Cryptographic module for secure processing of value-bearing items

• US 8,301,572 B2
• Filed: 08/24/2011
• Issued: 10/30/2012
• Est. Priority Date: 10/18/1999
• Status: Expired due to Fees

• Current Assignee: Stamps.com, Inc.
• Original Assignee: Stamps.com, Inc.
• Inventors: Ogg, Craig L., Chow, William W.
• Primary Examiner(s): Augustin, Evens J
• Application Number:
  US13/216,646
• Publication Number:
  US 20110307703A1
• Time in Patent Office: 433 Days
• Field of Search: 705/60, 705/75
• US Class Current: 705/60
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: G06Q 20/3829 involving key management
• CPC Class Codes: G06Q 20/401 Transaction verification
• CPC Class Codes: G07B 17/0008 Communication details outside or between apparatus coin-freed apparatus for franking per se G07F17/26
• CPC Class Codes: G07B 17/00733 Cryptography or similar special procedures in a franking system
• CPC Class Codes: G07B 2017/00056 Client-server
• CPC Class Codes: G07B 2017/00064 Virtual meter, online stamp; PSD functions or indicia creation not at user's location
• CPC Class Codes: G07B 2017/00145 via the Internet
• CPC Class Codes: G07B 2017/00201 Open franking system, i.e. the printer is not dedicated to franking only, e.g. PC (Personal Computer)
• CPC Class Codes: G07B 2017/00887 using look-up tables, also called master tables with pointers
• CPC Class Codes: G07B 2017/00967 PSD [Postal Security Device] as defined by the USPS [US Postal Service]

Abstract

An on-line value bearing item (VBI) printing system that includes one or more cryptographic modules and a central database is disclosed. The cryptographic modules are capable of implementing the USPS Information Based Indicia Program Postal Security Device Performance Criteria and other required VBI standards. The modules encipher the information stored in the central database for all of the on-line VBI system customers and are capable of preventing access to the database by unauthorized users. Additionally, the cryptographic module is capable of preventing unauthorized and undetected modification, including the unauthorized modification, substitution, insertion, and deletion of VBI related data and cryptographically critical security parameters.

Claims

1. A cryptographic device for securing data in a computer network comprising:

a processor programmed to authenticate a plurality of users on the computer network for generating a postal indicium, using a plurality of challenges;

a memory for storing a data record for ensuring authenticity of a user, the data record including a key for encrypting a user secret, a private key for signing the challenges, and a last challenge received from a client subsystem of the user;

a cryptographic engine for cryptographically protecting the data record; and

an interface for communicating with the computer network, wherein when the cryptographic device receives a new challenge message from the client subsystem, the processor is configured to respond by signing the received challenge with the stored private key and send a ciphertext back to the client subsystem to be compared with the new challenge message.

2. The cryptographic device of claim 1, wherein the data record further includes an ascending register value, a descending register value, a cryptographic device ID, an indicium key certificate serial number, a licensing ZIP code, a key token for an indicium signing key, user secrets, date and time of last transaction, an operational state of the respective device, and expiration dates for keys.

3. The cryptographic device of claim 1, wherein the data record further includes a passphrase repetition list.

4. The cryptographic device of claim 1, wherein the processor includes a state machine for determining a state corresponding to availability of one or more commands.

5. The cryptographic device of claim 4, wherein the state machine includes one or more of the group consisting of an uninitialized state, an initialized state, an operational state, an administrative state, an importing shares state, and an error state.

6. The cryptographic device of claim 5, wherein the one or more commands corresponding to the uninitialized state includes a command for start initializing.

7. The cryptographic device of claim 5, wherein the one or more commands corresponding to the initialized state includes commands for one or more of get status command, initialize access control database command, logon command, logoff command, query current user role command, query current user ID command, session management commands, audit entry creation command, generate master key set command, and generate transport key pair commands.

8. The cryptographic device of claim 5, wherein the one or more commands corresponding to the operational state include commands for one or more of access control, session management, key management, and audit support.

9. The cryptographic device of claim 8, wherein the commands for access control include one or more of transition to administrative state command, logon command, logoff command, query current user role command, query current user ID command, view access control database command, change password command, set clock command, and set Status command.

10. The cryptographic device of claim 1, wherein the postal indicium comprises a digital signature.

11. The cryptographic device of claim 1, wherein the postal indicium comprises a postage amount.

12. The cryptographic device of claim 1, wherein the processor is configured to share a secret with a plurality of other cryptographic devices.

13. The cryptographic device of claim 1, wherein at least one of the plurality of users is an enterprise account.

14. A system for securing data in a computer network comprising:

a server system configured to communicate with a plurality of client systems via the computer network, the server system including a plurality of cryptographic devices, each cryptographic device comprising;

a processor programmed to authenticate the plurality of users on the computer network for generating a postal indicium, using a plurality of challenges;

a memory for storing a data record for ensuring authenticity of a respective one of the plurality of users, the data record including a key for encrypting a user secret, a private key for signing the challenges, and a last challenge received from a client subsystem of the respective user;

a cryptographic engine for cryptographically protecting the data record; and

an interface for communicating with the computer network, wherein when a respective cryptographic device receives a new challenge message from the client subsystem, the processor is configured to respond by signing the received challenge with the stored private key and send a ciphertext back to the client subsystem to be compared with the new challenge message.

15. The system of claim 14, wherein the postal indicium comprises a digital signature.

16. The system of claim 14, wherein at least one of the plurality of cryptographic devices is configured to share a secret with other cryptographic devices.

17. The system of claim 14, wherein at least one of the plurality of cryptographic devices meets FIPS 140-1 level 3 security requirements.

18. The system of claim 14, wherein at least one of the plurality of cryptographic devices meets FIPS 140-1 level 4 security requirements.

19. The system of claim 14, wherein at least one of the plurality of cryptographic devices zeroizes all critical security parameters when a penetration attempt is detected.

20. The system of claim 14, wherein at least one of the plurality of cryptographic devices includes a security sensing and response circuit.

21. The system of claim 14, wherein at least one of the plurality of cryptographic devices includes a measure for detecting attacks involving one or more of the group consisting of probe penetration, power sequencing, radiation, and temperature manipulation.

22. The system of claim 14, wherein each of the plurality of cryptographic devices is programmed to receive any of the plurality of security device transaction data records.

23. The system of claim 14, wherein each cryptographic device is not dedicated to particular security device transaction data records.