Tamper resistant postal security device with long battery life

• US 7,028,014 B1
• Filed: 03/18/1999
• Issued: 04/11/2006
• Est. Priority Date: 03/18/1998
• Status: Expired due to Fees

• Current Assignee: Neopost Technologies S.A. (Quadient SA)
• Original Assignee: Ascom Hasler Mailing Systems Incorporated
• Inventors: Naclerio, Edward J.
• Primary Examiner(s): Dixon, Thomas A.
• Application Number:
  US09/646,489
• Time in Patent Office: 2,581 Days
• Field of Search: 713/194, 713/200, 713/300, 705/401, 705/402, 705/403, 705/405, 705/406, 705/410, 705/60, 705/61
• US Class Current: 705/401
• CPC Class Codes: G07B 17/00193 Constructional details of apparatus in a franking system
• CPC Class Codes: G07B 2017/00258 Electronic hardware aspects, e.g. type of circuits used
• CPC Class Codes: G07B 2017/00967 PSD [Postal Security Device] as defined by the USPS [US Postal Service]

Abstract

In accordance with the invention, a postal security device (PSD) (10) contains a non-volatile memory (13) which does not depend on battery power such as an EEPROM (13), and contains a nonvolatile memory (14, 16) which does depend on battery power, such as a static RAM. The PSD (10) also contains an encryption engine (12, 14, 22). An encryption key is developed and is stored in the static RAM (14), which is sized to be only large enough to contain the encryption key. A large body of data, too large to fit in the static RAM, is encrypted by means of the encryption engine (12, 14, 22) and with reference to the encryption key, and is stored in the EEPROM (13). This body of data typically includes cryptographic keys and sensitive bit-images. When the PSD is powered, a large RAM (typically a dynamic RAM) (16) is available to receive the large body of data, decrypted using the encryption key. A tamper switch (17) cuts power to both RAMs (14, 16) in the event of tampering.

Claims

1. A method for use with a postal security device comprising a secure housing, and within the secure housing a body of data having a size, said postal security device also having within the secure housing means for generating print data for printing of postage indicia, said generating of said print data relying in part on the body of data, said postal security device also having within the secure housing a first memory sized to accommodate the body of data, said first memory of a type not requiring electrical power to maintain the contents thereof, the postal security device also having within the secure housing a second memory not large enough to accommodate the body of data, said second memory of a type that requires electric power to maintain its contents, said postal security device also comprising a battery powering the second memory and a tamper switch mechanically coupled with the secure housing so that upon tampering with the secure housing the second memory is disconnected from the battery, said postal security device further comprising an encryption key stored within said second memory, said postal security device further comprising a cryptographic engine;

the method comprising the steps of;

storing the encryption key within the second memory;

encrypting the body of data by the cryptographic engine with respect to the encryption key;

storing the encrypted body of data in the first memory;

upon power-up of the postal security device decrypting the encrypted body of data with the cryptographic engine with respect to the encryption key;

temporarily storing the decrypted body of data in a third memory, wherein upon power down of the postal security device the decrypted body of data is lost;

in the event of tampering with the postal security device, removing power from the second memory and the third memory resulting in a loss of the encryption key and the decrypted body of data; and

requiring battery power for the second memory in order to minimize a need for back-up battery power in the postal security device, the second memory being limited in data storage capacity size in order to minimize battery power consumption when the second memory relies on back-up battery power.

2. A method for use with a postal security device comprising a secure housing, and within the secure housing a body of data having a size, said postal security device also having within the secure housing means for generating print data for printing of postage indicia, said generating of said print data relying in part on the body of data, said postal security device also having within the secure housing a first memory sized to accommodate the body of data, said first memory of a type not requiring electrical power to maintain the contents thereof, the postal security device also having within the secure housing a second memory not large enough to accommodate the body of data, said second memory of a type that requires electric power to maintain its contents, said postal security device also comprising a battery powering the second memory and a tamper switch mechanically coupled with the secure housing so that upon tampering with the secure housing the second memory is disconnected from the battery, said postal security device further comprising an encryption key stored within said second memory, said postal security device further comprising a cryptographic engine;

the method comprising the steps of;

storing the encryption key within the second memory;

encrypting the body of data by the cryptographic engine with respect to the encryption key;

storing the encrypted body of data in the first memory;

upon power-up of the postal security device decrypting the encrypted body of data with the cryptographic engine with respect to the encryption key;

temporarily storing the decrypted body of data in a third memory, wherein upon power down of the postal security device the decrypted body of data is lost;

in the event of tampering with the postal security device, removing power from the second memory and the third memory resulting in a loss of the encryption key and the decrypted body of data; and

limiting a size of data stored in the second memory to the encryption key in order to maximize a life of the battery powering the second memory.

3. The method of claim 2 further comprising, upon power-up of the postal security device, detecting a presence of the encryption key, and if not present, transmitting a message to an administrator of the postal security device indicating a breach of the postal security device.

4. The method of claim 2 further comprising determining that the data in the second memory is lost and automatically notifying a postal authority.

10. The postal security device of claim 4 further comprising an anti-tamper device adapted to interrupt power to the second memory device and the third memory device when the secure housing of the postal security device is tampered with, wherein the body of decrypted data is lost and the encryption key is not available.

11. The postal security device of claim 4 wherein the body of data includes cryptographic keys and sensitive bit-images.

12. The postal security device of claim 4 further comprising a detection device adapted to detect that the second non-volatile memory device is no longer storing the encryption key and send a message via a communications channel to an administrator of the postal security device for action.

5. A postal security device having improved battery power consumption during power-off periods comprising;

a first memory device for storing encrypted data, the first memory device being connected to a main power source and not connected to a back-up battery power source;

a second memory device having a memory storage capacity sufficient to store only an encryption key, the encryption key being used to decrypt the encrypted data stored in the first memory device when the postal security device is powered on, the second memory being connected to both the main power source and the back-up battery power source, the second memory device having a data storage capacity size limited to the encryption key to minimize battery power consumption when the second memory relies on back-up battery power, only the second memory having a battery source in order to minimize a need for back-up battery power;

an encryption engine adapted to decrypt the encrypted data using the encryption key during power on; and

a third memory for temporarily storing the decrypted data, the third memory being connected only to the main power source;

wherein when the main power source is interrupted, the decrypted data in the third memory is lost while the second memory retains the encryption key, and since only the second memory requires back-up battery power, battery power consumption of the postal security device is reduced.

6. The postal security device of claim 5 further comprising an anti-tamper device adapted to interrupt power to the second memory device and the third memory device, wherein the body of decrypted data is lost and the encryption key is not available.

7. The postal security device of claim 5 further comprising a postal indicia generator adapted to receive the decrypted body of data from the postal security device over a communications channel and print a postal indicia relying in part of the decrypted body of data.

8. A postal security device comprising:

a secure housing, and within the secure housing;

a first nonvolatile memory device not having a backup battery power source and adapted to store an encrypted body of data when power is applied to the postal security device and when power is not applied to the postal security device;

a second nonvolatile memory device having a backup battery power source and having a storage capacity only large enough to store an encryption key, the second non volatile memory having a limited data size tied to the encryption key to maximize a life of the back-up battery power source;

an encryption engine adapted to encrypt a body of data with reference to the encryption key in order to form the encrypted data stored in the first nonvolatile memory;

a third memory device not having a backup battery and adapted to temporarily store a body of decrypted data while the postal security device is powered on, the body of decrypted data being transferred to the third memory device from the encryption engine when the postal security device is initially powered on, the encryption engine decrypting the decrypted data stored in the second memory device with respect to the encryption key when the postal security device is powered on; and

wherein when the postal security device powers down, the body of decrypted data temporarily stored in the third memory device is lost and battery power required to maintain the postal security device is minimized.

9. The postal security device of claim 8 further comprising a means for generating print data for the printing of postal indicia, the generating of the print data relying in part on the decrypted body of data.

13. A method of improving back-up battery power consumption in a postal security device comprising:

storing a body of encrypted data in a first memory device that does not have a back-up battery power source, the encrypted data being encrypted by an encryption engine with respect to an encryption key;

storing the encryption key in a second memory device in the postal security device, only the second memory device having a back-up battery power source and having a maximum storage capacity limited to a size of the encryption key and limiting data storage capacity size of the second memory in order to minimize battery power consumption when the second memory relies on back-up battery power, wherein a need for back-up battery power in the postal security device is minimized;

powering up the postal security device and automatically decrypting the encrypted data with respect to the encryption key stored in the second memory device;

temporarily storing the decrypted data in a third memory device not having a back-up power source, wherein if power to the postal security device is interrupted, the decrypted data is lost and only the encryption key stored in the second memory device having the battery back-up is maintained; and

causing the decrypted data in the third memory device and the encryption key to be lost if the postal security device is tampered with.

14. The method of claim 13 further comprising generating an electrical signal when the postal security device is tampered with that causes the second memory device and the third memory device to automatically clear their respective memories.

15. The method of claim 13 further comprising, if the postal security device is tampered with, interrupting main electrical power to the second memory and the third memory and interrupting back-up electrical power to the second memory, wherein the interruption of main and back-up electrical power causes the second memory and the third memory to be cleared.

16. The method of claim 13 further comprising minimizing an amount of back-up battery power consumed by the postal security device when the postal security device is powered down by requiring back-up power only for the second memory.

17. The method of claim 13 further comprising storing only the encryption key and the encrypted body of data when no power is supplied to the postal security device and only the back-up power is supplied to the second memory device.

18. The method of claim 13 further comprising generating a postal indicia relying in part on the decrypted body of data and transmitting the postal indicia over a communications channel to a printer for printing the postal indicia.