wherein the parameter describes the physical structure of a predetermined breaking point provided in the seal.

2. The method according to claim 1, wherein the parameter describes a position of the predetermined breaking point relative to at least one marking on the seal or on an object, when the seal is applied to said object.

3. The method according to claim 1, wherein the predetermined breaking point comprises a perforation provided in the seal and the parameter describes physical structure of the perforation.

4. The method according to claim 3, wherein the parameter includes one or more of: a length of the perforation, a width of the perforation, an offset of the perforation with respect to an edge of the seal, or a code embedded in the structure of the perforation.

5. The method according to claim 1, wherein before capturing an image of the seal, the predetermined breaking point is produced in the seal according to a predefined value of the parameter describing physical structure of the predetermined breaking point, wherein the predefined value is stored as the reference parameter value for comparison with the determined parameter value describing physical structure of a predetermined breaking point.

6. The method according to claim 1, wherein the reference parameter value is recorded for each seal by: capturing at least one reference image of the seal; determining the reference parameter value of the parameter describing physical structure of the seal from the at least one captured reference image; storing the determined reference parameter value.

7. The method according to claim 5, wherein the predefined or determined reference parameter value is associated with an identification of the seal or a sealed object and stored in a central database, from which the reference parameter value is fetched based on said identification before confirming the integrity of the seal.

8. A system for confirming an integrity of a tamper-evident seal, comprising an image capturing means and a computing means connected to the image capturing means, wherein the computing means is configured to receive at least one captured image from the image capturing means and determine at least one parameter value describing physical structure of the seal from the at least one captured image, the system further comprising a verification mean configured to receive the at least one determined parameter value and compare the at least one determined parameter value with a pre-determined reference parameter value and confirm the integrity of the seal when the compared parameter values match, wherein the computing means is configured to determine a parameter value describing physical structure of a predetermined breaking point provided in the seal.

9. The system according to claim 8, wherein the computing means is configured to determine a position of the predetermined breaking point relative to at least one marking on the seal or on an object, when the seal is applied to said object, from the at least one captured image.

10. The system device according to claim 8, wherein the computing means is configured to determine the at least one parameter value describing physical structure of a perforation of the seal, in particular one or more of a length of the perforation, a width of the perforation, an offset of the perforation with respect to an edge of or marker on the seal, or a code embedded in the structure of the perforation.

11. The system according to claim 8, wherein the image capturing means and optionally the computing means is/are part(s) of a mobile device and the verification means is separate from the mobile device and the mobile device comprises communicating means connected to the computing means and configured to establish a connection to the verification means via a data network, wherein the verification means is configured to receive the reference parameter value from a central database.

12. A computer program product that can be loaded directly into the internal memory of a digital computer and comprises software modules for executing a method for confirming the integrity of a tamper-evident seal, comprising: capturing at least one image of the seal; determining a parameter value of a parameter describing physical structure of the seal from the at least one captured image; comparing the determined parameter value with a pre-determined reference parameter value; confirming an integrity of the seal when the compared parameter values match; wherein the parameter describes physical structure of a predetermined breaking point provided in the seal.

13. A tamper evident seal having a predetermined breaking point formed by at least one perforation of the seal, wherein the perforation has an irregular shape.

14. The seal according to claim 13, wherein the predetermined breaking point is formed by two or more perforations of the seal, wherein at least two of the perforations have different physical properties, in particular a different length, width and/or relative position on the seal.

15. A batch of tamper-evident seals, each having a predetermined breaking point formed by at least one perforation of the seal, wherein the position of the at least one perforation relative to a border of the seal or relative to a marking on the seal varies between different seals of the batch.

16. The system of claim 1 wherein the predetermined breaking point is the only viable position for cutting the seal.

17. The system of claim 1 wherein the predetermined breaking point is designed such that the seal has an increased fragility at the predetermined breaking point.

18. The system of claim 4 wherein the parameter includes a code embedded in the structure of the perforation, preferably by a sequence of long and short cuts.

19. The system of claim 1, wherein the parameter comprises a plurality of parameters.

Description

[0034] The invention will be defined in more detail below by means of preferred exemplary embodiments, to which it is not to be limited to, however, and with reference to the drawings. In detail:

[0035] FIGS. 1a and 1b schematically show a use-case for confirming or denying the integrity of a tamper-evident seal;

[0036] FIGS. 2a and 2b schematically illustrate differences between an authentic seal and a forged seal, which can be detected by the present method;

[0037] FIG. 3 schematically shows a seal in the form of a packaging comprising an identification feature as well as a security feature;

[0038] FIG. 4 schematically shows another seal in the form of a packaging comprising a different type of security feature than FIG. 4;

[0039] FIGS. 5a, 5b and 5c schematically show different states of a tamper-evident seal formed by a security label comprising a VOID material;

[0040] FIG. 6 schematically shows the steps of registering and confirming the integrity of a tamper-evident seal based on a reference parameter stored in a central database; and

[0041] FIG. 7 schematically shows the structure of a system and of a computer program product for performing a seal integrity verification.

[0042] FIG. 1a shows a tamper-evident seal 1 formed by a security label. The seal 1 has a predetermined breaking point 2. The predetermined breaking point 2 of the seal 1 is formed by a perforation 3 running across the seal 1 between the longer edges of the security label, effectively dividing the seal 1 into a first part 4 and a second part 5. In the sealed state shown in FIG. 1a, the first part 4 and second part 5 are connected by and across the predetermined breaking point 2. The integrity of the seal can be confirmed using a mobile device 6 comprising a camera 7 and optical sensor as a capturing means. The mobile device 6 captures at least one image of a region of the seal 1 comprising the predetermined breaking point 2 and uses the at least one captured image for confirming the integrity of the seal 1. Specifically, the mobile device detects the cuts of the perforation and their respective lengths and distances. These parameters of the physical structure of the perforation are then compared with pre-determined reference parameters comprising accepted ranges for the number of cuts as well as their respective length and distance from a neighbouring cut. If the determined number (three in this case), lengths or distances are within the accepted ranges, the integrity of the seal is confirmed by the mobile device 6. In the broken state of the seal shown in FIG. 1b, the first part 4 is separated from the second part 5. In this broken state the perforation 3 is formed by a single, continuous end-to-end cut 8 through the seal 1. The mobile device 6 therefore detects the single cut 8 and its length from the captured image. Consequently, the determined parameters are outside the accepted ranges (e.g. more than one cut was expected) and the integrity of the seal 1 cannot be confirmed. In the absence of a confirmation, a user of the mobile device 6 may perform one or more retries to verify the seal integrity. After a certain number (e.g. one, two, three, or more) of unsuccessful confirmation attempts (i.e. when a confirmation has been denied), the seal will be considered broken.

[0043] In FIG. 2a an authentic seal 9 is shown and in FIG. 2b a forged or fake seal 10 is shown. The authentic seal 9 comprises several security features 11, 12, 13. Specifically, the authentic seal 9 comprises an identification feature 11 in the form of a serial number. The serial number is preferably a unique, unguessable/unpredictable combination of numbers and letters, which can be used by the producer of the seal to trace certain aspects of the seal such as time and location of use. Consequently it is possible to determine the legitimacy of the seal from the serial number and the circumstances of its use. The authentic seal 9 further comprises an optically variable device (OVD) 12 in the form of a holographic signet on the seal as described in more detail in WO 2013/18897 A1. Because it is relatively difficult to copy an OVD, the use of an OVD on the seal discourages replication or at least significantly increases the necessary effort and cost. In FIG. 2a the OVD forms only a small part of the seal 9. Of course it is also possible to produce a seal where the OVD covers a significant portion of the seal. Finally, the predetermined breaking point 13 itself of the authentic seal 9 also acts as a security feature because of an embedded code, which is encoded in the parameters describing the physical structure of the perforation forming the predetermined breaking point 13. In this particular example, the embedded code is associated with the identification feature 11. It may for instance be an asymmetrically encrypted representation of the serial number. Alternatively the embedded code or the embedded code together with the serial number may be signed and applied to or associated with the seal or sealed object.

[0044] The fake seal 10 in FIG. 2b differs from the authentic seal 9 in that some of the security features have not been replicated accurately. Specifically, the pattern created by the forged OVD 14 differs from the pattern created by the authentic OVD 12. Also the physical structure of the predetermined breaking point 15 differs in that the perforation forming the predetermined breaking point 15 has a different number of cuts and the cuts have different lengths and distances. While the identification feature 16 has apparently been replicated accurately, it can be used to identify the forged seal based on the time and location of its use (e.g. when a serial number reserved for the European market is used on a product on the US market). Moreover the serial number used as the identification feature will no longer correspond to the other security features. In the above example, where the perforation encodes a representation of the serial number, due to the different shape of the perforation, the decrypted representation will not match the serial number of the forged seal and the forgery will be uncovered.

[0045] In FIGS. 3 and 4 the seal 1 is formed by a packaging 17, 18. The predetermined breaking points 19, 20 in the packaging 17, 18 are formed by perforations. In both embodiments, the packaging 17, 18 comprises additional security features in the form of an overt security marking 20 like a visible watermark or embossed image, in the form of an identification feature 21, 22 formed by a two-dimensional bar-code or QR-code, e.g. encoding a serial number or other unique identifier, or a human-readable code 22, or a security feature in the form of a covert security marking 23 like an invisible watermark or a marking applied using a security ink.

[0046] FIGS. 5a, 5b and 5c show different states of a tamper-evident seal 1 comprising a VOID material. The seal 1 has a predetermined breaking point 24 in the form of a notch 25 and can be identified via a serial number 26. In the validly sealed state shown in FIG. 5a the seal 1 is intact and the integrity of the seal can be confirmed with a mobile device 27 as described in connection with FIG. 1. In the embodiment shown in FIG. 5a, the parameter describing the physical structure of the predetermined breaking point 24 can be the edge length of the notch 25 and the angle between the edges. A more sensitive parameter would be the sharpness of the tip 28 of the notch 25, because the area around the tip 28 is the most fragile of the seal 1. Another usable parameter is the position of the notch with respect to the overall shape of the seal 1 or with respect to the serial number 26. As mentioned before, any combination of the parameters can be used to encode certain predefined information, which in turn can be linked to the serial number.

[0047] When confirming the integrity of the seal 1, the mobile device 27 can also analyse the general appearance of the seal surface with respect to colour or two-dimensional markings. A tampering by peeling off the seal 1 can be detected based on the change of appearance of the seal 1 due to the VOID material as shown in FIGS. 5b and 5c. In FIG. 5b the colour of the seal surface is changed in one part 29 of the seal, indicating that the respective part 29 has been subject to manipulation, e.g. separation of the seal 1 from the sealed product or packaging (not shown) has been attempted or performed. Alternatively or additionally, the VOID material may cause an irrevocable marking 30 of the seal 1 or of the product or package, as shown in FIG. 5b and FIG. 5c.

[0048] In a further embodiment, multiple predetermined breaking points may be provided in the tamper-evident seal 1. FIG. 6 shows the steps of capturing and registering reference parameters describing the physical structure of a first predetermined breaking point 31 of a seal 1. The vertical dashed line 32 separates the registration process 33 on the left from the verification process 34 on the right.

[0049] The registration process 33 serves to register two parameters , describing the physical structure of the predetermined breaking point 31 as reference parameters. Initially the seal 1 with a predetermined breaking point 31 having random parameters is provided. For example, the predetermined breaking point 31 may be produced in a random process, wherein the position and shape of the perforation forming the first predetermined breaking point 31 is governed by stochastically determined parameters. A second predetermined breaking point 35 in the form of a notch can be provided adjacent an identification feature 36 such that, when the second predetermined breaking point 35 is ruptured, the identification feature 36 will be destroyed or altered. A registration device 37 is configured to capture an image of the seal 1, in particular to capture the structure of the first predetermined breaking point 31 and the identification feature 36. From the captured image, the registration device 37 derives the serial number as well as the value of the two parameters , describing the physical structure of the predetermined breaking point 31. For example, one parameter may be the offset of the first cut of the perforation forming the predetermined breaking point 31 from the edge of the seal 1 and the other parameter may be the length of the first cut of the perforation forming the predetermined breaking point 31. Other parameters may include the vertical offset of the predetermined breaking point 31 from the serial number 36, the angle between a line defined by the predetermined breaking point 31 and the connected edges of the seal, etc. The value of the parameters , may be determined by matching a predefined shape of the perforation with the captured image or generally by pattern recognition methods applied to the captured image. For instance one parameter may be a distance between the perforation forming the predetermined breaking point 31 and an edge of the seal 1 or a distance between the perforation forming the predetermined breaking point 31 and the notch forming the second predetermined breaking point 35. It may also be the distance measured between a first separate cut of the perforation and a reference as mentioned before. The other parameter may be a ratio between singular cuts of the perforation or their widths or a ratio between widths of singular cuts of the perforation.

[0050] When the serial number and the parameter values , have been determined, the registration device 37 in an upload step 38 sends a message 39 comprising the serial number and the parameter values , to a central database 40. The central database 40 stores the received serial number and the received parameter values , in respective database tables. It further stores the relation between the serial number and the parameter values , , such that the parameter values , can be queried based on the serial number during verification.

[0051] The verification process 34 serves to confirm the integrity of the seal 1 by comparing the values of the two reference parameters , stored in the database 40 with separately determined values of the same parameters determined by the mobile device 41 acting as a verification device. The mobile device 41 performs essentially the same capturing and processing steps as described in connection with the registration device 37. In particular it captures an image of the seal 1 using optical sensor means 42 directed at the seal 1. From the at least one captured image it determines the serial number 36 and the present values , of the parameters describing the physical structure of the first predetermined breaking point 31. The mobile device 41 in a transmission step 43 transmits a message 44 comprising the determined serial number together with the parameter values , to the central database 41 for verification. Alternatively the reference parameter values , may be downloaded to the mobile device 41 for verification, with the downside that a potential attacker may use this information for forging the seal. In the present use-case the seal 1 is fully intact. The central database 40 compares the received parameter values , with the reference parameter values , and determines a match in both parameters. It therefore performs a confirmation step 45 and sends a confirmation message 46 to the mobile device 41, which can be displayed as a confirmation notification 47 to a user of the mobile device 41, signalling the integrity of the verified seal 1.

[0052] In FIG. 7 the elements of a preferred embodiment of the present system 48 are shown together with their connections. The system 48 for confirming the integrity of a tamper-evident seal 1 according to FIG. 7 comprises an input interface 49 (e.g. a keyboard or touch display interface) and a capturing means 50 connected to and controlled via the input interface 49. The capturing means 50 is further connected to a computing means 51 and a verification means 52. In this example, the capturing means 50 is configured to directly determine a serial number 53 of a seal 1 from at least one image captured by the capturing means 50 and transmits the serial number to the verification means 52. Moreover the computing means 51 is configured to receive captured image data of at least one image from the capturing means 50 and determine the values , of parameters describing the physical structure of a predetermined breaking point of a seal 1. The computing means 51 is configured to transmit the determined values , to the verification means 52. The verification means 52 is connected to a central database 40 and configured to receive the reference values , of the parameters from the central database 40 and to compare the received reference values , with the received determined values , . When the verification means 52 finds a match of the compared parameters, i.e. when preferably all compared parameters differ only within an acceptable range or error, it confirms the integrity of the seal 1 and transmits a confirmation message to an output interface 54 of the system 48.

[0053] The system is preferably implemented by a mobile device and a hosted service. The mobile device comprises the input interface 49, the output interface 54 and the capturing means 50. The hosted service comprises the central database 40 and the verification means 52. The verification means 52 as well as the computing means 51 can be either part of the mobile device or of the hosted service, depending on the computational effort necessary to determine the relevant parameters from the captured image. One advantage of this configuration is that the reference parameter values and/or parameter extraction algorithms are not exposed or accessible from outside the hosted service. Therefore a party seeking to forge the integrity of the seal cannot reproduce the seal state based on the reference parameter values and has significantly higher effort in re-engineering computation and used parameters.

[0054] The above-described embodiments concern predetermined breaking points formed by perforations and notches mainly because these types of predetermined breaking points are relatively easy to display. However the general principles of the present invention do apply to less visible types of predetermined breaking points in the same manner and with similar advantages. For improved detection, any types of predetermined breaking points can be accompanied by graphical indications on the seal, which serve as guidance for identifying the relevant area of the seal when determining the parameter describing the physical structure of the predetermined breaking point.