Method and arrangement for enhancing the security of critical data against manipulation

• US 5,771,348 A
• Filed: 09/09/1996
• Issued: 06/23/1998
• Est. Priority Date: 09/08/1995
• Status: Expired due to Fees

• Current Assignee: Francotyp-Postalia GmbH (Francotyp-Postalia Holding AG)
• Original Assignee: Francotyp-Postalia GmbH (Francotyp-Postalia Holding AG)
• Inventors: Thiel, Wolfgang, Kubatzki, Ralf
• Primary Examiner(s): Beausoliel, Jr., Robert W.
• Assistant Examiner(s): Palys, Joseph E.
• Application Number:
  US08/711,091
• Time in Patent Office: 652 Days
• Field of Search: 395/186, 395/187.01, 395/188.01, 395/182.22, 395/183.12, 380/3, 380/4, 380/23, 380/25, 364/464.15
• US Class Current: 726/2
• CPC Class Codes: G07B 17/00362 Calculation or computing within apparatus, e.g. calculation of postage value
• CPC Class Codes: G07B 2017/00395 Memory organization
• CPC Class Codes: G07B 2017/00403 Memory zones protected from unauthorized reading or writing
• CPC Class Codes: G07B 2017/00411 Redundant storage, e.g. back-up of registers
• CPC Class Codes: G07B 2017/00427 Special accounting procedures, e.g. storing special information

Abstract

In a method for enhancing the security of critical register data against manipulation, a number or a pointer that is allocated to a code word is loaded into a first non-volatile memory, and a code word is loaded into second non-volatile memories containing the critical data, whereby the code word is allocated to the last operating condition of the system, i.e. the code word has been selected on the basis of a pseudo-random sequence or as an outcome of the manufacture or a reloading of the system or before turn-off or before a voltage outage or before a standby before program interruption. A validity check of the code word is made at least at the time the system is turned on, and the old code word is replaced with a predetermined, new code word when the processor, after the validity check, recognizes the validity of the old code word with reference to the code word selected from a list with stored code words in its internal processor memory. This selection is made according to the number or the position of the pointer. The system is blocked after the time the system is turned on if the processor, after the validity check, denies the validity of the old code word with reference to the selected code word stored in the aforementioned list.

Claims

1. A method for enhancing security of critical data against manipulation in an information-processing system, comprising the steps of:

(a) storing a list containing a plurality of code words in an internal processor memory of a processor in a system containing critical data to be protected;

(b) loading an identifier into a first non-volatile memory in said system, said identifier identifying one of said code words in said list;

(c) loading said one of code words, as a current code word into a second non-volatile memory of said system, said second non-volatile memory containing the critical data;

(d) conducting a validity check of said current code word at least at a time said system is turned on by comparing said current code word to the code word in said list identified by said identifier;

(e) given validity of said current code word as a result of comparison with the code word in said list identified by said identifier, permitting access to said critical data and replacing said current code word with a predetermined, new code word;

(f) given invalidity of said current code word as a result of comparison with the code word in said list identified by said identifier, blocking said system from further operation after said system is turned on; and

(g) after each validity check, modifying said identifier to identify a new one of said code words dependent on a last operating condition of said system and replacing said one of said code words in said second memory with said new one of said code words as sad current code word.

2. A method as claimed in claim 1 comprising the additional step of:

selecting the last operating condition on which the current code word is dependent from the group of last operating conditions consisting of a last operating condition identified by a pseudo-random sequence, a last operating condition set by a manufacturer of said system, a last operating condition resulting from a reloading of said system, a last operating condition before turn-off of said system, a last operating condition before a voltage outage of said system, a last operating condition before said system enters into a standby time, and a last operating condition before program interruption in said system.

3. A method as claimed in claim 2 wherein said last operating condition comprises a last operating condition resulting from reloading of said system, wherein said system communicates with a remote data central and wherein reloading said system comprises the steps of:

placing said system in a communication mode with said remote data central and entering at least a monetary credit and a piece number of items to be processed by said system into respective memories in said system;

counting a number of new code words formed in said system beginning with a predetermined point in time and non-volatilely storing in said system said number of new code words formed externally of said processor;

interrogating, at said data central, said number of new code words formed at said data central; and

based on the interrogation, at said data central of said number of new code words formed, un-blocking an improperly blocked system which has become blocked due to a code word being incorrectly identified as invalid and restoring a preceding condition of said system by data transmission from said data central to said system.

4. A method as claimed in claim 1 comprising the additional steps of:

monitoring at least one security criterion related to said last operating condition of said system to determine whether said at least one security criterion is satisfied; and

placing said system in a mode for executing steps (a) through (g) only if said at least one security criterion is not satisfied.

5. A method as claimed in claim 1 wherein step (a) comprises storing a first portion of said plurality of code words in a first memory area of said internal processor memory and storing a second portion of said plurality of code words in a second memory area of said internal processor memory, wherein step (b) comprises loading an identifier into a first non-volatile memory in said system, said identifier identifying one code word in said first portion and one code word in said second portion, wherein step (c) comprises allocating first and second code words to a last operating condition of said system and loading said first and second code words, as a first current code word and a second current code word, into said second non-volatile memory of said system, wherein step (d) comprises conducting a validity check of said first and second current code words at least a time said system is turned on by comparing said first current code word to the code word identified by said identifier in said first portion and comparing said second current code word to the code word identified by said identifier in said second portion, wherein step (e) comprises given validity of each of said first and second current code words as a result of comparison with the respective code words in said first and second portions identified by said identifier, permitting access to said critical data and replacing each of said first and second current code words with respective predetermined, first and second new code words, and wherein step (f) comprises given invalidity of either of said first and second current code words as a result of comparison with the respective code words in said first and second portions identified by said identifier, blocking said system from further operation after said system is turned on.

6. A method as claimed in claim 5 wherein step (e) comprises forming said first new code word as a function of a code word in said first portion, and forming said second new code word as a function of a code word in said second portion.

7. A method as claimed in claim 6 comprising the step of selecting said function from the group of functions comprising functions which increment a numerical value, functions which decrement a numerical value and functions which modify a numerical value in a predetermined manner.

8. A method as claimed in claim 1 wherein step (e) comprises forming said new code word as a function of said current code word.

9. A method as claimed in claim 1 wherein step (e) comprises storing said new code word in said second non-volatile memory, and storing a program for calculating said new code word in said internal processor memory and using said program to calculate said new code word.

10. A method as claimed in claim 9 comprising the step of selecting said internal processor memory from the group of memory types comprising read only memories and externally programmable read only memories.

11. A method as claimed in claim 10 wherein said system communicates with a remote data central and comprising the additional steps of:

placing said system in a communication mode with said remote data central and entering at least a monetary credit and a piece number of items to be processed by said system into respective memories in said system;

counting a number of new code words formed in said system beginning with a predetermined point in time and non-volatilely storing in said system said number of new code words formed externally of said processor;

interrogating, at said data central, said number of new code words formed at said data central; and

based on the interrogation, at said data central of said number of new code words formed, un-blocking an improperly blocked system which has become blocked due to a code word being incorrectly identified as invalid and restoring a preceding condition of said system by data transmission from said data central to said system.

12. A method as claimed in claim 1 wherein step (b) comprises storing a program for calculating said identifier in said internal processor memory and using said program to calculate said identifier.

13. A method as claimed in claim 12 comprising the step of selecting said internal processor memory from the group of memory types comprising read only memories and externally programmable read only memories.

14. A method as claimed in claim 1 wherein step (b) comprises loading an identifier comprising a pointer into said first non-volatile memory in said system.

15. A method as claimed in claim 1 wherein step (b) comprises loading an identifier comprising a numerical value into said first non-volatile memory in said system.

16. A method for enhancing security of critical data against manipulation in an information-processing system, comprising the steps of:

(a) providing a non-volatile storage medium having a plurality of non-volatile storage areas, said non-volatile storage medium containing said critical data to be protected;

(b) allocating a separate code word respectively to each non-volatile storage area;

(c) providing a further memory selected from the group of memories consisting of an internal memory of a processor for said system, a memory on a chip card, or a similar system memory disposed at a remote data central in communication with said system;

(d) storing at least one of said separate code words in said further memory;

(e) preventing access to said critical data in said storage medium unless a match between at least one separate code word allocated to a non-volatile storage area and said at least one of said separate code words in further memory is made;

(f) forming new code words respectively at predetermined points in time; and

(g) storing said new code words in said non-volatile storage medium as replacements for said separate code words.

17. A method as claimed in claim 16 wherein step (f) comprises forming said new code words from previous ones of said separate code words.

18. A method as claimed in claim 17 wherein the step of forming said new code words comprises forming each new code word using an identical code word forming procedure from said separate code words.

19. A method as claimed in claim 17 wherein the step of forming said new code words comprises forming a new code word as a complementary shadow of another new code word to form a complementary code word from said complementary shadow for entry into said storage medium containing said critical data.

20. A method as claimed in claim 17 wherein the step of forming said new code words comprises forming a new code word as a complementary shadow of another new code word to form a complementary code word from said complementary shadow for entry into said storage medium containing said critical data, and storing said complementary shadow in at least one other area of said storage medium.

21. A method for enhancing security of critical data against manipulation in an information-processing system, comprising the steps of:

(a) loading a code word into an internal first non-volatile memory of a processor in said system and loading said code word into a second non-volatile memory of said system, said second non-volatile memory containing said critical data to be protected, said code word corresponding to a last operating condition of said system, said code word constituting a current code word;

(b) executing a validity check of said current code word at least at a time said system is turned on by comparing the respective code words stored in said first and second non-volatile memories;

(c) given agreement of said code words respectively stored in said first and second non-volatile memories, and replacing said current code word in said second non-volatile memory with a new code word selected, dependent on a last operating condition of said system, from a list of code words stored in said first non-volatile memory; and

(d) given non-agreement of said respective code word stored in said first and second non-volatile memories, blocking said system from further operation after said system is turned on.

22. A method as claimed in claim 21 comprising the additional step of:

selecting the last operating condition on which the current code word is dependent from the group of last operating conditions consisting of a last operating condition identified by a pseudo-random sequence, a last operating condition set by a manufacturer of said system, a last operating condition resulting from a reloading of said system, a last operating condition before turn-off of said system, a last operating condition before a voltage outage of said system, a last operating condition before said system enters into a standby time, and a last operating condition before program interruption in said system.

23. A method as claimed in claim 22 wherein said system communicates with a remote data central and wherein said last operating condition comprises a last operating condition resulting from reloading of said system, and wherein reloading said system comprises the steps of:

placing said system in a communication mode with said remote data central and entering at least a monetary credit and a piece number of items to be processed by said system into respective memories in said system;

counting a number of new code words formed in said system beginning with a predetermined point in time and non-volatilely storing in said system said number of new code words formed externally of said processor;

interrogating, at said data central, said number of new code words formed at said data central; and

based on the interrogation, at said data central of said number of new code words formed, un-blocking an improperly blocked system which has become blocked due to a code word being incorrectly identified as invalid and restoring a preceding condition of said system by data transmission from said data central to said system.

24. A method as claimed in claim 21 comprising the additional steps of:

monitoring at least one security criterion related to said last operating condition of said system to determine whether said at least one security criterion is satisfied; and

placing said system in a mode for executing steps (a) through (d) only if said at least one security criterion is not satisfied.

25. A method as claimed in claim 21, comprising loading a code word into the internal first non-volatile memory and into a plurality of second, non-volatile memories containing the data to be protected, checking the current code word for correspondence with the plurality of non-volatile memories before generating code words V and U, forming a new code word W'"'"' and subsequently forming a code word T'"'"' for the second non-volatile memory according to the equations:

space="preserve" listing-type="equation">W'"'"';

=F{P1} and

space="preserve" listing-type="equation">T'"'"';

=F{P2},

whereby P1 and P2 are different, monotonously steadily variable parameters.

26. A method as claimed in claim 25 wherein said monotonously steadily variable parameters are selected from the group consisting of the current time and the number of program interruptions.

27. A method as claimed in claim 25 comprising incrementing a numerical value before loading said new code word and the new code word is then calculated.

28. A method as claimed in claim 21, comprising forming the new code word dependent on the current code word.

29. A method as claimed in claim 21 further comprising storing said new code word in said second non-volatile memory, and storing a program for calculating said new code word in said internal processor memory and using said program to calculate said new code word.

30. A method as claimed in claim 29 comprising the step of selecting said internal processor memory from the group of memory types comprising read only memories and externally programmable read only memories.

31. A method for enhancing security of critical data against manipulation in an information-processing system, comprising the steps of:

providing a storage medium in said system having a plurality of non-volatile storage areas;

allocating a separate code word respectively to each storage area;

storing each of said separate code words in a non-volatile memory of a processor in said system;

checking for and requiring equivalency between at least one code word stored in said storage medium and at least one code word stored in said processor before permitting access to said critical data; and

after each check for equivalency, changing said at least one code word stored in said storage medium and said at least one code word stored in said processor for which equivalency is required before permitting access to said critical data.

32. A method as claimed in claim 31 wherein said system communicates with a remote data central and comprising the additional steps of:

placing said system in a communication mode with remote data central and entering at least a monetary credit and a piece number of items to be processed by said system into respective memories in said system;

counting a number of new code words formed in said system beginning with a predetermined point in time and non-volatilely storing in said system said number of new code words formed externally of said processor;

interrogating, at said data central, said number of new code words formed at said data central; and

based on the interrogation, at said data central of said number of new code words formed, un-blocking an improperly blocked system which has become blocked due to a code word being incorrectly identified as invalid and restoring a preceding condition of said system by data transmission from said data central to said system.

33. A method as claimed in claim 31 wherein the step of changing said at least one code word comprises forming a new code word using an identical code word procedure from said separate code words.

34. A method as claimed in claim 31 wherein the step of changing said at least one code word comprises forming a new code word as a complementary shadow of another code word to form a complementary code word from said complementary shadow for entry into said storage medium containing said critical data.

35. A method as claimed in claim 31 wherein the step of changing said at least one code word comprises forming a new code word as a complementary shadow of another code word to form a complementary code word from said complementary shadow for entry into said storage medium containing said critical data, and storing said complementary shadow in at least one other area of said storage medium.

36. An apparatus for enhancing security of critical data against manipulation in an information-processing system, comprising:

an internal processor having a non-volatile processor memory;

a further non-volatile memory, separate from said processor memory, respective code words being loaded into each of said processor memory and said further non-volatile memory;

security means for checking for, and for permitting access to said critical data only upon, coincidence of the code words respectively stored in the processor memory and the further non-volatile memory;

means for changing said code words respectively stored in the processor memory and in the further non-volatile memory after each check for coincidence by said security means; and

a sealed, secured housing containing said internal processor and said further non-volatile memory.

37. An apparatus as claimed in claim 36 wherein said non-volatile processor memory comprises a non-volatile memory internally contained in said internal processor.

38. An apparatus as claimed in claim 36 wherein said non-volatile processor memory comprises a non-volatile memory separate from said internal processor and connected for data exchange with said internal processor.

39. An apparatus as claimed in claim 38 further comprising an input/output control module contained in said housing and connected to said internal processor and to said non-volatile processor memory for transmitting data therebetween, and wherein said non-volatile processor memory is disposed in said housing and said apparatus further comprising means for mounting said non-volatile processor memory in said housing for preventing removal thereof during operation of said apparatus.

40. An apparatus as claimed in claim 38 wherein said non-volatile processor memory comprises a memory carried on a chip card, and said apparatus further comprising a chip card write/read unit connected to said internal processor for transmitting data between said memory of said chip card and said internal processor.

41. An apparatus as claimed in claim 36 wherein said further non-volatile processor memory comprises an internal EPROM.

42. A method for enhancing security against manipulation of critical data in a machine, comprising the steps of:

loading an authentification code that is generated with a code word, that is allocated to the code word and that encodes accounting data, into a first non-volatile memory that is protected against removal and manipulation during the running time of the machine;

loading the accounting data and said authentification code into second non-volatile memories NVM to be protected that contain register data, and allocating the code word to a last operating condition of the machine;

conducting a validity check of the authentification code that is allocated to the code word, at least the time the machine is turned on and, subsequently, upon an occurrence of a predetermined event;

replacing the code word with a predetermined, new code word for forming a further authentification code that is allocated to the new code word and that encodes accounting data upon a determination of validity of the code word; and

blocking the machine after it is turned on if, following the validity check, the authentification code checked on the basis of the code word is invalid.

43. A method as claimed in claim 42 further comprising loading said authentification code after the machine is turned on at predetermined chronological intervals.

44. A method as claimed in claim 42 further comprising loading said authentification code at intervals based on an item count of items processed by said machine.

45. A method as claimed in claim 42 further comprising loading said authentification code at intervals determined by a pseudo-random sequence.

46. A method for enhancing security against manipulation of critical data in a register in a machine comprising the steps of:

providing a first internal memory in said machine and securing said first internal memory against removal and manipulation during operation of said machine;

placing said first internal memory in communication with a processor in said machine during the operation of said machine generating a plurality of authentification codes using respectively separate code words and storing said plurality of authentification codes respectively in a plurality of non-volatile memory areas;

storing at least one of said plurality of authentification codes and said separate code words non-volatily in said first internal memory; and

generating a plurality of new code words, respectively replacing said separate code words, upon an occurrence of a predetermined event and storing a plurality of respective authentification codes generated with said new code words in said plurality of non-volatile memories and in a register to be protected.