Method and system implementing secure operations with network resource identifiers

Abstract

The invention takes advantage of certain features of the URI specification to incorporate cryptographic content in a way that does not hinder the normal operation of a URI. The cryptographic content can then be used to guarantee the authenticity of the path defined in the unencrypted portion. The path can also be used to point a reading device to a network resource capable of performing the decryption operation, or to store a decryption key. Fig. 6

Description

Title of the invention: Method and system implementing secure operations with network resource identifiers Field of the invention

[0001] The invention relates to URI-based seals, which may be implemented in a machine-readable format. State of the art

[0002] The last few decades have seen data migrate from physical media such as paper documents to the digital world. However, there are many cases where data materialization is still necessary. Examples include product labels, reference codes in printed communications, public displays, and others, with examples ranging from simple reference codes to the full content of a document.

[0003] Although these scenarios may suggest a need for human readability, the general trend towards digital processing makes it desirable to present such information in a form that is also suitable for machine interpretation. Many such representations already exist.

[0004] The development of Internet technology during the 20th century saw the emergence of a number of different mechanisms for linking an object to an electronic information management system. Punched cards were developed as a primitive input method for computing devices, and the possibility of using similar cards was quickly identified as a rapid means of recording the sale of an object. A major advance in this area was made with the development of the Universal Product Code system, based on reading a two-dimensional bar code using a laser scanner.

[0005] In the field of Consumer-Packaged Goods (CPG), Global Trade Identifier Numbers (GTIN) are used to identify products using printed labels and packaging. The linear barcode is a visual representation of the GTIN code below it. The last digit of a 14-digit GTIN 14 number, or a 13-digit GTIN 13 number, is a key. This key, also known as a check digit, is used to verify that the preceding digits are correct and have not been corrupted.

[0006] Based on this and related technologies, virtually all current consumer packaged goods are provided with such a code. More recently, The use of matrix or two-dimensional barcodes, including "QR Codes" (registered trademark in certain territories) described for example in the United States patent reference US5726435, has become widespread. These codes are capable of encoding more information in a reduced surface area than traditional one-dimensional barcodes and are, as such, frequently used to encode a Uniform Resource Identifier. Furthermore, in addition to these optical solutions, labeling solutions based on radio waves, particularly those based on RFID tags, are becoming widespread.

[0007] The widespread use of codes of this type raises the question of security, since it becomes necessary to verify the authenticity, accuracy or validity of a particular code.

[0008] Among the cryptographic solutions to this question, we can cite the Visible Digital Seal (VDS), a cryptographically signed data structure (in other words an electronically signed encoded data set, ESEDS) which can be encoded in a two-dimensional barcode symbology, generally a Datamatrix code, a QR code or a Han Xin code.

[0009] [Fig. 1a] shows an example of a Visible Electronic Stamp in a Datamatrix format.

[0010] [Fig.lb] shows an example of a Visible Electronic Seal in a QR code format.

[0011] [Fig. 1c] shows an example of a Visible Electronic Stamp in a

[0012] Han Xin format.

[0013] The code contains the essential information of the respective document as well as a digital signature that provides protection against data manipulation. Visible Electronic Seals (VDS) aim to guarantee, economically and securely, the authenticity and integrity of documents by asymmetric cryptography. Possible applications of VDS include identity cards, passports, product passports, certificates, tax stamps or any other document whose authenticity and integrity must be guaranteed.

[0014] The following character sequence is an example of the signature portion of an ESDS Visible Electronic Seal:

[0015] 3YBGMNJGEUM43777DRR637K2AA3NSNDIOR2HA4Z2F4XXU5BOMFT S6MBRF4YDGNZXHEYDAMBQGA2DSMBRF4ZDELZQGEXTCMBPGAYDCL ZSGEXTAMBQGHQIZDE4VZOB4HZAVTU27JQNQHKCZOKG4ZQP3L3LK 5BLKULDCGEMXHGTB2SMS7FUAUYF36K226FUDIKFZUKMYAFMW27O IXIAIYIAAZUG

[0016] The general use case for codes of this type, at the intersection of physical objects and computer systems, implicitly includes the very wide range of scenarios in which reading the code may prove necessary. Given the mobility and durability of these physical objects, no one knows how, where or when it may be desirable to read the code. Furthermore, a cryptographic structure such as the VDS presented above is generally a fairly opaque construction whose format must be known a priori to allow for its correct interpretation. It follows that, in practice, a general-purpose interface will be unable to process or interpret data thus encoded, which will require the use of a dedicated reader.As an example, in a typical prior art scenario, a Visible Electronic Stamp ESEDS, encoded in a two-dimensional barcode, a Datamatrix code, a QR Code or a Han Xin code, can only be read by a dedicated application, such as a specialized secure mobile application, without requiring an Internet connection in the event that the type of use case of the VDS is already known to the mobile application.

[0017] It is desirable to provide a mechanism allowing general data interfaces to manage data incorporated in cryptographic authentication components. Summary of the invention

[0018] In accordance with the present invention, according to a first aspect, a computer-implemented method of defining a secure network resource identifier structure is provided, comprising defining a Uniform Resource Identifier (URI) having scheme and path components identifying a network resource, and associating the scheme and path components with a fragment and / or query portion comprising a cryptographically signed data structure.

[0019] In accordance with the present invention, according to a second aspect, a computer-implemented method of defining a secure network resource identifier structure is provided, comprising defining a Uniform Resource Identifier (URI) having scheme and path components identifying a network resource, associating the scheme and path components with a path portion suffix comprising a cryptographically signed data structure constituting a unique identifier.

[0020] In a development of the first or second aspect, an additional step of encoding the secure network resource identifier structure in machine-readable code is provided.

[0021] In a development of the first or second aspect, the Uniform Resource Identifier points to a repository from which a software application capable of verifying that the path component corresponds to the signed data structure can be extracted.

[0022] According to the present invention, according to a third aspect, there is provided a method of accessing a network resource, comprising receiving a secure network resource identifier structure according to the first or second aspect, decrypting the cryptographically signed data structure, verifying that the path component corresponds to said signed data structure and, in response to the verification, accessing the network resource designated by the Uniform Resource Identifier.

[0023] In a development of the third aspect, an additional step of receiving the secure network resource identifier structure at a user device is proposed, the step of verifying that the path component corresponds to the signed data structure being performed at either the user device or a remote server identified by the path component.

[0024] According to the present invention, according to a fourth aspect, there is provided a method of decoding a secure network resource identifier structure, comprising receiving a secure network resource identifier structure according to aforementioned embodiments, identifying a structure characteristic of a scheme known to be used with secure network resource identifier structures according to aforementioned embodiments, isolating a portion of the secure network resource identifier structure known to correspond to a unique identifier according to the scheme, and attempting to decrypt the isolated portion of the secure network resource identifier structure.

[0025] In a development of the fourth aspect, the cryptographically signed data structure comprises an additional data payload, and the method comprises an additional step of extracting reference data from the network resource designated by the path component, and comparing the reference data to the additional data payload.

[0026] In a development of the third or fourth aspect, the cryptographically signed data structure comprises an additional data payload, and the method comprises a further step of identifying a characteristic of the secure network resource identifier structure associated with an additional network resource, and extracting reference data from said additional network resource, and comparing the reference data to the additional data payload.

[0027] According to the present invention, according to a fifth aspect, there is provided a method of associating a unique identifier with a product, the product belonging to a product tree classification, the method comprising the steps of composing a URI based on the classification of the product according to the product tree classification, obtaining a cryptographically signed data structure with respect to the URI according to claim 1, and associating the cryptographically signed data structure with the product as a unique identifier.

[0028] According to the present invention, according to a sixth aspect, there is provided a data processing system comprising means for carrying out the first, second, third, fourth or fifth aspect.

[0029] According to the present invention, according to a seventh aspect, there is provided a computer program comprising instructions which, when the program is executed by a computer, cause the computer to carry out the first, second, third, fourth or fifth aspect.

[0030] According to the present invention, according to an eighth aspect, there is provided a computer-readable medium comprising instructions which, when the instructions are executed by a computer, cause the computer to carry out the first, second, third, fourth or fifth aspect.

[0031] In accordance with the present invention, according to a ninth aspect, there is provided a secure network resource identifier structure, comprising a Uniform Resource Identifier (URI) having scheme and path components identifying a network resource, and a fragment and / or query portion comprising a cryptographically signed data structure.

[0032] In accordance with the present invention, according to a tenth aspect, a secure network resource identifier structure is provided, comprising a Uniform Resource Identifier (URI) having scheme and path components identifying a network resource, associating the scheme and path components and a path portion suffix comprising a unique identifier and a cryptographically signed data structure. Brief description of the drawings

[0033] The above and other advantages of the present invention will now be described with reference to the accompanying drawings, in which:

[0034] [Fig.1a] shows an example of a Visible Electronic Stamp in a Datamatrix format;

[0035] [Fig.lb] shows an example of a Visible Electronic Seal in a QR code format;

[0036] [Fig. 1e] shows an example of a Visible Electronic Stamp in a Han Xin format;

[0037] [Fig.2a] shows an example of a URI encoded in a Datamatrix format;

[0038] [Fig.2b] shows an example of a URI encoded in a QR code format;

[0039] [Fig.2c] shows an example of a URI encoded in a Han Xin format;

[0040] [Fig.3a] shows an example of a URI incorporating a component cryptographic, encoded in a Datamatrix format;

[0041] [Fig.3b] shows an example of a URI incorporating a component cryptographic, encoded in a QR code format;

[0042] [Fig.3c] shows an example of a URI incorporating a component cryptographic, encoded in a Han Xin format;

[0043] [Fig.4a] summarizes a method according to this first set of embodiments;

[0044] [Fig.4b] summarizes a method according to this second set of embodiments;

[0045] [Fig.5a] shows a method for decoding a resource identifier structure secure network as presented with reference to [Fig.4a];

[0046] [Fig.5b] presents a method of accessing a network resource according to a mode of realization ;

[0047] [Fig.6] presents various use case scenarios arising from modes of realization ;

[0048] [Fig.7] shows a generic computer system suitable for implementing embodiments of the invention; and

[0049] [Fig.8] shows a smartphone-type device adaptable to constitute a mode of realization. Detailed description

[0050] A very widely adopted data structure is the Web URI (Uniform Resource Identifier). The URI is a string of characters used to identify a resource. The Web URL (Uniform Resource Locator) can be an information resource such as a web page - as described in Request for Comments RFC 3986: Uniform Resource Identifier (URI): Generic Syntax.

[0051] The basic structure of the URI is as follows:

[0052] scheme: [ / / authority] [ / path] [?query] [#fragment]

[0053] For example, a typical URI may take the form:

[0054] http: / / machine.domain:port / path / data?key=value#fragid

[0055] The path information of the URI consists of a sequence of path segments separated by a slash (" / "). The path component contains data, usually organized in a hierarchical form. The path ends with the first question mark ("?"), at the end of the URI, or with the character ("#") - as described in RFC 3986 Section-3.3.

[0056] The query URI contains flat data that, together with data in the path component, serves to identify a resource within the scope of the URI's naming scheme and authority. The data in the hierarchical path component, together with data in the flat query component, serves to identify a resource within the scope of the URI's naming scheme and authority. The query component is indicated by the first question mark ("?"), followed by the ampersand ("&"). Query components are used to convey identifying information in the form of "&key=value" pairs - as described in RFC 3986 Section-3.4.

[0057] Example of a URI formed according to the GSI Digital Link standard:

[0058] https: / / zt.ag / 01 / 03779000004901 / 22 / 01 / 10 / 001 / 21 / 0001

[0059] https: / / zt.ag / 01 / 03779000004901 / 22 / 01 / 10 / 001?17=230701

[0060] In this case, the value “230701” can for example represent an expiration date of a product.

[0061] An example of a URI including an AutoID URL containing data according to the ANSI MH10.8.2 standard may take the form:

[0062] https: / / zt.ag / ?.8P=03779000004901&. lT=001&.S=0001

[0063] https: / / zt.ag / ?.8P=03779000004901&.lT=001.5D=230701036

[0064] In this case, the value “230701” can for example represent an expiration date of a product, and 036 indicates the date format YYMMDD.

[0065] The URI fragment identifier component of a URI allows indirect identification of a secondary resource by reference to a primary resource and additional identifying information. The identified secondary resource may represent a portion or subset of the primary resource, a view into representations of the primary resource, or another resource defined or described by those representations - as described in RFC 3986 Section-3.5.

[0066] A fragment identifier component is indicated by the presence of a hash character ("#") and ends at the end of the URI. A typical use of a URI fragment identifier is to provide a direct link to a particular section within an HTML page, i.e., a web document. The hash character ("#") is used to call an HTML page. This call is neutral and has no impact on the page being retrieved. The local browser performs local navigation within the resulting page.

[0067] https: / / zt.ag / 01 / 03779000004901 / 22 / 01 / 10 / 001 / 21 / 001#hello_world

[0068] https: / / zt.ag / ?. 8P=03779000004901 &. lT=001 &.S=000 l#hello_world

[0069] It is also common to represent URIs in a machine-readable format.

[0070] The machine-readable format can take any form. For example:

[0071] It may be optically readable, for example in the form of an image, an alphanumeric code, or a one-, two- (in particular “QR codes”) or three-dimensional barcode, or a holographic code. The code may be associated with other visual content, for example by steganography or any other invisible code.

[0072] Optical reading, using a camera, laser scanner, etc., offers a security advantage over radio communications in that it requires a line of sight and a determined alignment with the object, which makes it difficult to surreptitiously read the object. Since consumer devices are often equipped with a camera, these readers can therefore be implemented without requiring the addition of specialized dedicated hardware.

[0073] It may be magnetically readable, for example in the form of a magnetic strip.

[0074] It can be readable by radio communication, for example by RFID, NFC or Bluetooth low energy systems.

[0075] Radio communications have the advantage of not requiring physical contact, or even a line of sight between the object and a reader. Short-range radio communication enhances security and, by design, prevents interception attacks. The increasingly widespread use of short-range radio communications in consumer devices allows the implementation of such readers without the need for specialized hardware.

[0076] It can be readable acoustically, or in the form of a sound wave emitted by the object, either continuously, or periodically, or in response to stimulation by a user, or generated by the user device implementing the invention. This stimulation can be mechanical, sonic, electronic, optical or be carried out by any other suitable mechanism.

[0077] While sound waves do not require contact or even a line of sight between the object and a reader, they are inherently prone to scattering and interference, which limits their scope of use. In this regard, in some implementations, sound waves may offer a compromise between the characteristics of optical reading and those of radio reading. Since consumer devices are often equipped with a microphone (as well as a loudspeaker), these readers (respectively, sound emitters) can therefore be implemented without the use of specialized hardware.

[0078] It can be readable in the form of a tactile or palpable code, for example in the form of punched bumps or hollows, readable by optical or mechanical means.

[0079] A preferred approach is to use a machine-readable graphical format such as a Datamatrix code, a QR code or a Han Xin code.

[0080] [Fig.2a] shows a URI encoded in a Datamatrix format.

[0081] [Fig.2a] shows in particular a representation of the URI

[0082] https: / / zt.ag / 01 / 03779000004901 / 22 / 01 / 10 / 001 / 21 / 0001 encoded in a format Datamatrix.

[0083] [Fig.2b] shows an example of a URI encoded in a QR code format.

[0084] [Fig.2b] shows in particular a representation of the URI

[0085] https: / / zt.ag / 01 / 03779000004901 / 22 / 01 / 10 / 001 / 21 / 0001 encoded in QR format code.

[0086] [Fig.2c] shows an example of a URI encoded in a Han Xin format.

[0087] [Fig.2c] shows in particular a representation of the URI

[0088] https: / / zt.ag / 01 / 03779000004901 / 22 / 01 / 10 / 001 / 21 / 0001 encoded in Han format Xin.

[0089] A URI, for example encoded in a QR Code or other, can be read by most modern mobile devices since the vast majority of existing mobile devices are equipped with a functionality allowing these Codes to be scanned using only the camera.

[0090] Furthermore, a URL may point to a remote host server, but be processed locally in the device, or remotely on another remote server different from the one designated in the URL, defined by the mobile application on the device. This is what a point of sale (or POS) terminal is capable of doing with a URI comprising an AutoID URL containing data in compliance with, for example, the GSI Digital Link standard or the ANSI MH10.8.2 standard, in order to extract the GTIN (acronym in English for "Global Trade Item Number" or International Article Code, Application Identifier 01 or Data Identifier .8P in the ANSI MH10.8.2 standard) and thus determine the correct price of a given product.

[0091] In accordance with the present invention, cryptographic information is incorporated into a URI structure.

[0092] In particular, according to a first approach, a method is proposed for defining a secure network resource identifier structure, the secure network resource identifier structure comprising a Uniform Resource Identifier (URI) having scheme and path components identifying a network resource, and fragment and / or query parts comprising a data structure cryptographically signed. In this regard, the proposed mechanism does not rely on signing the initial URL portion of the URI but on signing an independent segment, which may or may not be partially associated with the URL value. As such, a VDS - or other cryptographically signed structure - can be attached to any URL, which may or may not be associated with the cryptographically signed data structure itself.

[0093] The cryptographically signed data structure may follow a Visible Digital Seal format, a Verifiable Credentials model, or any other cryptographic model, including, for example, the PKI cryptographic scheme (acronym for "Public Key Infrastructure").

[0094] Based on this and as an example, the following URI can be obtained: HTTPS: / / ZT.AG / 01 / 03779000004901 / 22 / 01 / 10 / 001 / 21 / 0001#3YBGMNJGEUM4377 7DRR637K2AA3NSNDIOR2HA4Z2F4XXU5BOMFTS6MBRF4YDGNZXHE YDAMBQGA2DSMBRF4ZDELZQGEXTCMBPGAYDCLZSGEXTAMBQGHQIZ DE4VZOB4HZAVTU27JQNQHKCZOKG4ZQP3L3LK5BLKULDCGEMXHGT B2SMS7FUAUYF36K226FUDIKFZUKMYAFMW27OIXIAIYIAAZUG

[0095] In this example, the portion following the # symbol is a fragment that conforms to RFC 3986, and it is this portion that embeds the cryptographic content. By embedding the cryptographic content in the fragment portion, the URI remains intelligible to any standard device or system capable of interpreting generic URIs. The hierarchical portion points to additional resources that can then allow the device or system to handle the cryptographic portion. In the worst case, the fragment portion can simply be ignored.

[0096] In addition, the cryptographic content could also be processed remotely by the remote host server, or by any other remote server, different from the one designated in the URL, defined by the mobile application on the device. This can be achieved by configuring the local device to recognize the general format of the cryptographic content and contact the remote server accordingly, or by addressing data embedded in the fragment part.

[0097] HTTPS: / / ZT.AG / 01 / 03779000004901 / 22 / 01 / 10 / 001 / 21 / 000 1#3YBGMNJGEUM43777DRR637K2AA3NSNDIOR2HA4Z2F4XXU5BOM FTS6MBRF4YDGNZXHEYDAMBQGA2DSMBRF4ZDELZQGEXTCMBPGAYD CLZSGEXTAMBQGHQIZDE4VZOB4HZAVTU27JQNQHKCZOKG4ZQP3L3 LK5BLKULDCGEMXHGTB2SMS7FUAUYF36K226FUDIKFZUKMYAFMW2 7OIXIAIYIAAZUG

[0098] Thus, if ordinarily the device should theoretically access the resource indicated by HTTPS: / / ZT.AG / 01 / 03779000004901 / 22 / 01 / 10 / 001 / 21 / 0001, due to the fact of decryption of the cryptographic content 3YBGMNJGEUM43777DRR63 7K2AA3NSNDIOR2HA4Z2F4XXU5BOMFTS6MBRF4YDGNZXHEYDAMBQ GA2DSMBRF4ZDELZQGEXTCMBPGAYDCLZSGEXTAMBQGHQIZDE4VZO B4HZAVTU27JQNQHKCZOKG4ZQP3L3LK5BLKULDCGEMXHGTB2SMS7 FUAUYF36K226FUDIKFZUKMYAFMW27OIXIAIYIAAZUG

[0099] according to embodiments, the device will be able to access any other resource possibly designated in the cryptographic content (and / or indicated by a selected part of the scheme and / or path parts), by virtue of programming or otherwise.

[0100] Optionally, the path element of the secure Uniform Resource Identifier may point to a repository from which a software application may be retrieved that is capable of verifying that the Uniform Resource Identifier matches the signed data structure. As an example, the URI (or the graphical code representing it) could be read to download and install a secure mobile application from the network resource indicated by the hierarchical portion of the URI. This application could then be used to (re)scan this same URI in order to read and process the cryptographic portion thereof.

[0101] Preferably, to be able to be combined with a URI, the cryptographic content must contain a character set that meets the criteria of the URL. It is preferable to avoid using characters other than those contained in the Base64-safe URL library ('A' to 'Z', 'a' to 'z', '0' to '9', '-' and '_').

[0102] Optionally, the method may include an additional step of encoding the secure network resource identifier structure into a machine-readable code, such as a Datamatrix code, a Han Xin code, a JAB code, or a QR code.

[0103] As previously indicated, the fragment (which follows the # symbol) in a URL is generally not communicated by the Internet browser and remains local. Also, its proposed use in the context of a secure message therefore remains local, for enhanced security. Such use may be exclusively local in nature, despite the usual scope of use of a URL. As such, embodiments based on the use of the fragment part are considered particularly advantageous.

[0104] [Fig.3a] shows an example of a URI incorporating a cryptographic component, encoded in a Datamatrix format.

[0105] [Fig.3a] shows in particular a representation of the URI

[0106] HTTPS: / / ZT.AG / 01 / 03779000004901 / 22 / 01 / 10 / 001 / 21 / 000 1#3YBGMNJGEUM43777DRR637K2AA3NSNDIOR2HA4Z2F4XXU5BOM FTS6MBRF4YDGNZXHEYDAMBQGA2DSMBRF4ZDELZQGEXTCMBPGAYD CLZSGEXTAMBQGHQIZDE4VZOB4HZAVTU27JQNQHKCZOKG4ZQP3L3 LK5BLKULDCGEMXHGTB2SMS7FUAUYF36K226FUDIKFZUKMYAFMW2 70IXIAIYIAAZUG encoded in a Datamatrix format.

[0107] [Fig.3b] shows an example of a URI incorporating a cryptographic component, encoded in a QR code format.

[0108] [Fig.3b] shows in particular a representation of the URI

[0109] HTTPS: / / ZT.AG / 01 / 03779000004901 / 22 / 01 / 10 / 001 / 21 / 000 1#3YBGMNJGEUM43777DRR637K2AA3NSNDIOR2HA4Z2F4XXU5BOM FTS6MBRF4YDGNZXHEYDAMBQGA2DSMBRF4ZDELZQGEXTCMBPGAYD CLZSGEXTAMBQGHQIZDE4VZOB4HZAVTU27JQNQHKCZOKG4ZQP3L3 LK5BLKULDCGEMXHGTB2SMS7FUAUYF36K226FUDIKFZUKMYAFMW2 7OIXIAIYIAAZUG encoded in a QR code format.

[0110] [Fig.3c] shows a URI incorporating a cryptographic component, encoded in a Han Xin format.

[0111] [Fig.3c] shows in particular a representation of the URI

[0112] HTTPS: / / ZT.AG / 01 / 03779000004901 / 22 / 01 / 10 / 001 / 21 / 000 1#3YBGMNJGEUM43777DRR637K2AA3NSNDIOR2HA4Z2F4XXU5BOM FTS6MBRF4YDGNZXHEYDAMBQGA2DSMBRF4ZDELZQGEXTCMBPGAYD CLZSGEXTAMBQGHQIZDE4VZOB4HZAVTU27JQNQHKCZOKG4ZQP3L3 LK5BLKULDCGEMXHGTB2SMS7FUAUYF36K226FUDIKFZUKMYAFMW2 7OIXIAIYIAAZUG encoded in a Han Xin format.

[0113] The combination of cryptographic content such as a Visible Digital Seal and a URI in a two-dimensional barcode symbology, such as a QR Code, allows not only local reading and processing by a particular application, but also convenient reading by most mobile and other suitable devices (smartphones, tablets, laptops, smart TVs, etc.) without the need for a particular application.

[0114] If the embodiment of Figure 3 uses the fragment part of a URI for the incorporation of cryptographic content, other approaches are however considered.

[0115] According to one set of alternative embodiments, cryptographic content may be added to a query part of the URI. In accordance with RFC 3986 Section-3.5, a query part is delimited by the sequence variable = value. Note that query parts are also defined by the presence of a “?” or “&” symbol, and that queries take, in the first instance, the form “?Keyl=vall” and, in later instances, the form “&key2=val2”. Since the “=” symbol appears in all cases (and nowhere else in a valid URI), it can be systematically considered as an indicator of the instantiation of a query.

[0116] The following URI is an example of embedding cryptographic content in a request part, illustrating GS1 Digital Link encoding.

[0117] HTTPS: / / ZT.AG / 01 / 03779000004901 / 22 / 01 / 10 / 001 / 21 / 0001? 250=3YBGMNJGEUM43777DRR637K2AA3NSNDIOR2HA4Z2F4XXU 5BOMFTS6MBRF4YDGNZXHEYDAMBQGA2DSMBRF4ZDELZQGEXTCMBP GAYDCLZSGEXTAMBQGHQIZDE4VZOB4HZAVTU27JQNQHKCZOKG4ZQ P3L3LK5BLKULDCGEMXHGTB2SMS7FUAUYF36K226FUDIKFZUKMYA FMW27OIXIAIYIAAZUG

[0118] The following URI is an example of embedding cryptographic content in a request part, the URI including an AutoID URL containing data in accordance with ANSI MH10.8.2 encoding.

[0119] .HTTPS: / / ZT.AG / ?.8P=03779000004901&. 1T=OO1&.S=3YBGM NJGEUM43777DRR637K2AA3NSNDIOR2HA4Z2F4XXU5BOMFTS6MBR F4YDGNZXHEYDAMBQGA2DSMBRF4ZDELZQGEXTCMBPGAYDCLZSGEX TAMBQGHQIZDE4VZOB4HZAVTU27JQNQHKCZOKG4ZQP3L3LK5BLKU LDCGEMXHGTB2SMS7FUAUYF36K226FUDIKFZUKMYAFMW27OIXIAI YIAAZUG

[0120] The following URI is an example of embedding cryptographic content in a request portion, the URI including an AutoID URL containing data in accordance with ANSI MH10.8.2 encoding using the secondary serial number code.

[0121] HTTPS: / / ZT.AG / ?.8P=03779000004901&.lT=001&.S=0001&. 30S=3YBGMNJGEUM43777DRR637K2AA3NSNDIOR2HA4Z2F4XXU5B OMFTS6MBRF4YDGNZXHEYDAMBQGA2DSMBRF4ZDELZQGEXTCMBPGA YDCLZSGEXTAMBQGHQIZDE4VZOB4HZAVTU27JQNQHKCZOKG4ZQP3 L3LK5BLKULDCGEMXHGTB2SMS7FUAUYF36K226FUDIKFZUKMYAFM W27OIXI AI YIAAZUG

[0122] [Fig.4a] summarizes a method according to this first set of embodiments.

[0123] As shown in [Fig.4a], the method starts at step 400 before moving on to step 405 in which the schema and path components of a URL The method then proceeds to step 410 where a cryptographic fragment or query part is associated with the scheme and path components in the URI structure.

[0124] The method may then optionally proceed to step 415 of encoding the URI as well obtained in machine-readable code.

[0125] Although not shown, the method may also include additional steps described herein. It will be understood that, in some embodiments, steps 405 and 410 may be performed in any sequence or in parallel and, as discussed in more detail below, can be repeated to create multiple fragment or query parts.

[0126] In another set of alternative embodiments, the cryptographic content may be added to the URI as a path part suffix at the end of the hierarchical segment.

[0127] As discussed above, a secure network resource identifier according to embodiments may serve as the basis for a secure product label affixable to a product, and then be scanned by a customer or at another stage of the supply chain to confirm characteristics of the product to which the label is affixed. The GSI Digital Link standard, for example, defines different levels of granularity, from the product reference (01 GTIN), to the serial number (21 S / N) which uniquely identifies a particular item, through the Lot number (10 LOT). It will be understood that the character string constituting the cryptographic content for a particular product should theoretically also be unique. Under these conditions, the cryptographic content of the character string may be considered as the serial number for the product in question without compromising the labeling logic.

[0128] For example, the GSI Digital Link standard defines the Serial Number Application Identifier "21" (designated by the acronym S / N). Based on this, the user device receiving the URI of the invention may identify the characteristic structure of a GSI Digital Link element, and the presence of the code 21 indicating that the following value is a unique identifier, and then speculatively attempt to decode the sequence on the assumption that it may be cryptographic content within the meaning of an embodiment. If the sequence is successfully decrypted, it may then be used in the same manner as in other embodiments described herein, and if not, it may be marked as insecure and treated in the same manner as other traditional URIs.Note that, since the content following code 21 is in all cases a unique value, the use of cryptographic content in this segment does not prevent the use of the same string to designate a network resource.

[0129] An example of this approach is given by the following URI

[0130] HTTPS: / / ZT.AG / 01 / 03779000004901 / 22 / 01 / 10 / 001 / 21 / 3YB GMNJGEUM43777DRR637K2AA3NSNDIOR2HA4Z2F4XXU5BOMFTS6M BRF4YDGNZXHEYDAMBQGA2DSMBRF4ZDELZQGEXTCMBPGAYDCLZSG EXTAMBQGHQIZDE4VZOB4HZAVTU27JQNQHKCZOKG4ZQP3L3LK5BL KULDCGEMXHGTB2SMS7FUAUYF36K226FUDIKFZUKMYAFMW27OIXI AIYIAAZUG

[0131] A method of decoding a secure network resource identifier structure is therefore provided, the method comprising receiving a secure network resource identifier structure according to embodiments set forth above, identifying a structure characteristic of a scheme known to be used with secure network resource identifier structures according to embodiments set forth above, isolating a portion of said secure network resource identifier structure known to correspond to a unique identifier according to said scheme, and attempting to decrypt said isolated portion of said secure network resource identifier structure.Optionally, an additional step of determining that said isolated portion of said secure network resource identifier structure cannot be decrypted and issuing an indication that said secure network resource identifier structure is not deemed secure may be provided. Optionally, when said isolated portion of said secure network resource identifier structure is successfully decrypted, an additional step of verifying that said path component corresponds to said signed data structure may be provided. The method may further optionally comprise additional steps as discussed herein relating to any operation performed based on decryption of the cryptographic content of a secure network resource identifier structure described herein.

[0132] [Fig.4b] summarizes a method according to this second set of embodiments.

[0133] As shown in [Fig.4b], the method begins at step 400 before proceeding to step 405 in which the scheme and path components of a URL are defined. The method then proceeds to step 411 in which a uniquely identifying cryptographic path suffix is ​​associated with the scheme and path components in the URI structure.

[0134] The method may then optionally proceed to step 415 of encoding the URI thus obtained into a machine-readable code.

[0135] Although not shown, the method may also include additional steps described herein. It will be understood that, in some embodiments, steps 405 and 411 may be performed in any sequence or in parallel and, as discussed in more detail below, may be repeated to create multiple path suffix portions.

[0136] Additionally, in some embodiments, steps 410 and 411 may be performed in any sequence or in parallel and, as discussed in more detail below, may be repeated to create multiple fragment, query, or path suffix parts.

[0137] Furthermore, on this basis, it is possible to propose a method for associating a unique identifier with a product, the product belonging to a tree classification of product, the method comprising the steps of composing a URI based on the classification of said product according to said product tree classification, obtaining a cryptographically signed data structure with respect to a secure network resource identifier as presented herein, and associating the cryptographically signed data structure with the product as a unique identifier.

[0138] It will be understood that any suitable character sequence that cannot be resolved into a valid web resource may be defined for this purpose at the end of the characterizing part.

[0139] In this regard, a method is provided for defining a secure network resource identifier structure, said secure network resource identifier structure comprising a Uniform Resource Identifier (URI) having scheme and path components identifying a network resource, and a path portion suffix comprising a unique identifier and a cryptographically signed data structure signed using a cryptography infrastructure.

[0140] It should be emphasized that structures according to embodiments may incorporate multiple query and / or fragment and / or path suffix parts, either with multiple parts of the same type or with a combination of parts of different types (always respecting the criteria, so that, for example, a fragment part systematically follows the last path suffix part).

[0141] In this regard, a number of possible structures have been described, each constituting a secure network resource identifier according to embodiments.

[0142] A number of possible uses can be envisaged for the cryptographic content portion of the secure network resource identifier defined herein.

[0143] In some embodiments, a closer relationship between the hierarchical portion of the URI and the cryptographic portion may be contemplated. Specifically, the cryptographic portion may incorporate an encrypted version of the hierarchical portion itself, or some other representation of the contents of the hierarchical portion itself, whereby the cryptographic portion may serve to authenticate the hierarchical portion. This representation may include a hash, a signature, or some other representation of the hierarchical portion. Indeed, since it is generally desirable to limit the size of the secure network resource identifier as a whole and of the cryptographic contents in particular, the representation may be limited to only a portion of the hierarchical portion, e.g., to specify only the domain thereof.

[0144] As such, and in order to protect a Web URI as such (in other words, the scheme and path components identifying a network resource, excluding a path part suffix), the cryptographic component can contain the data already available in the path part and the query string part of the Web URI.

[0145] This approach may constitute a method of accessing a network resource, comprising receiving a secure network resource identifier structure as set forth above, extracting a public key for the cryptographically signed data structure, verifying that the path component (and, if applicable, any other part of the secure network resource identifier that does not belong to the cryptographic content) matches the signed data structure and, in response to said verification, accessing the network resource designated by said secure network resource identifier.

[0146] For the purpose of protecting a remote destination from the Web URI, the cryptographic content may contain certain data relating to the remote destination or the content at that destination, including a hash of a document at the destination, which may be verified at the time of resolving the cryptographic content.

[0147] In this respect, a method of accessing a network resource may comprise an additional step of receiving the secure network resource identifier structure at a user device, said step of verifying that said Uniform Resource Identifier corresponds to said signed data structure being carried out at either the user device or a remote server identified by said Uniform Resource Identifier.

[0148] In some embodiments, the cryptographic content may additionally or alternatively include an additional data payload.

[0149] As discussed above, a secure network resource identifier according to embodiments may serve as the basis for a secure product label affixable to a product and then be scanned by a customer or at another point in the supply chain to confirm characteristics of the product to which the label is affixed.

[0150] In this context, the additional data payload may include a product identifier, a serial number, a quality label, a quality seal, an indication of geographical origin, and the like.

[0151] Additionally or alternatively, the data payload may incorporate an indication of other inherent characteristics of the product that are otherwise difficult to determine, such as the date of manufacture, sugar content, alcohol content, etc. Incorporating this data into the cryptographic component allows it to be permanently and indelibly integrated into the secure network resource identifier. Any discrepancy between this data and corresponding data, for example, on a web page indicated by the path element of the same secure network resource identifier, may be flagged as evidence of tampering or deception.

[0152] A product identity, including product reference (01 GITN), Batch number (10 LOT) or serial number (21 S / N), can be provided at any of the granularity levels stipulated by the GSI Digital Link standard for example.

[0153] In this respect, a method for accessing a network resource may comprise an additional step of identifying a characteristic of said secure network resource identifier structure associated with an additional network resource, and extracting reference data from the additional network resource, and comparing the reference data to the additional data payload; and, further, in the event of detecting a mismatch between the reference data and said additional data payload, issuing an alert message and / or disconnecting said network resource.

[0154] [Fig.5a] shows a method of decoding a secure network resource identifier structure, as shown with reference to [Fig.4a].

[0155] As shown in the figure, the method begins at step 500 in which a secure network resource identifier structure according to embodiments as disclosed herein is received. The method then proceeds to step 501 in which a characteristic structure of a scheme known to be used with secure network resource identifier structures according to embodiments as disclosed herein is identified. This characteristic structure being thus identified, the method proceeds to step 502 in which a portion of said secure network resource identifier structure known to correspond to a unique identifier according to said scheme is isolated. In step 503, an attempt is made to decrypt the isolated portion of the secure network resource identifier structure. The method may then end at step 504. Alternatively, the method may loop back to step 501 for a new URL

[0156] [Fig.5b] shows a method of accessing a network resource according to one embodiment.

[0157] [Fig.5b] more particularly presents a method of accessing a network resource according to the preceding description.

[0158] More specifically, as shown in the figure, the method begins at step 505 before proceeding to step 510 in which a secure network resource identifier is received, for example as obtained following the method of FIGS. 4a and / or 4b. The method proceeds to step 515 in which an encryption key used to decrypt the cryptographic content of the secure network resource identifier is extracted. The method may then proceed to optional step 520 in which the decrypted cryptographic content is compared to the pattern and path portions of the secure network resource identifier.

[0159] The method can then move on to the optional step 525 in which access is made to the resource designated by the verified path and, in step 530, reference data are extracted and compared to the optional Secure Network Resource Identifier payload.

[0160] If a mismatch is detected, for example following the comparisons in steps 520 or 535, determined in step 540, the method can proceed to step 545 at which an alert can be issued or the network resource can be disconnected.

[0161] It will be understood that the steps of [Fig.5b] may be performed in a different sequence, and that any combination of the optional steps may be performed.

[0162] Therefore, the cryptographic content may also contain additional information only available when using the secure application.

[0163] [Fig.6] presents various use case scenarios arising from modes of realization.

[0164] As shown in [Fig.6], a scenario may start from a traditional URI 612 or from a URI formed according to any of the preceding embodiments 611.

[0165] Furthermore, it is possible to provide a traditional device 622 incorporating only a generic camera application allowing a QR code to be scanned for example, and an augmented device 612 equipped with software capable of detecting a URI formed according to any one of the preceding embodiments and, if necessary, decoding it.

[0166] A secure network resource identifier according to embodiments represented in a two-dimensional Code (such as a QR Code) 611 may be scanned by any compatible secure mobile application 621 as represented by arrow 611a. Following scanning by a compatible secure mobile application 621 (e.g., the “Otentik Code Reader” application), the mobile application 621 may process and display the list of information relating to the visible electronic seal and, optionally, prompt to point to the destination URI designated in the initial URI. If the destination server is a secure server 631, it may indicate that the link between the Code and the content destination is reliable since the request originates from the secure mobile application. Access may then be performed as represented by arrow 621a. The prompt is optional since the user may otherwise be connected to the secure destination link and verified.

[0167] An insecure network resource identifier 612 (i.e., a traditional URI lacking the cryptographic content disclosed herein) in a Two-Dimensional Code may still be scanned by a compatible secure mobile application 621 as represented by arrow 612b. Once the identifier is scanned, the mobile application may display that the URL is insecure and prompt to point to the destination designated in the path element of the URL. In the event that a traditional URI 612 indicates a secure server 631, access may however be granted but without performing additional security functions, as represented by arrow 621a.

[0168] The device 622 may thus include any standard mobile application (such as the default QR Code reader in the camera of the application embedded on an iPhone or an Android smartphone). The typical scenario of reading a traditional URI 612 is represented by the arrow 612a. Whether or not the URI 612 points to a secure server, the address designated in the traditional URI 612 will be resolved in the usual manner, as represented by the arrow 622a. In a scenario in which the device 622 reads a secure network resource identifier in a graphical code 611 as represented by the arrow 611b, the destination resource designated in the path element of the secure network resource identifier may be accessed in a similar manner as represented by the arrow 622b.If the specified destination server is a secure server (i.e., one that can decrypt the cryptographic content), 631 then it can process the full secure network resource identifier and confirm that the link between the URI and the resource is reliable. If the specified destination server is not a secure server, no additional security is provided, but access to the URI can continue in the usual manner.

[0169] A particular case is represented by the arrows 621c and 622c, in which a local application (capable or not of carrying out security operations according to embodiments) is configured to reroute access requests referenced by a URI (compliant or not with embodiments) for example by replacing higher level elements of the hierarchical part.

[0170] Using a URI to encode the object identifier provides a flexible and ubiquitous platform for encoding and interpretation. Encoding the identifier provides security and better evidence of data integrity and provenance. Identifying the encoding in the URI itself improves the autonomy of the identification system because more information is available locally.

[0171] The scheme name may be any suitable existing URI protocol or scheme name, or may be a scheme name designated for the purposes of the present invention. Embedded operating systems or other platform software will generally be configured to handle URIs according to various schemes or protocols, and to handle each according to its own characteristics and criteria. Appropriate configuration of such software will enable such devices to correctly interpret whatever scheme is adopted for implementing the present invention.

[0172] Identifying the encoding in the URI itself provides the ability to locally decode the object identifier. Known systems are forced to communicate with remote systems for identification, decoding, and verification of identifiers, whereas, according to the present invention, these activities can be implemented locally. In other words, systems implementing the invention do not need to have network access.

[0173] This embodiment offers the advantage of allowing purely local verification. The algorithms and their associated parameters can all be stored in the device used for the verification process. The library of algorithms and their associated parameters can be static or updated regularly, for example whenever network connectivity is available. The possibility of regular updating of the library strengthens the security of the solution.

[0174] In some embodiments, the URI may optionally be defined to resolve to a remote network location or a remote website, in addition to or instead of calling a local resource. The remote network location may implement certain aspects of the verification process. Calling a website in this manner may also provide a mechanism for gracefully handling situations in which the local device is unable, for some reason, to decode the object identifier. Calling a website in this manner may also provide a mechanism for handling verification failures, either in the form of a mechanism for notifying the user of the implications of the verification failure, or in the form of a mechanism for reporting the verification failure to a remote server for monitoring or auditing purposes.Calling a website in this manner may further provide a mechanism for presenting auxiliary information to a user, alongside the verification process.

[0175] According to an additional embodiment of the methods described with reference to Figure 5, the method may comprise an additional step of notifying the result of said verification to a user. Any convenient mechanism may be used for this purpose, for example by displaying a message on a display unit of the user device implementing the method, by emitting a sound, etc.

[0176] Embodiments therefore take advantage of certain features of the URI specification to incorporate cryptographic content so as not to interfere with the normal operation of a URI. The cryptographic content can then be used to ensure the authenticity of the path defined in the unencrypted portion. The path can also be used to point a reading device to a network resource capable of performing the decryption operation, or to a decryption key.

[0177] The disclosed methods may take the form of a fully software-based embodiment (e.g. FPGA), a fully software-based embodiment (e.g. for controlling a system according to the invention) or a fully software-based embodiment. embodiment containing both hardware and software elements. Software embodiments include, but are not limited to, firmware, resident software, microcode, etc. The invention may take the form of a computer program product accessible from a computer-readable or computer-readable medium, providing program code for use by, or in connection with, a computer or instruction execution system.

[0178] A computer-readable or computer-operable medium may be any device capable of containing, storing, communicating, distributing, or transporting the program for use by, or in connection with, the instruction-executing system, apparatus, or device. The medium may be an electronic, magnetic, optical, electromagnetic, infrared, or solid-state system (or apparatus or device), or a broadcast medium.

[0179] In some embodiments, the methods and processes described herein may be implemented in whole or in part by a user device. These methods and processes may be implemented by computer application programs or services, an application programming interface (API), a library and / or other computer program product, or any combination thereof.

[0180] The user device may be a mobile device such as a smartphone or tablet, a computer, or any other device with processing capability, such as a robot or other connected device.

[0181] [Fig.7] shows a generic computer system suitable for implementing embodiments of the invention.

[0182] As shown in [Fig.7], a system includes a logic device 701 and a storage device 702. The system may optionally include a display subsystem 711, an input subsystem 712, 713, 714, a communication subsystem 720, and / or other components not shown.

[0183] The logic device 701 comprises one or more physical devices configured to execute instructions. For example, the logic device 701 may be configured to execute instructions that are part of one or more applications, services, programs, routines, libraries, objects, components, data structures, or other logical constructs. These instructions may be implemented to perform a task, implement a data type, modify the state of one or more components, obtain a technical effect, or, more generally, achieve a desired result.

[0184] The logic device 701 may include one or more processors configured to execute software instructions. Additionally or alternatively, the logic device may include one or more hardware or firmware logic devices configured to execute hardware or firmware instructions. The processors of the logic device may be single-core or multi-core, and the instructions they execute may be configured for sequential, parallel, and / or distributed processing. Individual components of the logic device 701 may optionally be distributed among at least two separate devices, which may be remotely located and / or configured to perform coordinated processing. Aspects of the logic device 701 may be virtualized and executed by remotely accessible networked computing devices configured in a cloud computing-like configuration.

[0185] The storage device 702 includes one or more physical devices configured to store instructions executable by the logical device to implement the methods and processes described herein. During implementation of these methods and processes, the state of the storage device 702 may be changed - e.g., to store different data.

[0186] The storage device 702 may include removable and / or embedded devices. The storage device 702 may include one or more types of storage devices including optical memory (e.g., CD, DVD, HD-DVD, Blu-Ray disc, etc.), solid-state memory (e.g., RAM, EPROM, EEPROM, etc.), and / or magnetic memory (e.g., hard disk drive, floppy disk drive, magnetic tape drive, MRAM, etc.), among others. The storage device may include volatile, non-volatile, dynamic, static, read / write, read-only, random access, sequential access, location-addressable, file-addressable, and / or content-addressable devices.

[0187] In some arrangements, the system may include an interface 703 adapted to support communications between the logic device 701 and other system components. For example, additional system components may include removable and / or embedded extended storage devices. The extended storage devices may include one or more types of storage devices, including optical memory 732 (e.g., CD, DVD, HD-DVD, Blu-Ray disc, etc.), solid-state memory 733 (e.g., RAM, EPROM, EEPROM, FLASH memory, etc.), and / or magnetic memory 731 (e.g., hard disk drive, floppy disk drive, magnetic tape drive, MRAM, etc.), among others. This extended storage device may include volatile, non-volatile, dynamic, static, read / write, read-only, random access, sequential access, location-addressable, file-addressable, and / or content-addressable.

[0188] It will be understood that the storage device comprises one or more physical devices, and excludes the broadcasting of signals as such. However, aspects of the instructions described herein may alternatively be broadcast by a communication medium (e.g., an electromagnetic signal, an optical signal, etc.) rather than being stored on a storage device.

[0189] Aspects of the logic device 701 and the storage device 702 may be integrated together into one or more hardware logic components. These hardware logic components may include field-programmable gate arrays (FPGAs), program- and application-specific integrated circuits (PASICs / ASICs), program- and application-specific standard products (PSSPs / ASSPs), system-on-chips (SOCs), and complex programmable logic devices (CPLDs), for example.

[0190] The term “program” may be used to describe an aspect of a computer system implemented to perform a particular function. In some cases, a program may be instantiated via a logical device executing machine-readable instructions stored by the storage device. It will be understood that different modules may be instantiated from the same application, service, code block, object, library, routine, API, function, etc. Similarly, the same program may be instantiated from different applications, services, code blocks, objects, routines, APIs, functions, etc. The term “program” may encompass individual or grouped executable files, data files, libraries, drivers, scripts, database records, etc..

[0191] The system in [Fig.7] can more particularly be used to implement embodiments of the invention.

[0192] For example, a program implementing the steps described with respect to [Fig.4a], 4b or 5 may be stored in the storage device 702 and executed by the logic device 701. The logic device may cause the camera 716 or the near-field interface 721 to read the object identifier from the object or cause the printer 717 or the near-field interface 721 to affix the object identifier. and / or the machine-readable code on the object. The URI path may indicate the resource 76, accessible via the Internet 65.

[0193] Thus, the invention can be embodied in the form of a computer program.

[0194] Such a system may be further adapted to encode the URI in a machine-readable form.

[0195] Furthermore, once properly configured and connected, the elements in [Fig.7] may constitute a system for verifying a URL. The system may be further adapted to decode a remaining portion of the URI using the extracted algorithm / parameter combination to obtain a decoded object identifier.

[0196] It will be understood that a “service,” as used herein, is an application program executable across multiple user sessions. A service may be available to one or more system components, programs, and / or other services. In some implementations, a service may run on one or more server computing devices.

[0197] If present, the display subsystem 711 may be used to present a visual representation of data stored by the storage device. This visual representation may take the form of a graphical user interface (GUI). To the extent that the methods and processes described herein change the data stored by the storage device 702 and thus change the state of the storage device 702, the state of the display subsystem 711 may likewise be changed to visually represent changes to the underlying data. The display subsystem 711 may include one or more displays utilizing virtually any type of technology.These display devices may be combined with the logic device and / or the storage device in a shared enclosure, or these display devices may be peripheral display devices.

[0198] If present, the input subsystem may include, or interface with, one or more user input devices such as a keyboard 712, a mouse 713, a touchscreen 711, a game controller (not shown). In some embodiments, the input subsystem may include, or interface with, natural user input (NUI) components. These components may be embedded or peripheral, and the transduction and / or processing of input actions may be handled internally or externally. Examples of NUI components may include a microphone for speech and / or voice recognition; an infrared, color, stereoscopic, and / or depth camera for vision and / or gesture recognition; a head tracking system, a motion tracking system, and a eye movements, an accelerometer, and / or a gyroscope for movement detection and / or intention recognition; as well as electric field sensor components for the assessment of brain activity.

[0199] If present, the communication subsystem 720 may be configured to communicatively couple the computing system to one or more other computing devices. For example, a communication module may communicatively couple a computing device to a remote service hosted, for example, on a remote server 76 via a network of any size, including, for example, a personal network, a local area network, a wide area network, or the Internet. The communication subsystem may include wired and / or wireless communication devices compatible with one or more different communication protocols. As non-limiting examples, the communication subsystem may be configured to communicate via a wireless telephone network 74, or a wireless or wired local or wide area network.In some embodiments, the communication subsystem may enable the computer system to send and / or receive messages to / from other devices via a network such as the Internet 75. The communication subsystem may further support short-range inductive communications 721 with passive devices (NFC, RFID, etc.).

[0200] The system in [Fig. 7] is intended to illustrate a wide range of different types of information management system. It will be understood that many of the subsystems and features described with respect to [Fig. 7] are not necessary to practice the invention, but are incorporated for the purpose of illustrating possible systems in accordance with the present invention. It will be understood that system architectures may vary considerably, and that the relationship between the various subsystems in [Fig. 7] is purely schematic and likely to vary in terms of arrangement and distribution of roles in the systems. It will be understood that, in practice, systems will likely incorporate different subsets of the various subsystems and features described with respect to [Fig. 7]. [Fig. 8] shows a further example of a device in accordance with the present invention.Those skilled in the art will understand that it will be possible to use systems developed in the future, also operating according to the present invention.

[0201] [Fig.8] shows a smartphone-type device adaptable to constitute an embodiment. As shown in [Fig.8], the smartphone-type device incorporates the elements 701, 702, 703, 720, 733, 714, 715, 716, 711 described above. It is in communication with the telephone network 74 and a server 76 via the network 75. The elements 731, 732, 717, 712, 713 are however omitted. The characteristics shown in this figure can also be integrated into a tablet-type device.

[0202] It will be understood that the configurations and / or approaches described herein are illustrative only and that these particular embodiments or examples should not be construed in a limiting sense since many variations are possible. The particular routines or methods described herein may represent one or more of any number of possible processing strategies. In this regard, various actions illustrated and / or described may be performed in the illustrated and / or described sequence, in other sequences, in parallel, or omitted. Likewise, it is possible to change the order of the processes described above.

[0203] The subject matter of the present invention encompasses all novel and non-obvious combinations and sub-combinations of the various processes, systems and configurations, and other features, functions, actions and / or properties described herein as well as all or part of their equivalents.

Claims

Claims

1. A computer-implemented method of defining a secure network resource identifier structure, said method comprising defining a Uniform Resource Identifier (URI) having scheme and path components identifying a network resource, and associating said scheme and path components with a fragment and / or query portion comprising a cryptographically signed data structure.

2. A computer-implemented method of defining a secure network resource identifier structure, said method comprising defining a Uniform Resource Identifier (URI) having scheme and path components identifying a network resource, associating said scheme and path components with a path portion suffix comprising a cryptographically signed data structure constituting a unique identifier.

3. A method according to any preceding claim, comprising a further step of encoding said secure network resource identifier structure in machine-readable code.

4. Method according to any one of the preceding claims, said Uniform Resource Identifier pointing to a repository from which a software application capable of verifying that said path component corresponds to said signed data structure can be extracted.

5. A computer-implemented method of accessing a network resource, said method comprising receiving a secure network resource identifier structure according to any preceding claim, decrypting said cryptographically signed data structure, verifying that said path component matches said signed data structure, and, in response to said verification, accessing the network resource designated by said Uniform Resource Identifier.

6. The method of claim 5, comprising a step of receiving the secure network resource identifier structure at a user device, said step of verifying that said path component matches said data structure signed being performed at either the user device or a remote server identified by said path component.

7. A computer-implemented method of decoding a secure network resource identifier structure, said method comprising receiving a secure network resource identifier structure according to aforementioned embodiments, identifying a structure characteristic of a scheme known to be used with secure network resource identifier structures according to aforementioned embodiments, isolating a portion of said secure network resource identifier structure known to correspond to a unique identifier according to said scheme, and attempting to decrypt said isolated portion of said secure network resource identifier structure.

8. A method according to any one of claims 6 or 7, said cryptographically signed data structure comprising an additional data payload, and said method comprising a further step of extracting reference data from the network resource designated by said path component, and comparing said reference data to said additional data payload.

9. A method according to any one of claims 6 to 8, said cryptographically signed data structure comprising an additional data payload, and said method comprising a further step of identifying a characteristic of said secure network resource identifier structure associated with an additional network resource, and extracting reference data from said additional network resource, and comparing said reference data to said additional data payload.

10. A computer-implemented method of associating a unique identifier with a product, said product belonging to a tree-based product classification, said method comprising the steps of composing a URI based on the classification of said product according to said tree-based product classification, obtaining a cryptographically signed data structure with respect to said URI according to claim 1, and associating said cryptographically signed data structure with said product as said unique identifier.

11. Data processing system comprising means for carrying out the method according to any one of the preceding claims.

12. A computer program comprising instructions which, when the program is executed by a computer, cause the computer to carry out the method according to any one of claims 1 to 10.

13. A computer-readable medium comprising instructions which, when the instructions are executed by a computer, cause the computer to perform the method of any one of claims 1 to 10.

14. A secure network resource identifier structure, comprising a Uniform Resource Identifier (URI) having scheme and path components identifying a network resource, and a fragment and / or query portion comprising a cryptographically signed data structure.

15. A secure network resource identifier structure, comprising a Uniform Resource Identifier (URI) having scheme and path components identifying a network resource, associating said scheme and path components and a path portion suffix comprising a unique identifier and a cryptographically signed data structure.

Images