'Uncrackable' Document and Product Security?

Curunculus writes "The Engineer reports that a unique 'fingerprint' formed by microscopic surface imperfections on almost all paper documents, plastic cards and product packaging could be used as a cheaper method to combat fraud. One of the developers, Professor Cowburn commented: "The beauty of this system is that there is no need to modify the item being protected in any way with tags, chips or inks; it's as if documents and packaging have their own unique DNA. This makes protection covert, low-cost, simple to integrate into the manufacturing process and immune to attacks against the security feature itself." This system is now being commercialised via Ingenia Technology, a spin off company."

Comments

But..

[Daxster]

Wouldn't this technology still be vulnerable to current problems? Things like where somebody steals your card, or records the data being sent/received whether it's from a computer or some machine somewhere.

Fraud prevention?

[Joe Random]

From the article:

Using the optical phenomenon of 'laser speckle', researchers examined the fine structure of different surfaces using a focused laser, and recorded the intensity of the reflection. The technique was tried on a variety of materials including matt-finish plastic cards, identity cards and coated paperboard packaging and resulted in clear recognition between the samples. This continued even after they were subjected to rough handling including submersion in water, scorching, scrubbing with an abrasive cleaning pad and being scribbled on with thick black marker.

So let me get this straight; I can scrub on one of these "fingerprinted" document until the letters wear off, write whetever I want on it with a black marker, and it will pass the verification check? Doesn't that kind of prevent the entire purpose of fingerprinting documents in the first place?

"Well Mr. Random, while it is quite unusual to see a tax rebate check of *ahem* eleventy-billion dollars, the article passed all verification checks. We've deposited the amount into your account. Have a nice day."

Re:Surface imperfections?

[Wilson_6500]

From what I understand, the imperfections are _everywhere_ over the document. I guess they'd do their little speckle-counting thing over six or ten different square inches (or centimeters, or whatever) of the document, and then folding doesn't matter. Besides, if the surface profile can survive scorching and abrasion, I think folding might not be a huge deal, and pressing certainly not.

I've worked with speckle-based systems, and I'm skeptical about this, since there's a _lot_ of variance when you're dealing with laser speckle. I don't really know how their imaging system could quickly and efficiently discriminate between hundreds of little dots, average their sizes, statistics, etc.

Any OE-s around that specialize in speckle to clear this up?

Shhhhhh...

[GuitarNeophyte]

You're not supposed to point out the elephants in the middle of the room. Just play along and be nice. And remember to bring plenty of peanuts.

TFA indicates it is flawed

[photon317]

Well, actually I didn't read the linked FA yet, but I read about this same thing elsewhere a few days ago. They said the chances of two peices of the same kind of paper have the same signature were 1:1000. Two reams of paper and you're in (or 1,000 peices of passport plastic, or whatever). Hardly an effort considering the documents they're considering using it on. Unless they can bump that number into the billions or more, it's pointless because it's too easy to manufacture a duplicate of any given document that has an identical fingerprint just by brute force.

Re:TFA indicates it is flawed

[Raindance]

To be fair, it isn't clear whether this is a "the quantity of uniquely identifiable information just isn't there" flaw or an "instrument precision" flaw. Most probably, nobody knows.

So, I wouldn't count it out just yet.

Also, I'm not so sure on your comment,
"Unless they can bump that number into the billions or more, it's pointless because it's too easy to manufacture a duplicate of any given document that has an identical fingerprint just by brute force."

In some circumstances, yes, you'll be able to see the original document you're trying to forge, and get a "pretty decent fingerprint match". On some documents you don't-- and in that case, this system *will* stop you if implimented correctly.

Re:Flatbeds

[walt-sjc]

Um, no. Different kind of scanner... The type of scanner they are talking about in the article looks for characteristics of the paper / media itself and not what is printed on it. The key phrase in the article is "Using the optical phenomenon of 'laser speckle'"... This implies that they shine a laser on the document. Don't think your standard flat bed scanner is going to be doing that anytime soon...

How much data again?

[ka9dgx]

<ASSUME>So, let start with some assumptions:

• 1 sample for every cm^2 of document
• A4 sized documents.
• Capability to register up to 1 trillion documents

</ASSUME>

Now, on with the math. First, we figure out how many samples we're going to possibly accomodate, as an address space:
Total surface area (21.0 cm * 29.7 cm * 10 E^12) * 1 Sample / cm^2 --> 623,700,000,000,000 Samples

This results in a 50 bit address space, if we were able to just sequentially number the samples. Since we have to work with what we're given, lets just assume we can get by with 256 bits/sample.

This results in the need to store (256 bits sample) * (1 byte / 8 bits) * (21 cm * 29.7 cm / document) * (1 sample / cm^2) --> 19958.4 bytes/ document.

So, in order for this to work we need to store about 20k/page. In order to authenticate documents, your stored database would be approximately 20 Gigabytes/ million documents, and indexing isn't going to help much.

That's a lot of work, and it seems to me it would be quicker, easier, and far more efficient in general to store duplicates of the originals in a secure location.

--Mike--