CA2497108C - Systems and methods for encoding randomly distributed features in an object - Google Patents

Abstract

The described systems and methods described are directed at encoding randomly distributed features in an object. Randomly distributed features in an authentication object are determined. Data representing the randomly distributed features is compressed and encoded with a sib. A label is created and includes the authentication object and the encoded data. The data may be compressed by determining a probability density function associated with the authentication object. Vectors associated with the randomly distributed attributes arc determined based, at least in part, on the probability density function. The vectors are encoded using an arithmetic coding algorithm.

Description

SYSTEMS AND METHODS FOR ENCODING RANDOMLY DISRIBUTED
FEATURES IN AN OBJECT

TECHNICAL FIELD

The systems and methods described herein generally relate to counterfeit-resistant and/or tamper-resistant labels; and more particularly, to utilizing randomly distributed features of an object (whether embedded or naturally inherent) to limit unauthorized attempts in counterfeiting and/or tampering with the label.

BACKGROUND OF THE INVENTION

Counterfeiting and tampering of labels cost product marketers and manufacturers billions of dollars each year in lost income and lost customers.
With the proliferation of computer technology, generating labels that resemble the genuine item has become easier. For example, a scanner may be utilized to scan a high-resolution image of a genuine label which can then be reproduced repeatedly at a minimum cost. Also, coupons may be scanned, modified (e.g., to have a higher value), repeatedly printed, and redeemed.

Various technologies have been utilized to stop the flood of counterfeiting and tampering in the recent years. One way labels have been secured is by incorporation of bar codes. Bar codes are generally machine-readable code that is printed on a label. Using a bar code scanner, the label with a bar code may be quickly read and authenticated. One problem with current bar coded labels is that an identical label may be used on various items.

Another current solution is to have the scanned bar code examined against secure data stored in a database (e.g., a point of sale (POS) system). This solution, however, requires incorporation of up-to-date data from a marketer or manufacturer. Such a solution requires timely and close cooperation of multiple entities. Also, such a solution limits its implementation flexibility and may not always be feasible.

These technologies, however, share a common disadvantage; namely, the labels scanned are physically identical for a given product. Accordingly, even though the manufacturing process for creating the legitimate labels may be highly sophisticated, it generally does not take a counterfeiter much time to determine a way to create fake pass-offs. And, once a label is successfully copied a single time, it may be repeatedly reproduced (e.g., by building a master copy that is replicated at low cost). Even if a label is black-listed in a database after a given number of uses, there is no guarantee that the labels that are scanned first are actually the genuine labels.

Accordingly, the current solutions fail to provide labels that are relatively hard to copy and inexpensive to produce.

SUMMARY OF THE INVENTION

According to one aspect of the present invention, there is provided a method comprising: determining randomly distributed features in an object;
determining a probability density function associated with the object;
compressing data representing the randomly distributed features, wherein the compressing is based in part on the probability density function; encoding the compressed data with a signature; and creating a label comprising the object and the encoded data, wherein compressing data representing the randomly distributed features comprises:
determining vectors associated with the randomly distributed features based, at least in part, on the probability density function; and encoding the vectors using an arithmetic coding algorithm, wherein the algorithm comprises: set U as a list of all unit areas in S-S, u list of all marked units, M(u), is set to M(u)=Q do find all unit areas V=argmin,' II Q,rQõII do find unit area w=argmaxõEv(1, v) set AC range for w to

2 y(w,u) set of nodes ordered before w is M,,,(u)=M(u), M(u)=M(u) U w, V=V-w, U=U-w while VSO while UFO.

According to another aspect of the present invention, there is provided a system comprising an issuer configured to determine randomly distributed features in an authentication object and to compress data representing the randomly distributed features comprising fibers, the issuer being further configured to encode the compressed data with a signature and to create a label that includes the authentication object and the encoded data; wherein the issuer is further configured to determine a probability density function associated with the authentication object, wherein the probability density function is defined as the likelihood of finding a second end of a fiber at a given location within a non-illuminated area when a first end of the fiber is located within an illuminated area of the authentication object, and to compress the data representing the randomly distributed features by:
determining vectors associated with the randomly distributed attributes based, at least in part, on the probability density function; and encoding a portion of the vectors as a path by applying an arithmetic coding algorithm, wherein the algorithm comprises: set U as a list of all unit areas in S-S, u list of all marked units, M(u), is set to M(u)=O do find all unit areas V=argmin,,uMM Q,-QõII do find unit area w=argmaxõEv(1, v) set AC
range for w to 7(w, u) set of nodes ordered before w is M,,(u)=M(u), M(u)=M(u) U w, V=V-w, U=U-w while V$O while UFO.

According to still another aspect of the present invention, there is provided a label comprising: an authentication object including randomly distributed features; and encoded information associated with the authentication object, the information being encoded with a signature and including compressed data representing the randomly distributed features in the authentication object, wherein the data in the encoded information is compressed by: determining a probability density function associated with the authentication object; determining vectors associated with the randomly distributed attributes based, at least in part, on the probability density function; and encoding the vectors using an arithmetic coding algorithm; wherein the label is self-authenticated by comparing the compressed data 2a in the encoded information and the data representing the randomly distributed features obtained by analyzing the authentication object; and wherein the compressed data was compressed by: determining vectors associated with the randomly distributed features based, at least in part, on the probability density function; and encoding the vectors using an arithmetic coding algorithm, wherein the algorithm comprises: set U as a list of all unit areas in S-S, u, list of all marked units, M(u), is set to M(u)=O, do find all unit areas V=argmin,, JI Q,,Qõll , do find unit area w=argmaxõEvE(1, v), set AC range for w to y(w,u) (see Eqns. 17, 18), set of nodes ordered before w is M v(u)=M(u), M(u)=M(u) U w, V=V-w, U=U-w, while VSO while UFO.

According to yet another aspect of the present invention, there is provided an apparatus comprising: means for determining randomly distributed features in an authentication object; means for determining a probability density function associated with the authentication object, wherein the probability density function defines a likelihood a point will contain an illuminated second end of a fiber and is conditioned on location of a first end of the fiber in an illuminated region;
means for compressing data representing the randomly distributed features, wherein the compressing is based in part on the probability density function; means for encoding the data with a signature; and means for creating a label that includes the authentication object and the encoded data, wherein the means for compressing data representing the randomly distributed features comprises: means for determining vectors associated with the randomly distributed features based, at least in part, on the probability density function; and means for encoding the vectors using an arithmetic coding algorithm, wherein the algorithm comprises: set U as a list of all unit areas in S-S, u, list of all marked units, M(u), is set to M(u)=O, do find all unit areas V=argmin,,Jl Q,,Qull, do find unit area w=argmaxõEv(1, v), set AC range for w to y(w,u) (see Eqns. 17, 18), set of nodes ordered before w is MW(u)=M(u), M(u)=M(u) U w, V=V-w, U=U-w, while VSO while U#O.

2b According to a further aspect of the present invention, there is provided a method comprising: determining randomly distributed features in an authentication object; compressing data representing the randomly distributed features, wherein the compressing comprises: determining a probability density function associated with the authentication object wherein the probability density function represents the probability that a unit of the randomly distributed features is found in a particular region of the authentication object; determining point-to-point vectors associated with end-points of the randomly distributed features based, at least in part, on the probability density function; and encoding the point-to-point vectors using an arithmetic coding algorithm, wherein encoding the vectors using the arithmetic coding algorithm includes determining a path for connecting a portion of the point-to-point vectors within a fixed amount of data wherein the path connects points of the point-to-point vectors; returning the path as the compressed data; encoding the compressed data with a private key; and creating a label that includes the authentication object and the encoded data.

According to yet a further aspect of the present invention, there is provided one or more computer-readable memories containing instructions that are executable by a processor to perform a method as described above or below.

According to still a further aspect of the present invention, there is provided a system comprising: an issuer configured to determine randomly distributed features in an authentication object and to compress data representing the randomly distributed features, the issuer being further configured to determine a probability density function associated with the authentication object wherein the probability density function represents the probability that a unit of the randomly distributed features is found in a particular region of the authentication object, to determine point-to-point vectors associated with end-points of the randomly distributed features based, at least in part, on the probability density function, to encode the point-to-point vectors by encoding a portion of the point-to-point vectors as a path within a fixed amount of data by applying an arithmetic coding algorithm to compress the data wherein the path connects points of the point-to-point vectors, and 2c to return the path as the compressed data, the issuer being further configured to encode the compressed data with a private key and to create a label that includes the authentication object and the encoded data.

According to another aspect of the present invention, there is provided a label comprising: an authentication object including randomly distributed features;
and encoded information associated with the authentication object, the information being encoded with a private key and including compressed data representing the randomly distributed features in the authentication object, wherein the data in the encoded information is compressed by determining a probability density function associated with the authentication object wherein the probability density function represents the probability that a unit of the randomly distributed features is found in a particular region of the authentication object, determining point-to-point vectors associated with end-points of the randomly distributed features based, at least in part, on the probability density function, encoding the point-to-point vectors using an arithmetic coding algorithm, wherein encoding the vectors using the arithmetic coding algorithm includes determining a path for connecting a portion of the point-to-point vectors within a fixed amount of data wherein the path connects points of the point-to-point vectors and returning the path as the compressed data; wherein the label is self-authenticated by comparing a decoding of the encoded information and data representing the randomly distributed features obtained by analyzing the authentication object.

According to yet another aspect of the present invention, there is provided an apparatus comprising: means for determining randomly distributed features in an authentication object; means for compressing data representing the randomly distributed features, wherein the means for compressing data comprises:
means for determining a probability density function associated with the authentication object wherein the probability density function represents the probability that a unit of the randomly distributed features is found in a particular region of the authentication object; means for determining point-to-point vectors associated with end-points of the randomly distributed features based, at least in part, 2d on the probability density function; means for encoding the point-to-point vectors using an arithmetic coding algorithm, wherein encoding the vectors using the arithmetic coding algorithm includes determining a path for connecting a portion of the point-to-point vectors within a fixed amount of data wherein the path connects points of the point-to-point vectors; and means for returning the path as the compressed data; means for encoding the compressed data with a private key;
and means for creating a label that includes the authentication object and the encoded data.

The systems and methods described herein are directed at encoding randomly distributed features in an object. In one aspect, randomly distributed features in an authentication object are determined. Data representing the randomly distributed features is compressed and encoded with a signature. A label is created and includes the authentication object and the encoded data.

In another aspect, the data is compressed by determining a probability density function associated with the authentication object. Vectors associated with the randomly distributed attributes are determined based, at least in part, on the 2e i probability density function. The vectors are encoded using an arithmetic coding 2 algorithm.

3

4 BRIEF DESCRIPTION OF TIDE DRAWINGS
........ ................. :.......... ........... ........... ....
.....................................................
s Fig. 1 shows an example authentication object for use as part of a label, 6 such as a certificate of authenticity.

7 Fig. 2 is a schematic diagram illustrating an example certificate of s authenticity system and example procedures employed by the system for issuing 9 and verifying a certificate of authenticity.

to Fig. 3A is a schematic diagram of an example scanning system for ii capturing randomly distributed features of an authentication object associated with 12 a certificate of authenticity.

13 Fig. 3B is a top view of the authentication object shown in Fig. 3A.

14 Fig. 4 is a flow diagram of an example process that maybe used to create a is certificate of authenticity.

16 Fig. 5 is a flow diagram of an example process that may be used to n compress data that represents the randomly distributed attributes of an 1s authentication object.

19 Figure 6 is a graphical representation of areas that correspond to four 20 different regions in an example authentication object.

21 Figure 7 is a graphical representation of the nineteen different regions on an 22 example authentication object.

23 Fig. 8 is a graph of an example of the probability density function for a 24 square authentication object.

25 Figure 9 is a graphical representation of areas in an authentication object.
L.& M"A Mc 3 i Fig. 10 is a graphical representation of an example of how an arithmetic 2 coder encodes the string "aba".

3 Figure 11 is an example of an instance of an authentication object shown :_.....:....4 :..wit nodes. ...................:................

s Figure 12 is a graphical representation of a certificate of authenticity 6 designed for optimizing cost effectiveness.

7 = Fig. 13 illustrates an example computing device which the described e systems and methods can be either fully or partially implemented.

DETAILED DESCRIPTION
to 11 I. Introduction 12 The systems and methods described herein are directed at encoding 13 information about the randomly distributed features of an object used in a label.
14 Labels may include any type of identification means that are attached to or is incorporated within an item. A label that is configured to be authenticated is 16 referred herein as a certificate of authenticity. An object with randomly 17 distributed features used in a certificate of authenticity is referred to herein as an is authentication object. To enable self-authentication, a certificate of authenticity i9 may include both the authentication object and the information about the randomly 20 distributed features. A compression method may be used to increase the amount 21 of information about the randomly distributed features that can be encoded and 22 included in the certificate of authenticity. According to one example calculation, 23 the cost of forging a certificate of authenticity is exponentially increased 24 proportional to the improvement in compressing the information. This substantial ,a l,L,mi PLW 4 AW-10 us i increase in forging cost results in a reliable certificate of authenticity that is 2 relative cheap to manufacture but is difficult to falsify.

3 Fig. I shows an example authentication object 100 for use as part of a label, 4. ...such . as.. a. certificate . of of. authenticty.:.. To. be..
effectively. used in a ceTttfitote of ........................................... .
s authenticity, authentication object 100 typically contains randomly distributed 6 features that are unique and are hard to replicate. The example authentication 7 object 100 shown in Fig. I is part of a fiber-based certificate of authenticity and i contains fibers 110 that are embedded in the object in a random manner.
Fibers 9 110 serve as the randomly distributed features of authentication object 100.
Fibers io 110 may be incorporated in authentication object 100 by any means. For example,' ii fibers 100 may be sprayed onto authentication object 100. Fibers 100 may also be 12 embedded into authentication object 100 during the manufacturing process.
In one 13 . embodiment, fibers 110 are optical fibers capable of transmitting light between 14 their endpoints. Thus, by shedding light on a certain region 120 of authentication is object 100, endpoints of fibers 131.133 that have at least one end-point within the 16 lit up region are illuminated.

17 In Fig. 1, authentication object 100 includes Krandomly distributed fibers.
is Authentication object 100 may be scanned at a resolution of L x L pixels.
Each 19 fiber has a fixed length of R. Although the example authentication object 100 in 20 Fig. 1 contains fibers, it is to be understood that authentication objects with other 21 randomly distributed features may also be used in a certificate of authenticity in a n similar manner.

23 The randomly distributed features of authentication object 100 may be 24 used in a certificate of authenticity to protect the proof of authenticity of an 2s arbitrary object, such as a product. For example, certain hard-to-replicate data w: HW" rru 5 ~us-.ns us i about the randomly distributed features of the certificate of authenticity may be 2 digitized, signed with the private key. of the issuer, and the signature may be 3 imprinted on the certificate of authenticity in a machine-readable form to validate ...............4 ...that:. the.. produced. instance .. is . authentic. Each instance of the certificate of ..................... .... ........:....... .........
...........................
......
s authenticity is associated with an object whose authenticity the issuer wants to 6 vouch. In one embodiment, verification of authenticity is done by extracting the 7 -signed data (data about the randomly distributed features) using the public key of s the issuer and verifying that the extracted data matches the data of the associated 9 instance of the certificate of authenticity. In order to counterfeit protected objects, to the adversary needs to either: (i) figure out the private key of the issuer, (ii) devise ii a manufacturing process that can exactly replicate an already signed instance of 12 the certificate of authenticity, or (iii) misappropriate signed instances of the 13 certificate of authenticity. From that perspective, the certificate of authenticity can 14 be used to protect products whose value roughly does not exceed the cost of is forging a single certificate of authenticity instance, including the accumulated 16 development of a successful adversarial manufacturing process.

17 A goal of a certificate of authenticity system is to ensure the authenticity of is products or certain information associated with a product. The set of applications 19 is numerous and broad, ranging from software and media (e.g., DVD, CD) anti-20 piracy to unforgeable coupons and design of tamper-proof hardware. For 21 example, creating a tamper-resistant chip would require coating its package with a u certificate of authenticity. Before each usage, the integrity of the certificate of 23 authenticity should be verified in order to verify authenticity of the protected 24 silicon.

LM d PUC 6 Am=muM

1 Below, example hardware platforms for inexpensive but efficient read-out 2 of the randomly distributed features of a fiber-based certificate of authenticity will 3 be discussed. The hardware platforms may include a barcode. Since the capacity .bits; . the message signed .:...... 4 of. a..barcode. for. low-cost. readers is .limited to about. 3K
.
:..:........ ..................... .
s by the private key is limited to the same length. Also, since one of the goals of a 6 certificate of authenticity system is to maximize the effort of the adversary who 7 aims at forging a specific instance of the certificate of authenticity, the problem $ associated with storing in the fixed-length signed message as much as possible 9 information about the unique and randomly distributed features of a fiber-based to certificate of authenticity will be discussed. An example analytical model for a i i fiber-based certificate of authenticity will be provided. Then, the discussion 12 below will also formalize the problem of compression of a point set, and show that 13 optimal compression of fibers' positions in an instance of a certificate of 14 authenticity is an NP-complete problem. In order to heuristically address this is problem, an algorithm which significantly improves upon compression ratios of 16 conventional compression methodologies will be provided.

1a U. Issul and Verifying Certificate of Authenticity 19 Fig. 2 is a schematic diagram illustrating an example certificate of 20 authenticity system 200 and example procedures employed by the system for 21 issuing and verifying a certificate of authenticity. Certificate of authenticity n system 200 includes certificate of authenticity 210, an issuer 230, and a verifier 23 250. As shown in Fig. 2, certificate of authenticity 210 may include the u authentication object 100 in Fig. 1, a barcode 213, and text 215.

mwft ruc 7rti,Dyais The information that needs to be protected on a certificate of authenticity 2 includes: (a) the representation of the hard-to-replicate randomly distributed 3 features of authentication object 100 and (b) an arbitrary associated textual data.

...Initially,..the. randomly. .distributed..festures of.authentication object IOQ, such as ~ ........................ ...
locations of fibers, are scanned using a hardware device. Details on how this 6 information is collected and represented will be discussed below in conjunction 7 with Fig. 3.

a For the purpose of discussion, assume that the resulting information f is a 9 random string of nF bits. Parameter n, is fixed and equals nF = k = nt, k e N, io where - n is the length of an RSA public-key (for example, n,M =1024) and k is i commonly set to k e [l, 3). Given a fixed nF, the digest f of data 231 representing 12 the randomly distributed features of authentication object 100 may statistically 13 maximize the distance between any two distinct certificate of authenticity 14 instances. This goal translates directly to minimized likelihood of a false negative is and false positive during the verification step.

16 The textual data r is- an arbitrary string of characters which depends on the n application (e.g., expiration date, manufacturer's warranty). The textual data is is derived from text 215, which is printed on certificate of authenticity 210 as shown I9 in Fig. 2.

20 The textual data may be hashed using a cryptographically secure hash 21 algorithm 237, such as SHAT. The output of the hash function is denoted as a 22 message t with nr bits. Issuer 230 creates the message m that may be signed by 23 RSA. For example, messages f and t are merged into a message m of length 24 n. = nF using a reversible operator 6 that ensures that each bit of m is dependent u upon all bits from both f and t. This step may maximize the number of bits that L" & Sam PUC $ 11g7-JIMJJ

need to be manipulated in data 231 as well as text 215 to create a certain message 2 m . An example of such an operator is symmetric encryption m = t f w EE (f) of 3 f using r or certain subset of bits from r as a key. Message m is signed with an RSA signature. 235 using the private.key 233 of the issuer 230.. Eachõn,~ bits of s m are signed separately. The resulting signature s has ns = n,,, = nF bits.
This 6 message is encoded and printed as barcode 213 (such as barcodes that obey the 7 PDF417 standard) onto certificate of authenticity 210.

9 The verification of certificate of authenticity 210 involves several steps.
9 Verifier 250 initially scans the printed components: text 215 and barcode 213.
io Barcode 213 is decoded into the originally printed signature s. Text 215 is i i scanned and is hashed in order to create the message t. Note that generic optical 12 character recognition (OCR) is not required for this task because the font used to 13 print the text is known to the verifier 250 and optimized for improved OCR.
For 14 successful certificate of authenticity verification, text 215 and barcode 213 need to is be read without errors; a task which is readily achievable with modern scanning 16 technologies.

17 Verifier 250 performs the RSA signature verification 255 on s using is issuer's public-key 253 and obtains the signed message m. Verifier 250 can then i9 compute f = m( )-'t . In the example of using encryption as , this is achieved 20 via decryption f = E,-' (m) . Next, verifier 250 scans data 251 of representing the 21 randomly distributed features in authentication object 251 and creates their 22 presentation f . Verifier 250 compares f to the extracted f .. Verifier 250 needs 23 to quantify the correlation between the two sets of data: the one attached to the z4 certificate and the one used to create the signature on the certificate of is authenticity. At decision block 259, if the level of similarity of the two sets of Ls NVA& ruc 9 ~ts~-iaaus data surpasses a certain ' threshold, verifier 250 announces that the certificate of 2 authenticity 210 is authentic and vice versa.

3 Fig. 3A is a schematic diagram of an example scanning system 300 for ...............4 ...capturing:. randomly.. distributed ..eatures..of authenticatipn .object.. 310.. associated s with a certificate of authenticity. Scanning system 300 includes optical sensor 6 322 and light source 324. Optical sensor 322 is configured to scan authentication 7 object 310 and may include a charged coupled device (CCD) matrix of a particular s resolution. In one embodiment, optical sensor 322 has a resolution of 128 x 9 pixels. Light source 324 is configured to provide light of a particular wavelength io to illuminate a region of authentication object 310. Light source 324 may include, ii for example, a light emitting diode (LED). As shown in Fig. 3A, one end of fiber 12 326 in authentication object 310 is illuminated by light source 324. The light is 13 transmitted to the other end of fiber 326 and is sensed by optical sensor 322.

14 Fig. 3B is a top view of the authentication object 310 in Fig. 3A. In is operation, the scanning system 300 divides authentication object 310 into regions, 16 such as regions 311-314. As shown in Fig. 3B, light source 324 of scanning 17 system 300 sheds light onto region 314 while regions 311-313 are isolated from is light source 324. By illuminating region 314, the location of the endpoints in 9 regions 311-313 of authentication object 310 can be determined by optical sensor 20 322. Thus, the read-out of the randomly distributed features in authentication 21 object 310 includes four digital images that contain four different point-sets. Each 22 point-set is associated with a particular region and is determined by illuminating 23 that region.

24 It is conceivable that advancement in technology, such as nanotechnology, 25 may enable an electronic device to decode the randomly distributed features from = Ll&Rryst n 10 MX).1 ! a ,certificate of authenticity and create a light pattern that corresponds to these 2 features. Such a device may be able to forge the certificate of authenticity. In one 3 embodiment, scanning system 300 may be configured to prevent this method of ..i ..forging. by. .changing. the. wavelength (e.g,. color).of the light,used.
by. light. source ............................
s 324. For example, the wavelength of the light may be randomly selected each 6 time an authentication object is scanned by scanning system 300. Optical sensor 7 322 may be configured to detect the wavelength of the light emitted by the fibers o in the authentication object and to determine whether that wavelength corresponds 9 to the wavelength of the light emitted by light source 324. If the wavelengths of io the emitted and detected light do not match, the certificate of authenticity is likely i 1 a forgery.

12 Fig. 4 is a flow diagram of an example process 400 that may be used to 13 create a certificate of authenticity. At block 405, the authentication object in a 14 certificate of authenticity is scanned The authentication object may be scanned 15 using scanning system 300 in Fig. 3A.

16 At block 410, data representing the randomly distributed attributes of the 17 authentication object is determined. In a fiber-based authentication object, the is data may include the positions of the endpoints of fibers that are illuminated, such I9 as the endpoints shown in Fig. 3B.

20 At block 415, the data is compressing to enhance the security level of the 21 certificate of authenticity. Data compression will be discussed in detail in 22 conjunction with Fig. 5. Briefly stated, a path may be determined for compressing 23 a portion of the data representing randomly distributed attributes in the 24 authentication object.

LM a XqVA Pa .C l 1 ,us,.o,+us I At block 420, the compressed data is encoded. For example, the 2 compressed data may be signed using private-key 233 in Fig. 2. At block 425, the 3 encoded data is incorporated in the certificate of authenticity. For example, the ......... 4.... encoded data. may be printed. onto. the. certifi, cate, of authenticity, as a, barcode, such ..., ................ .
s as baroode 213 in fig. 2.

6 Fig. 5 is a flow diagram of an example process 500 that may be used to 7 compress data that represents the randomly distributed attributes of an e authentication object. For the purpose of discussion, process 500 will be described 9 in the context of a fiber based certificate of authenticity. However, process 500 to may be applied to any type of certificate of authenticity.

1, At block 505, a probability density function associated with the 12 authentication object is determined. Probability density function will be discussed 13 in Section 111-A. An example probability density function is shown in Equation 14 ll. A graphical presentation of the example probability density function is is illustrated in Fig. 8. Briefly stated, the probability density function represents the 16 likelihood that a unit of the randomly distributed attributes is found in a certain 17 location of the authentication object. In the context of a fiber-based certificate of is authenticity, the probability density function may represent the probability that a i9 particular point in a region of the authentication object is illuminated.
The 20 probability density function may also be used to compute how many of the total 21 fibers will be illuminated in a particular region.

n At block 510, vectors associated with the randomly distributed attributes 23 are determined. In the context of a fiber-based certificate of authenticity, point-to-24 point vectors are used and will be discussed in Section IV A. In particular, 2s c.. a ruc 12 ~rsr.~n+us i Equation 16 may be used to compute point-to-point vectors to represent the 2 randomly distributed attributes in a fiber-based certificate. of authenticity.

3 At block 515, the vectors are encoded using an arithmetic coding algorithm.

...........: ... Arithmetic coding.. algorithm. will. be , discussed , in.
Section. V A....An..example ...............
s algorithm is shown in Table 2.

6 At block 520, a path for compressing a portion of the vectors within a fixed 7 amount of data is determined. The method for computing the path is discussed in 8 Section IV B. The example path may be computed using Equation 20. At block 9 525, the path of the compressed data representing a portion of the randomly ,o distributed attributes is returned.

12 IIL Certificate of Authenticity Model 13 In this section, an analytical model of a fiber-based certificate of 14 authenticity is discussed. Two features of a certificate of authenticity S
are is modeled. Given that a particular region S, of the certificate of authenticity is 16 illuminated, the probability density function that a particular point in S -S, is 17 illuminated is computeck Also, given that K fibers are in S, the expected number ,.s of fibers that are illuminated in S - S, is also computed.

20 A. Distribution of Illuminated Fiber End-Point 21 An authentication object (L,R,K) is modeled as a square with an edge of L
22 units and K fibers of fixed length R -,s L/2 randomly thrown over the object. Other 23 model variants, such as variable fiber length or arbitrary shape authentication 24 object, can be derived from this model. The authentication object is positioned in 2s the positive quadrant of a 2D Cartesian coordinate system as illustrated in Fig. 1.
i., e,~,.a ruc 13 1 In addition, the authentication object is divided into four equal squares 2 S = {S,,S2,S3,S4} . Each of them is used to record the. 3D fiber structure as 3 described above in conjunction with Fig. 3A and 3B. Next, a fiber is denoted as a ...............4 ...tuple...f.w.{AB)...of. points....A,BcS..such.. tk t...the..distance,..between..them..is ...................
IAA-BIER.

7 Definition 1. Distribution of Illuminated Fiber End-Points. Given that s one of the squares S, is illuminated, the probability density function (pdf) 9 .p(i, Q(x, y)) is defined for any point Q(x, y) c S - S, via the probability c(i, P) that to any area P c S - S, contains an illuminated end-point A of a fiber f _ {A, B1, 11 conditioned on the fact that the other end-point B is located in the illuminated 12 region S,. More formally, for any P c S - S, :

F(i,P)=Pr[AcPJ f=(A,B)cS,BcS,] (6) ,5 = If p(i.Q(x,y)*dy.

Assume that throwing a fiber f = (A, B} into an authentication object is consists of two dependent events: (t) first end-point A lands on the authentication object and (u) second end-point B hits the authentication object. While A can land anywhere on the COA, the position of B is dependent upon the location of A A. Endpoint B must land on part of the perimeter of the circle centered around A, with a radius R, and contained within the authentication object. In the remainder of this subsection, the function p(i, Q(x, y)) is analytically computed based on the ,..., , PLLC 14 .~1--.-.. 1 I

i analysis of the events (W). For brevity, only q,(i,Q(x, y)) is computed for the case 2 when region S, is lit up. q,(1, Q(x, y)) are computed in two steps.

::..:..:......... :................Definition...'etlietex..Can#sinmeat., First,:,~or a giyeu, point A c S.,., the......
. ... .............
s perimeter containment function e(A) is defined, which measures the length of the 6 part of the perimeter (arc) of the circle centered at A with radius R that is 7 encompassed by the entire authentication object S. There are four different s regions in the authentication object (marked P1 through P4 in Fig. 6) where e(A) 9 is uniformly computed.

Fig. 6 is a graphical representation of areas P 1-P4 that correspond to the' ii four different regions in an example authentication object 600. For each point in a 12 certain area Px, the perimeter containment function is computed using a closed 13 analytical form distinct for that area using Equations 7-10 as discussed below.

14 AREA P1. This is the central area of the authentication object, where for any is point Q c P 1, the circle with radius R centered at Q does not intersect with any of 16 the edges of the authentication object. The area is bounded by: R s x s L-R, 17 RSySL-R.

1s e(Q(x, y)) = 2R,r. (7) AREA P2. There are four different P2 regions, where a circle with radius R

centered at any point Q c P2 intersects twice with exactly one edge of the authentication object. For brevity, consideration is give only for the following one:

R:5 x:5 L - R, 0 5 y < R. Equations for other three regions can be symmetrically computed.

IM l nq Puc 15 wcu-/ONUS

~ =

2 e(Q(x, y)) = R fr + 2 aresin (R~ . (8) ........ ARE~-'P3: There;are four.different'P3 regions, where a'eircle'with*radius* A

3 centered at any point Q c P3 intersects twice with two different edges of the 6 authentication object. Consideration is give only for, the following one:
0:5 x < R, Osy<R, XI +y22R2.

e(Q(x,Y)) = 2R R-arccos(R )-arccosl R . (9) 13 AREA P4. There are four different P4 regions, where a circle with radius R
14 centered at any point Q c P4 intersects once with two edges of the COA.
Consideration is give only for the following one: x2 + y2 < R2 .
1s 16 r 17 e(Q(x, y)) = R 2 +aresinl R)+aresin(R~ . (10) 1E l 19 In all Equations 8-10, only the return values of functions aresin(=) and arccos(=) that are within (0,,d2) are considered.

21 In the second step, the actual qr(1, Q(x, y)) is computed based on the fact that 22 an illuminated endpoint A of a fiber f = (A, B) is at position A = Q(x, y) only if B
23 is located on the part(s) of the circle C(Q, R) centered at Q(x, y) with a diameter 24 R and contained by S, .

L..,,RM PUC 16 ~er~.,s ar,s = =

Lemma 3. Dependence of rp(i,Q(x, y)) from e(Q(x, y)). Using function 2 e(Q(x, y)), pdf p(i,Q(x, y)) is computed using the following integral:

aRd9 :4 .............. ......c(i,.Q(x..Y)).=..... J....... (11)............
ctQ,s, where 9 browses the perimeter of C(Q, R) c S, and a is a constant such 7 that:
$

p(i. Q(x, y))dxdy =1. (12) 12 A point Q c S - S, can be illuminated only due to a fiber f = {Q, B), such 13 that B c S,. This implicates that B is located somewhere on the perimeter of the 14 circle C(Q, R) contained by S,. For a given fiber f = {A, B), the probability that A

lands on a specific infinitesimally small arc of length dl c S, is equal to dt/e(B).
1s 16 Hence:

90, Q)=area(S-S,)"1 f 4Rdld9 (13) 1s c(g s, P(B(Q, R,,9) c C)dl 20 where function area(S - S) computes the area under S - S, . Thus, the pdf 21 q,(1, Q(x, y)) at a point Q c S - S, is proportional to the integral of the inverse of the 22 value of e(=) over C(Q, R) C S, .

23 Figure 7 is a graphical representation of the nineteen different regions on an 24 example authentication object 700 that have distinct analytical formulae as a 25 solution to the integral quantified in Equation 11. For brevity, g3(1,Q(x,y)) is ws x.,.. ruc 17 ~ts~.~uau = ;~ =

i approximately solved using a simple numerical computation. The results is 2 illustrated in Fig. 8 3 Fig. 8 is a graph of an example probability density function for a square 4.....authentication object with parameters. L = 64 and R = 28 sampled at unit points.
s Fig. 8 shows that the likelihood that an endpoint of a fiber lands on a certain small 6 area P c S - S, varies significantly depending on the particular position of P
7 within S - S, . By using the information about the variance of p(i, Q(x, y)) s throughout S-Sõ the point-subset compression algorithms can be significantly 9 improved, as presented in Section N Manufacturing authentication object such to that q,(i,Q(x,y))=corist. over the entire area S-S,, is a non-trivial task, probably 11 as difficult as forging an original authentication object.

Area Bounds IV(t, Q(x, y)) 14 TO 05x5L/2-R. O5y5L/2-R o Is TI x2+(y-L/2)2 <R2, 05x5L/2-R. R[aresinO+arccosu~' )]
L/2 - R < y 5 L/2 R
16 72 x2 + (y - L/2)2 z R', 0 5 x S L/2 - R. 2Rarccos(uaR
17 L/2-R<y5L12 x2 +(y-L/2)2 2 R2.
is T3 (x - L/2)2 +y2 Z R2 , 2R [anxos ('22,2)+arccos(a)]
19 (x - L/2)2 + (y - L/2)2 2 R2 20 x2 +(y-L/2)2 <R2. R[aresin(R)+aresin(R)]
T4 (x - L/2)2 + ys <,R2, 21 (x - L/2)2 + (y - L/2)2 2 R2 R [arccos ( )+ arccos ( Liz)]+
22 x2+(y-L/2)2 <R2, Ts (x - L/2)2 + y2 < R2 , R [I+ aresin (R )+ aresin (f) 23 ]
(x - L/2)2 + (y - L/2)2 < R=
x2 +(y-L/2)2 < R2. R[aresin(,)+arccosOK +

25 (x - L/2)2 + y2 2 R2 , 2R arccos( ) L... liptit, PL.C 18 lrsF!!lais (x-L/2)2+(y-L/2)2 ZR2.
L/2 - R < x S L/2 2 x2+(y-L/2)2 <R2, 77 (x-L/2)2+y2zR2, R[Z+=sin ( )+arccos( )]
3 (x-L/2)2+(y-L/2)2 <A2 .......... ...: 4..............................x2. + (y.-L/2)2.Z.
R2................................................................ .
is (x-L/2)2+y2 zR2. R[ +arccos(Y-jL)+arccos( (x - L/2)2 + (y - L/2)2 < R 2 Table 1.

a B. Illumination Ratio of Fiber End-Points Definition 3. Illumination Ratio of Fiber End-Points. For an authentication object (L,R,K) and its illuminated region S,, the illumination ratio A is defined as a probability that a fiber f = {A, B} has landed such that one of its end-points is in B c S - S, conditioned on the fact that the other end-point is in ACS,:

1s A=Pr[BcS-S, I f ={A,B},AcS,]. (14) 17 Definition 4. Possibly Illuminated Arc. For any point A c S, a function 1 ` p (i, A(x, y)) is defined that measures the length of the part of the perimeter of 19 C(A, R) contained by S - S, .

Figure 9 is a graphical representation of the areas TO-T8, where 21 yr(i,Q(x, y)) is computed using distinct closed analytical forms. p(i,Q(x, y)) is 22 analytically computed based on the analysis of the events (i-i:) from Section 111-A.
23 Similarly to Section 111-A, only in the case when region S, is lit up is computed.
24 There are nine different regions in the COA (marked TO through T8 in Fig.
9) 2s ~.. 19 ~~.~

i where yi(1,Q) is computed uniformly. The analytical closed forms for Rv(1,Q) 2 depending on the location of Q within S, are given in Table 1.

a Lemma....4.,... D-epe.ndence... of ..ly(1,Q(x,Y)), P(Q(x,Y)),... and... ,.
The s illumination ratio defined as in Def.3, can be computed as follows:

7 . -v(i,Q(x, y)) dxdy. (15) Q(X'Y)cs, e(Q(x, y)) A circle centered at a point A c S with radius R is denoted as C(A, R) . For each point Q c S, , the likelihood that. the other end-point B of a fiber f =
(Q, B) I I lands within S - S, , equals the ratio of lengths of parts of the perimeter of C(Q, R) contained by S - S, and S respectively. By integrating this ratio over all points 13 within Sõ Equation 15 is obtained.

Given an authentication object (L,R.,K), using A, computed by numerically approximating Equation 15 and the closed forms for yr(1,Q) from Table 1, one can 16 compute the expected number of illuminated points in S - S, when S, is 17 illuminated as 2K/2 . For example, for an authentication object (64,28,100) the Ir resulting 2 w 0.74, which means that on the average, the number of illuminated endpoints in case S, is illuminated, is about 0.74.50 = 37.
N. Compression of a Point-Subset in a COA

21 The goal of the certificate of authenticity system is to ensure that the task of 22 manufacturing (i.e. forging) a specific authentication object instance as difficult as 23 possible. This goal is quantified as a demand for recording the positions of as many as possible fibers of the authentication object. In the example compression L,~xq., ru 20 ,ws~.,nus 1 algorithm, the number of regions of authentication object equals four;
hence, for 2 each region SI, a quarter nõ/4 of bits in the signed message m is dedicated to 3 storing as many as possible fiber end-points illuminated in S - S, once light is shed ......... 4...on. S, ....Note. ht in general,. . not. all..illumuated..points need to be stored; only .. the .. .
s largest subset of these points that can be encoded using n.14 bits.

6 In this section, a mechanism is described, which is configured to encode the 7 -distance between two illuminated points in an' authentication object. The $ mechanism is based on arithmetic coding. Next, the problem of compressing as 9 many as possible fiber endpoints using a constant number of bits is formalized.
to Finally, the discussion will show that this problem is NP-complete and a ii constructive heuristic as a sub-optimal solution is presented.

13 A. Encoding Point-to-Point Vectors 14 In this subsection, how a vector defined by its starting and ending point is is encoded using a near-minimal number of bits is described. An additional 16 constraint is that the points in the considered area occur according to a given pdf.

1a 1) Arithmetic coding:

19 An arithmetic coder (AC) converts an input stream of arbitrary length into a 20 single rational number within [0,I}. The principal strength of AC is that it can 21 compress arbitrarily close to the entropy. The discussion below shows how a word 22 "aba" is encoded given an alphabet with an unknown pdf of symbol occurrence.

23 Fig. 10 is a graphical representation of an example of how an arithmetic 24 coder encodes the string "aba" is encoded given an alphabet L = (a,b) with an 23 unknown pdf of symbol occurrence. The example is illustrated in Fig. 10.

u..,~.c,ticc 21 ~r~nsa~s 1 Initially, the range of the AC is reset to [0,1) and each symbol in L is given an 2 equal likelihood of occurrence Pr[a] = Pr[b] =1/2 . Thus, the AC divides its range 3 into two subranges [0, 0.5) and [0.5,1), each representing "b" and "a"
respectively.
4 ...Symbol.. a.. is, encoded by constraining ining the range of the AC to the range that .....................................
corresponds to this symbol, i.e., [0.5,1). In addition, the AC updates the counter for 6 the occurrence of symbol "a" and recomputes Pr[a] = 2/3 and Pr[b] =1/3 . In the 7 next iteration, according to the updated Pr[a],Pr[b], the AC divides its range into a [0.5,0.6667) and [0.6667,1), each representing "b" and "a" respectively.
When "b"
9 arrives next, the AC reduces its range to the corresponding [0.5,0.6667), updates 1o Pr[a]=Pr[b]=2/4, and divides the new range into [0.5, 0.5833) and 11 [0.5833,0.6667), each representing "b" and "a" respectively. Since the final symbol 12 is "a", the AC encodes this symbol by choosing any number within 13 (0.5833,0.6667) as an output. By choosing a number which encodes with the 14 fewest number of bits (digits in our example), 0.6, the AC creates its final output.
The decoder understands the message length either explicitly in the header of the 16 compressed message or via a special "end-of-file" symbol.

17 The AC iteratively reduces its operating range up to a point when its range i is such that the leading digit of the high and low bound are equal. Then, the 19 leading digit can be transmitted. This process, called renormalization, enables compression of files of any length on limited precision arithmetic units.
21 Performance improvements of classic AC focus on: using precomputed 22 approximations of arithmetic calculations, replacing division and multiplication 23 with shifting and addition.

24 An AC encodes a sequence of incoming symbols s=s,,s2,... using a number of bits equal to source's entropy, H(s) Pr[s, ] 1og2 (Pr[s, ]) . Hence, for La a If*" I ac 22 uaI.1VNW

1 a semi-infinite stream of independent and identically distributed symbols, on a 2 computer with infinite precision arithmetic, the AC is an optimal, entropy coder.

.............4 ............. .2.-,Arithmetic.Encoding of a Min-Di lance_,['.P*7tq-Point Kector s Given an authentication object (L,R,K), it is assumed that light is shed on 6 one of its quadrants, S, . Next, we assume that the authentication object is 7 partitioned into a grid of L x L unit squares U = u(i, j),i =1...L, j =1...L
, where each a u(i, j) covers the square area within x e (i -l,i], y e {j -1, j]. Unit areas model the 9 pixels of the digital scan of an authentication object. The resolution of the scan 1o equals L x L . Next, a principal point of a unit u(x, y) is defined as a point Q, with 1 coordinates (x, y).

13 Lemma 5. Unit Illumination Likelihood. Assuming there are K fibers 14 with exactly one end point in S - S, , the probability that any unit area 1s u(x, y) c S - S, contains at least one illuminated fiber end-point equals:

r(u)=Pr[(3f ={A,B}aF)Acu,BcS,] (16) =1-[1-~(i,u)]`.

And 20 r(u) = Pr[(Bf = {A, B} a F)A a u, B c S, ] = l - Pr[(-,3c E F)A c 21 u,BcS,]=1-(l-Pr[Acu,BcS,I f=(A,B)])"

23 From Equation 7, Equation 16 is concluded. In Section III-B, the 24 expectation for x' is E[x] = 21K12 is computed.

L" e mom MAC 23 ~rsr.ro,.us f =

i Problem 1. Dual' Vector Encoding for COA. Conditioned on the fact that 2 unit u c S - S, contains an illuminated fiber end-point, a goal is to encode using as 3 few as possible bits the locations of two other illuminated units v, and v2 relative ::....... 4 .to.unit:u...An.additional.constraint is that.among.all illuminated units in S-Sõ the s principal points of v, and v=, Q, and Q. respectively, are located at two shortest 6 distances in Euclidean sense from the principal point of u, Q. A priority rule is 7 set so that if a set of units V, I V 1> 1 are at the same distance with respect to u, the s one with the highest likelihood of illumination: argmax,,,(r(v)) is encoded first.

to Set U as a list of all unit areas in S - S, - u .

11 List of all marked units, M(u), is set to M(u) = 0 .
12 do 13 Find all unit areas V = argmin,ru II Q, - Q, q .
14 do ~s Find unit area w = argmaxõ,, 4(l, v) .

16 Set AC range for w to y(wu) (see Egns.17,18).
17 Set of nodes ordered before w is M, (u) = M(u) .
Is M(u)=M(u)uw, Y=V-w, U=U-w.

19 while V ;e 0 20 while U*0 21 Table 2. ALGORITHM Al.

23 The encoding of a unit-to-unit vector is done using an AC, which uses 24 algorithm Al to assign a corresponding range on the encoding interval for each 2s encoding symbol, i.e. each unit v c S - S, different from the source unit u. For LM&HO'Arcc 24 .raI.I9J4W

1 each unit v, algorithm Al assigns a range equal to the probability that v is one of 2 the two closest illuminated units with respect to the source unit u. This probability 3 is denoted as p(v ~ u). In the case when a 3- 1 units are expected to illuminate in p(v u)=v(v) H [1-r(w)]+ (17) 6 rcaL(~) r(v)r(w) fl [1- r(z)], wcM(r) scM,(M).srw where the set of units M,(u) is computed as in algorithm Al. For each unit 11 V, algorithm Al assigns a range y (v, u) used by the AC to encode v conditioned 12 on the fact that u has already been encoded. This range is equal to:

is y(v.u) = E F(AW [U) (18) is wcS-s, 17 Thus, the two nearest illuminated units are encoded by construction near-1a optimally (e.g. the encoding is optimal on a processor with infinite precision 19 arithmetic) because a sequence of symbols is encoded using a number of bits approximately equal to the entropy of the source:

H(u) y(v, u) logs [y(v,u)]. (19) 22 Cs-s, 24 Dual vector encoding is used as a primitive to encode a subset of points in the overall compression algorithm presented in the Section IV B. Although the a..a ?LW 25 us~.nsrus r i enpoding algorithm is near-optimal for the set of assumptions presented in Section 2 IV A.2, the same set of constraints is not valid for the overall compression goal, 3 hence, the inherent optimality of using arithmetic coding with range allocation via :..........4 ... 1. is discussed in Section IV B.. ......... ..
.............. ................. ..................... .......... .......... .
.
s et 6 B. Compression of a Point-Subs 7 The optimization problem of compressing the positions of as many as s possible illuminated unit areas using a fixed number of bits is modeled.
Consider 9 the following directed complete graph with weighted edges. For each illuminated to unit u e S - S,, a node aõ is created. A directed edge e(u, v) from node nõ
to node t1 nv is weighted with the optimal length of the codeword that encodes the vector 12 that points to v, 0(e(u,v)) _ -1og2 [y(v, u)] as in Equation 19, conditioned on the t3 fact that u is already encoded. Lets denote this graph as G(N, E,12) , where N, E, 14 and in represent the set of nodes, directed edges, and corresponding weights is respectively.

17 Problem 2. Compression of a Point-Subset (CPS).

1s INSTANCE: Directed, complete, and weighted graph G(N,E) with a non-19 negative vertex function 0: E -+ R, positive integer 1,,,,, a Z+, positive real number 20 AeR'.

21 QUESTION: Is there a subset of I > I.. nodes N' c N with a path through zz them, i.e. a permutation < n (,) >, such that the sum of weights along the 23 path is:

~,i,.. Our 26 ,its1_1nws .-= =
!-1 tv(e(n,c ~ ~ n~ ,+u )) <A. (20) ...... ....... Pi+oblemr'2' models--the optimization- problem of coinpressing..as many' . as.....................
Possible (i.e. 1) fiber end-points in an authentication object using a fixed storage 6 (i.e. A). This problem is NP-complete as it can be shown that the ASYMMETRIC
TRAVELING SALESMAN PROBLEM, ATSP, can be reduced to CPS, ATSP S CPS, via $ binary search for A. In the remainder of this section, an efficient constructive 9 heuristic A2 is presented that aims at solving this problem. The premier design requirement for the heuristic is fast run-time performance because each certificate it of authenticity must be signed separately at a manufacturing line.

12 First, the distance measure between two nodes in N does not obey the 13 triangle inequality for all nodes. Intuitively, the encoding procedure from Section 14 IV A encodes vectors in. S - S, using a number of bits proportional to the likelihood that a certain unit is one of the two closest illuminated points.
Hence, 16 units farther from the source node are encoded with significantly longer 17 codewords as they are unlikely to occur, which renders shortcuts to these nodes in 19 the solution route highly undesirable.

Theorem 2. The distance measure w does not universally obey the triangle inequality:

23 w(e(u, v)) + a)(e(v, w) .k w(u, w).

i.. a x4.. ruc 27 ,usii~uus = s 3 For simplicity, assume that (Vu c S - S) t = r(u) = cont., then u, v, and w 2 are positioned along the same line in S - S,. The Euclidean distances 11 u -v 3 II' - w jj, and H u - w II are a, b, and a+b respectively. The triangle inequality that ............ 4. unpl><es ..... ....f(uv,w) =1og2.[Y(w,u)}-logs. [r(~, )J.-loge [r(w,v)} Z 0 . From ....................... ........
s Equations 17 and 18, the following can be computed: .

7 f(a,b, t) =2abRlog, (1-t)+log2 1 t -t (21) (l-t)2 +(a2 +b2)rrt(1-t)+a'b',r2t2 -loge 1+ (a+b)2A-1 t 11 and show that for abrrt 1, the triangle inequality does not hold, i.e., 12 f(a,b,t)<0.

13 The best approximation algorithm for ATSP where the triangle inequality 14 holds, yields solutions at most 1096 N p times worse than the optimal.
is Alternatively, to the best knowledge of the authors, approximation algorithms for 16 ATSP variants where the triangle inequality does not hold, have not been 19 developed. In the general case, when the distance metric function w is arbitrary, Ii the ATSP problem is NPO-complete, i.e. there is no good approximation algorithm 19 unless P = NP. On the other hand, approximation algorithms for variants of TSP
which satisfy a scaled version of the triangle inequality:
21 p(w(e(u, v)) + w(e(v, w))) Z w(u, w), u > 1 can be solved with a worst case result 22 (3p + 1) u12 times worse than the optimal solution. Distance metric w does not 23 follow this constraint, hence, a heuristic for Problem 2 is developed without a 24 worst-case guarantee. In addition, we aim for as good as possible performance of the heuristic on the average, rather than a worst-case guarantee.
Authentication ~. E,~.. 28 .~-~

=

1 object instance which 'cannot be compressed satisfactorily can be disposed.
2 Likelihood of this event should be small, less than one in a million.

.4 ............ ONSTRUCTNE PHASE

s Set of edges E' = (argmin,(a,(a, b), aKb, a)) I (Ha, b) c N) .

6 Set of subpaths P is selected as a set of shortest K edges 7 in E' s.t. Z -1 a~(e,)5 A sorted by w.

8 Denote the weight of the shortest edge in E as a).,,, .
9 for each path p,cP,i=1..K-1 for each path p, c P, j = i + L K

11 if p, and p, have a common source-destination node 12 Concatenate p, and p. as p, = p, J p1 .

13 Remove pJ from P.

14 Denote source and destination nodes of a path p, c P
as s, and d, respectively.

16 for each path p, c P, i =1..K

17 Find all shortest paths q(i, j) from s, to any d f, j * 1.
18 while I P l< maxP

19 (P P) = argmin Concatenate p, = p, I q(i, j) I pj and remove pp from P.
21 Find exhaustively a concatenation pa, = p, I ...I p s.t.

22 M(&)(Yay(e) < A and I pl, is maximal ) .
23 route(p,, ) 24 reroute( & ) PbW = Ph a.,., ruc 29 ws,-193"

1 } =

for each edge e(s,,d,)c ph,i=1,...,1ph I-1 2 for each node pair (d,, sl) c ph, j = i + 2,...,I ph 3 Find shortest path q(i, j) via nodes in N - ph.

if path q(i, j) I e ,..., has a better metric s M(ph) then perõ

6 then per,=ph.

8 repeat I times 9 Contract ph so that w(e) S.pA, where p is a contraction factor, randomly chosen from p e {0.4,0.8} .
1 Denote nodes no and n, as the first and last node in ph.
12 while E. P. w(e)5 A

13 Among edges that have no or. n, as destination or 14 source respectively, find edge e with minimal weight.
is Concatenate a to ph.

16 rereoute(ph ) 17 TABLE 3. ALGORITHM A2.
is 19 The rationale behind using the distance metric rv from Section IV A is based on an assumption that a good solution succeeds to traverse each node on its 21 route via the two closest neighboring nodes. Hence, in the scope of Problem 2, the n used metric is optimal only if the best solution found satisfies this property. If the 23 final solution does not have this property, the optimality of encoding a single 24 vector is dependent upon the distribution of weights of the edges in the solution.

~.. ,ti,,..; PUC 30 "n-MOW

The developed heuristic A2 has two stages: a constructive and an iterative 2 improvement phase. The constructive phase follows a greedy heuristic which 3 builds the initial solution. Initially, A2 identifies a set of dominating edges .8'. For ,.. each,pak of edges,.e(v,u), between nodes U, V, A2 selects only the shorter of the two and stores it in E'. Next, a set P of initial subpaths is created by 6 sorting the edges in E' and selecting the top K shortest edges whose weights sum 7 up as close as possible to A. The first and last node in a path p, are denoted as s, a and d, respectively. In the next step, A2 concatenates subpaths from P
iteratively 9 in the increasing order of their weights: at any point, the pair of shortest subpaths to põ p, which have a common source-destination node d, = s f, is concatenated until 11 all possible connections are established. In the unlikely out when I P ~=1, the 12 .. optimal solution is found and the search is stopped. Else, all single-edge subpaths 13 are removed from P. Then, using Dijkstra's algorithm, A2 finds all shortest paths u between each destination tail d, of each subpath p, in P and source tails of all is other subpaths, sl, i = i... [ P 1, i * j. The shortest paths are routed via nodes which 16 are not in P . The shortest path is denoted between s, and d1 as q(i, J).
In another 17 greedy step, A2 sorts all concatenations p, I q(i, j) I p f according to their la weight/node count ratio. In increasing order of this metric, A2 continues 19 concatenating subpaths in P via nodes in N - P until the total number of 20 remaining paths is I P I= maxP (usually maxP = 9 ). The remaining paths are 21 concatenated using an exact algorithm which finds a path p, with the optimal 22 metric: maximal cardinality and a sum of weights smaller than A. In the final step, 23 a rerouting procedure browses all the nodes in P, and using the Dijkstra algorithm 24 tries to find shortest paths to other nodes in P via the remaining nodes in E. The 25 same procedure also tries to find a better ending tail than the one that exists in p..

u. t iw.w rue 31=~uaar =

I For each reroute, A2 checks whether the new reroute has a better metric than the 2 current, best path p,, .

3 Figure 11 is an example of an instance of an authentication object ...............4 :..(512,0.4.=512,25.6). is-shaven. with.,r: =.$8 ao4es..A2.retarne4_the. path illustrated I.. .
s with bold lines. The path is such that its sum of weights is smaller than A
= 512.

6 To document the path, 12.11 bits per point is used.

7 . In the iterative improvement phase, we repeat several rounds of the s following loop. In the first step, A2 contracts the currently best found path p..
9 into pa,, so that I p, i is maximal and the sum of weights along p,F is smaller than a io fraction of pA. The contraction parameter p is randomly selected in each i i iteration within p e {0.4,O.8}. Nodes no and n, are denoted as the first and last 12 node in pb . While the sum of weights in pa is smaller than A, among edges that 13 have nõ or n, as destination or source respectively, we find an edge e with 14 minimal weight and concatenate it to p.. When the new candidate path põ is is created, it is adopted as the best solution if its metric is better than the metric of 16 the best path created so far. As a last step of the iterative improvement loop, A2 17 performs the rerouting procedure previously described.

to In order to fit the run-time of A2 for a particular authentication object 19 (L,R,K) class within one second, the improvement loop is repeated I =
(100,10000) 20 times. In general, the worst-time complexity of A2 is Oa N r log I N D as multi-21 source shortest paths are computed via the Dijkstra algorithm. In an 22 implementation that uses the Floyd-Warshall algorithm to compute all pairs 23 shortest paths, the complexity of A2 can be reduced to OQ N r). Although the 24 graph is originally complete, by removing edges with high weights, we create a s Airu.c 32 us~.~swus t sparse graph, where Johnson's algorithm for all-pairs shortest paths yields 2 OQN f logINI+INIIED.

4. V

s The discussion in this section shows how authentication object (L,R,K) 6 parameters impact the performance of the algorithm A.2. Figure 11 illustrates a 7 solution to a single instance of the problem, an authentication object s (512,0.4-512,256). The scanning grid to L-512 scanning cells. The figure 9 depicts the case when the lower left quadrant of the authentication object is to illuminated. Graph G(N,E), built using the corresponding illuminated fiber end-ii i points, is illustrated with medium bold lines. Only the top ten shortest edges 12 starting from each of the x = 88 nodes in the graph is shown. The resulting path 13 shown in the figure using bold lines, consists of 41 nodes. The sum of weights 14 along path's edges is smaller than the storage limit: A -512, bits. The path is is compressed using 12.11 bits per fiber end-point (b/fep). Storing the data without 16 compression would require 41.18 = 738 bits, which results in a compression ratio 17 of 0.61. The compression ratio is defined as a ratio of the size of the compressed is message vs. the original message size.

20 VI. A Design ObJective for a COA System 21 A goal of the certificate of authenticity designer is to maximize the cost of n forgery s.r using a bounded manufacturing cost sõ . Several parameters may z3 impact Sm . For brevity and simplicity, three parameters are discussed:

24 the total length of fiber RK s 0, 25 the scanning tolerance ; and 33.

= 1 =
1 the barcode storage A.

2 System performance is optimized by limiting the number of trials available 3 to the adversary for accurate positioning of a sufficient subset of the signed fiber ............. .4 en.-points (Sectwn.VI-A and ..y.se,ecting..e.systerri parameters ..{R........so,... t s expected forging cost SI (A2) is maximized (Section VI-B).

7 A. Limiting the Number of Adversarial Trials' s Consider a compression scheme C which stores G out of the w 9 illuminated fiber end-points in a A -limited storage. In general, when forging a 1o certificate of authenticity, the adversary can use all r fibers to-try to place at least 11 G~ of them accurately at their corresponding locations. Cost of forging a 12 certificate of authenticity greatly depends upon the number of available trials.
13 Here, a technique is proposed which aims at. reducing the number of adversarial 14 trials, K, by detecting anomalous distribution of fibers around the signed fiber 1s end-points during verification.

is ISSUING A COA INSTANCE

19 Scan for a set N of K points, illuminated when light is shed on S, .
20 Using A bits, compress a subset P c M, with G =l P IS j r.

21 Find a subset of units U c S - S, , such that u (Vu, E U)(Vp,E P) minQl u, - Pj ID < e, .

23 E_ =I NnUI-G, K,. =G+e2.

24 Sign P, c, and the associated information (see Section 2).

L.. Hem ILLC 34 .~,., = .j =
1 ' I Extract P, a from signature.

2 Find a subset of units U c S - S, , such that 3 (Vu, E U)(vp1 E P) mint u, - p1 ID < e, .

......4 : ............ ... . Scan. fora set N' of x'. points,. illuminated, when light is, shed.on . $.,,........................... . .
s if I N' n U h Kr then COA instance is invalid, 6 elself I N' n P IZ G~ then COA instance is valid, 7 else COA instance is invalid.

s TABLE 4. ALGORITHM A3 io The certificate of authenticity issuer and verifier repeat their parts of the i i algorithm A3 for each authentication object quadrant S, . The issuer initially scans 12 the authentication object instance and collects information about the set of points 13 N which illuminate when S, is lit up. Next, using the available A bits, it 14 compresses the largest subset P e N, I P J- G returned by A2. Then, A3 finds a is subset U c S-S,, such that the Euclidean distance between each unit u, e U
and 16 its closest unit p1 E P is at most e,. Subset U of units represents an e, -17 neighborhood of P. Then, the issuer counts the number K,, of points in N
that is exist in U. Since, Kr has to be greater than G to prevent false negatives, the 19 issuer stores along with P, the difference s2 - K7 - G in the message m, which is 20 later signed using the private key of the issuer (see Section 11). Using the public 21 key of the issuer, the verifier extracts from the attached signature the compressed 22 point subset P and e2 and recreates the corresponding e, -neighborhood, U .
Then, 23 the verifier scans the authentication object instance for the set of illuminated fibers 24 N' when S, is lit up. It announces that the instance is authentic by checking that w= ruc 35 . ~aans the number of common points in U and N' is at most G + e2 and that the number 2 of common points in N' and P is at least GS .

3 By storing s2 in the signature, the adversary is imposed to use at most 4... Kr = G + x .trials tl~41 position fabexs in; th.c.;,, -neig>tbo hoo0. of P,- '4e .adversary's s goal is to place at least GS fiber end-points from P accurately, hence, the 6 adversary can afford G(1- C) + e2 misplacements located in the e, -neighborhood 7 of P during the forgery process. It is expected that each trial, targeting a point p,, s if unsuccessful, ends up in the e, -neighborhood of p, . By increasing C,, the 9 verifier can identify possible misplacements over a larger neighborhood;
however, io this also increases the expectation for s'2 - a value that the certificate of i i authenticity designer wants to keep as low as possible.

12 Below, an empirical design methodology is shown which adopts a given 13 e, = const., and then seeks to maximize the main objective s f(A2) from the 14 perspective of several certificate of authenticity parameters.

'5 16 B. Designing a COA System 17 Problem 3. A Design Objective for a COA System. For a given 1 e compression algorithm A2, fixed RK :5 4), e,, and A, find a cut {Rõ K.) of the is available fiber which maximizes:

21 (R..K.) =arg+Rmaaxo)S.,(A2,R,K), (22) 23 where q f is the cost of forging a COA instance.

.i I Figure 12 is a graphical representation of a certificate of authenticity design 2 for optimized cost effectiveness. The abscissa quantifies fiber length R
relative to 3 L, while the ordinate shows the number of fibers K. The bar illustrates the log -4 cost of forgery log,p( f(A2,R,K)).with a constraint limit A=512 bits and a set of .................... ::..:................... ..
s fixed parameters: S = 0.9, e, = 8, andv = 0.8. The figure also illustrates the quality 6 of solutions obtained for all cuts of a fixed length fiber RK = cD = I00L .

7 A simple empirical technique may be used that searches for the best fiber s cut {R.,K.}. The search procedure is illustrated using Figure 12. The abscissa and 9 the ordinate represent the values of R and K respectively. The bar denotes the to expected log -cost of forging an certificate of authenticity instance, 11 Ioglo (S1 (A2, RK)). The cost is given with respect to R and K, and for a fixed set 12 of parameters: A = 512 , l = 0.9, e, = 9, and v = 0.8 . The diagram in Figure 12 was 13 computed empirically. A2 is applied to 500 randomly generated certificate of 14 authenticity (512,R,K) instances with each combination of is R={0.05L,0.IOL,...,0.45L) and K={80,96,...,192,256,384,512,768,1024}. The 16 expected compression performance for each point in the remaining portion of the 17 {R, K} -space was obtained by interpolating the empirical results. From Figure 12, is the best fiber cut can be found in the neighborhood of K. m 900 and R. w 0.
IL .
19 This result points to the fact that for the selected design environment, a cross-2o shaped certificate of authenticity is the best option. Note that careful selection of 21 the fiber cut resulted in an order of magnitude improvement in the forgery cost n with respect to a randomly selected point on RK = cD . The empirical principles 23 used in this example, can be applied to search for a near optimal parameter set for 24 different certificate of authenticity environments and manufacturing constraints.

LM e õe^ ruc 37 ,usa~v,+us Fig. 13 illustrates an example computing device 1300 within which the 2 described systems and methods can be either fully or partially implemented.
3 Computing device 1300 is only one example of a computing system and is not ...............:. 4. intended to. suggest. any limitation. as. to, the .scope of the use or functionality oft e s invention.

6 Computing device 1300 can be implemented with numerous other general 7 , purpose or special purpose computing system environments or configurations.
a Examples of well known computing systems, environments, and/or configurations 9 that may be suitable for use include, but are not limited to, personal computers, io server computers, thin clients, thick clients, hand-held or laptop devices, u multiprocessor systems, microprocessor-based systems, set top boxes, 12 programmable consumer electronics, network PCs, minicomputers, mainframe i3 computers, gaming consoles, distributed computing environments that include any 14 of the above systems or devices, and the like.

is The components of computing device 1300 can include, but are not limited 16 to, processor 1302 (e.g., any of microprocessors, controllers, and the like), system n memory 1304, input devices 1306, output devices 1308, and network devices is 1310.

19 Computing device 1300 typically includes a variety of computer-readable 20 media. Such media can be any available media that is accessible by computing 21 device 1300 and includes both volatile and non-volatile media, removable and u non-removable media. System memory 1304 includes computer-readable media 23 in the form of volatile memory, such as random access memory (RAM), and/or 24 non-volatile memory, such as read only memory (ROM). A basic input/output as system (BIOS), containing the basic routines that help to transfer information LMOAV PUC 38 ~ccn.~ s i between elements within computing device 1300, such as during start-up, is stored 2 in system memory 1304. System memory 1304 typically contains data and/or 3 program modules that are immediately accessible to and/or presently operated on ... ............. .
..... ....: 4: .. by processor: l 302. .............. ..: .
s System memory 1304 can also include other removable/non-removable, 6 volatile/non-volatile computer storage media. By way of example, a hard disk 7 drive may be included for reading from and writing to a non-removable, non-a volatile magnetic media; a magnetic disk drive -may be included for reading from 9 and writing to a removable, non-volatile magnetic disk (e.g., a "floppy disk"); and to an optical disk drive may be included for reading from and/or writing to a i i removable, non-volatile optical disk such as a CD-ROM, DVD, or any other type 12 of optical media.

13 The disk drives and their associated computer-readable media provide 14 non-volatile storage of computer-readable instructions, data structures, program is modules, and other data for computing device 1300. It is to be appreciated that 16 other types of computer-readable media which can store data that is accessible by 17 computing device 1300, such as magnetic cassettes or other magnetic storage 18 devices, flash memory cards, CD-ROM, digital versatile disks (DVD) or other 19 optical storage, random access memories (RAM), read only memories (ROM), 20 electrically erasable programmable read-only memory (EEPROM), and the like, 21 can also be utilized to implement exemplary computing device 1300. Any number u of program modules can be stored in system memory 1304, including by way of 23 example, an operating system 1320, application programs 1328, and data 1332.

24 Computing device 1300 can include a variety of computer-readable media as identified as communication media. Communication media typically embodies e a x",. PLW 39 Mai-~9e~us i computer-readable instructions, data structures, program modules, or other data in 2 a modulated data signal such as a carrier wave or other transport mechanism and 3 includes any information delivery media. The term "modulated data signal"
refers 4: to a signal that has one flr mire of its characteristics sot or chan.god in. such a s manner as to encode information in the signal. By way of example, and not 6 limitation, communication media includes wired media such as a wired network or 7 direct-wired connection, and wireless media such as acoustic, RF, infrared, and a other wireless media. Combinations of any of the above are also included within 9 the scope, of computer-readable media.

A user can enter commands and information into computing device 1300 u via input devices 1306 such as a keyboard and a pointing device (e.g., a "mouse").
12 Other input devices 1306 may include a microphone, joystick, game pad, 13 controller, satellite dish, serial port, scanner, touch screen, touch pads, key pads, 14 = and/or the like. Output devices 1308 may include a CRT monitor, LCD
screen, is speakers, printers, and the like.

16 Computing device 1300 may include network devices 1310 for connecting 17 to computer networks, such as local area network (LAN), wide area network is (WAN), and the like.

19 Although the invention has been described in language specific to structural features and/or methodological steps, it is to be understood that the invention 21 defined in the appended claims is not necessarily limited to the specific features or n steps described. Rather, the specific features and steps are disclosed as preferred 23 forms of implementing the claimed invention.

i... xq..rxcc 40 .tsr.~wius

Claims (53)

CLAIMS:

1. A method comprising:

determining randomly distributed features in an object;

determining a probability density function associated with the object;
compressing data representing the randomly distributed features, wherein the compressing is based in part on the probability density function;

encoding the compressed data with a signature; and creating a label comprising the object and the encoded data, wherein compressing data representing the randomly distributed features comprises:

determining vectors associated with the randomly distributed features based, at least in part, on the probability density function; and encoding the vectors using an arithmetic coding algorithm, wherein the algorithm comprises:

set U as a list of all unit areas in S-Si- u list of all marked units, M(u), is set to M(u)=.SLZERO.
do find all unit areas do find unit area w=argmax set AC range for w to .gamma.(w,u) set of nodes ordered before w is M w(u)=M(u), M(u)=M(u) U w, V=V-w, U=U-w while W~.SLZERO.
while U~.SLZERO..

2. The method as recited in claim 1, wherein encoding the vectors using the arithmetic coding algorithm includes determining a path for connecting a portion of the vectors within a fixed amount of data.

3. The method as recited in claim 1, wherein the randomly distributed features are fibers that are randomly positioned in the object.

4. The method as recited in claim 3, wherein the probability density function represents a probability that fibers in the particular region are illuminated by a light source.

5. The method as recited in claim 3, wherein the probability density function is derived based, at least in part, on the length of the fibers.

6. The method as recited in claim 3, wherein each vector represents the end points of two fibers.

7. The method as recited in claim 1, wherein the data is encoded with a private key.

8. The method as recited in claim 1, wherein the label is a certificate of authenticity configured to be self-authenticated and wherein the object is an authentication object included in the certificate of authenticity.

9. The method as recited in claim 1, wherein the encoded data is included in the label as a barcode.

10. The method as recited in claim 1, further comprising:

determining textual data that includes a string of characters;
hashing the textual data with an algorithm;

encrypting the compressed data using the hashed textual data; and including the textual data in the label.

11. The method as recited in claim 10, wherein the algorithm is a cryptographically secure hash algorithm.

12. The method as recited in claim 10, wherein the algorithm is an SHA1 cryptographical algorithm.

13. One or more computer-readable memories containing instructions that are executable by a processor to perform the method recited in claim 1.

14. A system comprising an issuer configured to determine randomly distributed features in an authentication object and to compress data representing the randomly distributed features comprising fibers, the issuer being further configured to encode the compressed data with a signature and to create a label that includes the authentication object and the encoded data;

wherein the issuer is further configured to determine a probability density function associated with the authentication object, wherein the probability density function is defined as the likelihood of finding a second end of a fiber at a given location within a non-illuminated area when a first end of the fiber is located within an illuminated area of the authentication object, and to compress the data representing the randomly distributed features by:

determining vectors associated with the randomly distributed attributes based, at least in part, on the probability density function; and encoding a portion of the vectors as a path by applying an arithmetic coding algorithm, wherein the algorithm comprises:

set U as a list of all unit areas in S-Si-u list of all marked units, M(u), is set to M(u)=.SLZERO.
do find all unit areas V=argmin do find unit area w=argmax set AC range for w to .gamma.(w,u) set of nodes ordered before w is M w(u)=M(u), M(u)=M(u) U w, V=V-w, U=U-w while V~.SLZERO.
while U~.SLZERO.

15. The system as recited in claim 14, wherein the probability density function utilizes a perimeter containment function.

16. The system as recited in claim 15, wherein the perimeter containment function assumes that the first end of the fiber can be located anywhere within the authentication object and that the second end of the fiber will be in a location dependent on a location of the first end of the fiber.

17. The system as recited in claim 15, wherein the perimeter containment function comprises different instances, depending on intersection of a perimeter with edges of the authentication object.

18. The system as recited in claim 14, wherein the determined vectors are encoded using a near-minimal number of bits type algorithm.

19. The system as recited in claim 14, further comprising:

a verifier configured to decode the data representing the randomly distributed features in the label and to authenticate the label by comparing the decoded data with the data of the actual randomly distributed features determined from the authentication object.

20. A label comprising:

an authentication object including randomly distributed features; and encoded information associated with the authentication object, the information being encoded with a signature and including compressed data representing the randomly distributed features in the authentication object, wherein the data in the encoded information is compressed by:

determining a probability density function associated with the authentication object;

determining vectors associated with the randomly distributed attributes based, at least in part, on the probability density function; and encoding the vectors using an arithmetic coding algorithm;

wherein the label is self-authenticated by comparing the compressed data in the encoded information and the data representing the randomly distributed features obtained by analyzing the authentication object; and wherein the compressed data was compressed by:

determining vectors associated with the randomly distributed features based, at least in part, on the probability density function; and encoding the vectors using an arithmetic coding algorithm, wherein the algorithm comprises:

set U as a list of all unit areas in S-Si-u, list of all marked units, M(u), is set to M(u)=.SLZERO., do find all unit areas V=argmin do find unit area w=argmax set AC range for w to .gamma.(w,u) (see Eqns. 17, 18), set of nodes ordered before w is M w(u)=M(u), M(u)=M(u) U w, V=V-w, U=U-w, while V~.SLZERO.
while U~ .SLZERO.

21. The label as recited in claim 20, wherein encoded information is included in the label as a barcode.

22. The label as recited in claim 20, wherein encoded information is encoded using a private key.

23. The label as recited in claim 20, further comprising:

textual data that includes a string of characters, wherein the compressed data is encrypted using the textual data.

24. The label as recited in claim 23, wherein compressed data is encrypted by:

hashing the textual data with an algorithm; and encrypting the compressed data using the hashed textual data.

25. An apparatus comprising:

means for determining randomly distributed features in an authentication object;

means for determining a probability density function associated with the authentication object, wherein the probability density function defines a likelihood a point will contain an illuminated second end of a fiber and is conditioned on location of a first end of the fiber in an illuminated region;

means for compressing data representing the randomly distributed features, wherein the compressing is based in part on the probability density function;
means for encoding the data with a signature; and means for creating a label that includes the authentication object and the encoded data, wherein the means for compressing data representing the randomly distributed features comprises:

means for determining vectors associated with the randomly distributed features based, at least in part, on the probability density function; and means for encoding the vectors using an arithmetic coding algorithm, wherein the algorithm comprises:

set U as a list of all unit areas in S-Si-u, list of all marked units, M(u), is set to M(u)=.SLZERO., do find all unit areas V=argmin, do find unit area w=argmax , set AC range for w to .gamma.(w,u) (see Eqns. 17, 18), set of nodes ordered before w is M w(u)=M(u), M(u)=M(u) U w, V=V-w, U=U-w, while V~.SLZERO.
while U~.SLZERO..

26. The apparatus as recited in claim 25, further comprising means for incorporating fibers in the authentication object as the randomly distributed features.

27. The apparatus as recited in claim 25, further comprising:

means for determining vectors associated with the randomly distributed features based, at least in part, on the probability density function; and means for encoding the vectors using an arithmetic coding algorithm.

28. The apparatus as recited in claim 25, further comprising:

means for determining textual data that includes a string of characters;
means for hashing the textual data with an algorithm;

means for encrypting the compressed data using the hashed textual data; and means for including the textual data in the label.

29. The apparatus as recited in claim 25, further comprising:

means for authenticating the label by comparing encoded data with the data associated with the randomly distributed features in the authentication object.

30. A method comprising:

determining randomly distributed features in an authentication object;
compressing data representing the randomly distributed features, wherein the compressing comprises:

determining a probability density function associated with the authentication object wherein the probability density function represents the probability that a unit of the randomly distributed features is found in a particular region of the authentication object;

determining point-to-point vectors associated with end-points of the randomly distributed features based, at least in part, on the probability density function; and encoding the point-to-point vectors using an arithmetic coding algorithm, wherein encoding the vectors using the arithmetic coding algorithm includes determining a path for connecting a portion of the point-to-point vectors within a fixed amount of data wherein the path connects points of the point-to-point vectors;

returning the path as the compressed data;

encoding the compressed data with a private key; and creating a label that includes the authentication object and the encoded data.

31. The method as recited in claim 30, wherein the randomly distributed features are fibers that are randomly positioned in the authentication object.

32. The method as recited in claim 31, wherein the probability density function represents a probability that fibers in the particular region are illuminated by a light source.

33. The method as recited in claim 31, wherein the probability density function is derived based, at least in part, on the length of the fibers.

34. The method as recited in claim 31, wherein each vector represents the end points of two fibers.

35. The method as recited in claim 30, wherein the label is a certificate of authenticity configured to be self-authenticated and wherein the authentication object is included in the certificate of authenticity.

36. The method as recited in claim 30, wherein the encoded data is included in the label as a barcode.

37. The method as recited in claim 30, further comprising:

determining textual data that includes a string of characters, wherein the textual data is included in the label;

hashing the textual data with an algorithm; and encrypting the compressed data using the hashed textual data, wherein the hashed textual data is merged with the data representing the randomly distributed features prior to encoding the compressed data.

38. The method as recited in claim 37, wherein the algorithm is a cryptographically secure hash algorithm.

39. The method as recited in claim 37, wherein the algorithm is an SHA1 cryptographical algorithm.

40. One or more computer-readable memories containing instructions that are executable by a processor to perform the method recited in claim 30.

41. A system comprising:

an issuer configured to determine randomly distributed features in an authentication object and to compress data representing the randomly distributed features, the issuer being further configured to determine a probability density function associated with the authentication object wherein the probability density function represents the probability that a unit of the randomly distributed features is found in a particular region of the authentication object, to determine point-to-point vectors associated with end-points of the randomly distributed features based, at least in part, on the probability density function, to encode the point-to-point vectors by encoding a portion of the point-to-point vectors as a path within a fixed amount of data by applying an arithmetic coding algorithm to compress the data wherein the path connects points of the point-to-point vectors, and to return the path as the compressed data, the issuer being further configured to encode the compressed data with a private key and to create a label that includes the authentication object and the encoded data.

42. The system as recited in claim 41, wherein the issuer is further configured to include a barcode with the encoded data in the label.

43. The system as recited in claim 41, wherein the issuer is further configured to determine textual data that includes a string of characters, the textual data being included in the label, and to hash the textual data with an algorithm.

44. The system as recited in claim 43, wherein the issuer is further configured to encrypt the compressed data using the hashed textual data, wherein the hashed textual data is merged with the data representing the randomly distributed features prior to encoding the compressed data.

45. The system as recited in claim 41, further comprising:

a verifier configured to decode the data representing the randomly distributed features in the label and to authenticate the label by comparing the decoded data with the data of the actual randomly distributed features determined from the authentication object.

46. A label comprising:

an authentication object including randomly distributed features; and encoded information associated with the authentication object, the information being encoded with a private key and including compressed data representing the randomly distributed features in the authentication object, wherein the data in the encoded information is compressed by determining a probability density function associated with the authentication object wherein the probability density function represents the probability that a unit of the randomly distributed features is found in a particular region of the authentication object, determining point-to-point vectors associated with end-points of the randomly distributed features based, at least in part, on the probability density function, encoding the point-to-point vectors using an arithmetic coding algorithm, wherein encoding the vectors using the arithmetic coding algorithm includes determining a path for connecting a portion of the point-to-point vectors within a fixed amount of data wherein the path connects points of the point-to-point vectors and returning the path as the compressed data;

wherein the label is self-authenticated by comparing a decoding of the encoded information and data representing the randomly distributed features obtained by analyzing the authentication object.

47. The label as recited in claim 46, wherein the encoded information is included in the label as a barcode.

48. The label as recited in claim 46, further comprising:

textual data that includes a string of characters, wherein the compressed data is encrypted using the textual data.

49. The label as recited in claim 48, wherein the compressed data is encrypted by:

hashing the textual data with an algorithm; and encrypting the compressed data using the hashed textual data, wherein the hashed textual data is merged with the data representing the randomly distributed features prior to encoding the compressed data.

50. An apparatus comprising:

means for determining randomly distributed features in an authentication object;

means for compressing data representing the randomly distributed features, wherein the means for compressing data comprises:

means for determining a probability density function associated with the authentication object wherein the probability density function represents the probability that a unit of the randomly distributed features is found in a particular region of the authentication object;

means for determining point-to-point vectors associated with end-points of the randomly distributed features based, at least in part, on the probability density function;

means for encoding the point-to-point vectors using an arithmetic coding algorithm, wherein encoding the vectors using the arithmetic coding algorithm includes determining a path for connecting a portion of the point-to-point vectors within a fixed amount of data wherein the path connects points of the point-to-point vectors; and means for returning the path as the compressed data;

means for encoding the compressed data with a private key; and means for creating a label that includes the authentication object and the encoded data.

51. The apparatus as recited in claim 50, further comprising means for incorporating fibers in the authentication object as the randomly distributed features.

52. The apparatus as recited in claim 50, further comprising:

means for determining textual data that includes a string of characters, wherein the textual data is included in the label;

means for hashing the textual data with an algorithm; and means for encrypting the compressed data using the hashed textual data, the hashed textual data being merged with the data representing the randomly distributed features prior to encoding the compressed data.

53. The apparatus as recited in claim 50, further comprising:

means for authenticating the label by comparing encoded data with the data associated with the randomly distributed features in the authentication object.