Classifications

• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
  • H04L9/30—Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
  • H04L2209/12—Details relating to cryptographic hardware or logic circuitry
  • H04L2209/127—Trusted platform modules [TPM]
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
  • H04L2209/56—Financial cryptography, e.g. electronic payment or e-cash

Definitions

• the present invention relates in general to data processing systems, and in particular, to fiscal printers that contain hardware for collecting and storing information used for tax collection purposes.
• point-of-sale terminal (cash register) printers must have additional hardware that collects and stores that cash register's sales totals data for reporting to the government, for tax collection purposes. These printers are known as “fiscal printers”.
• the additional hardware in the fiscal printer that collects and stores these totals is tamper-evident (has features which show tampering) , which is accepted by these governments as “secure”.
• This secure hardware controls print requests to the customer receipt print station from the terminal's application program, and it also generates printing itself, based on certain circumstances. All printing on customer receipts is also either printed on a separate "journal” paper roll, or stored electronically inside the secure hardware.
• the public key can be printed on the receipt printer as a trusted method of revealing the public key for use in signature authentication.
• Any encryption algorithm's private key can be determined by employing enough time and money to the effort. The larger the private key, the more difficult it is to determine, but a larger private key also takes longer to legitimately encrypt a signature within the fiscal printer. The goal is to use a private key small enough to be practically manageable, but large enough to be impractical to "hack".
• the present invention provides a method to automatically and continuously reduce hacking susceptibility of data from an output device comprising the steps of: generating within said output device a private/public encryption key pair; calculating a viability time for said private/public encryption key pair; selectively publishing a public encryption key of said private/public encryption key pair while keeping a corresponding private encryption key stored in secured hardware in said output device; modifying said viability time based on inputted parametric data; and modifying said private/public encryption key pair based on comparison of a real time date to said viability time.
• the present invention also provides a computer program comprising program code adapted to perform the method as described in the previous paragraph .
• the output device's private key is small enough to allow for as fast a signature encryption as possible and secure enough to make it impractical to break the key, for the life of the device, without requiring manual intervention of every device installed.
• a method and system are disclosed for optimizing the security of information generated by an output device. While private/public key encryption has been used, the present invention preferably discloses a method and system for applying this encryption technique to systems where employing latest technology may not be the most effective system.
• Output devices have hardware that is tamper-evident and as such are accepted by certain governments as secure .
• Embodiments of the present invention extend this hardware with circuits and components that allow a private/public key pair to be generated once during manufacture and will cause erasure of the private key if the security of the hardware is broached without authorization.
• Embodiments of the present invention incorporate algorithms internal to the secure hardware that calculate the viability of a given length of private/public keys based on inputted parameters which include length the code has been in existence, technology advances and other factors with the intent of optimizing the length of time to encrypt as well as insuring a commensurate security level with the economic risk of unauthorized private key discovery.
• the present invention further provides a system for automatically and continuously reducing hacking susceptibility of data from a output device comprising: an algorithm circuit for generating a private/public encryption key pair internal to secure hardware of said output device; a viability time circuit for calculating a viability time for said private/public key pair; a public circuit for sending a public key of said generated private/public key pair external to said output device; a first modifying circuit receiving inputted parametric data, said first modifying circuit operable for modifying said viability time using said inputted parametric data; and a second modifying circuit operable to change said generated private/public key pair based on a comparison of a real time date to said viability time.
• the present invention further provides a data processing system, comprising: a central processing unit (CPU) ; shared random access memory (RAM) ; read only memory (ROM) ; an I/O adapter; an output device system as described in the previous paragraph; a display adapter; and a bus system coupling said CPU to said ROM, said RAM said display adapter, and the output device system described in the previous paragraph.
• CPU central processing unit
• RAM shared random access memory
• ROM read only memory
• I/O adapter an output device system as described in the previous paragraph
• display adapter a display adapter
• a bus system coupling said CPU to said ROM, said RAM said display adapter, and the output device system described in the previous paragraph.
• the output device is a fiscal printer.
• FIG. 1 illustrates a table having date, cost and time to break or hack a private key
• FIG. 2 illustrates a flow diagram of method steps in an embodiment of the present invention
• FIG. 3 illustrates a system block diagram of an embodiment of the present invention
• FIG. 4 is a system block diagram used in conjunction with embodiments of the present invention.
• private, public or private/public keys may be used synonymously to mean private, public, or private/public encryption keys.
• the word encryption may not be used in all cases for the sake of brevity.
• Encryption involves the encoding and decoding of information by use of an algorithm.
• private/public key encryption there are two "keys".
• the public key is made available for use by anyone who wants to send a message to the owner of the private key.
• the sender uses the public key to encrypt the message which can then only be decrypted by use of the private key.
• the private key may also be used to encrypt a message which can be decrypted by anyone with access to the public key.
• the primary purpose of the private/public key encryption is to maintain message integrity in the sense that the message can be identified as having originated from the person with access to that private key, that is, authorship integrity. To some degree it also protects the security of the information in transit, although it may be read by anyone, in addition to the addressee, who has the sender's public key.
• the public key is not public in the sense that it is broadcast to everyone, it is public in that it is given only to those with authorized access to a secured fiscal printer.
• the fiscal printer now (e.g., by algorithm) destroys the old private key and sends a message encrypted with the new private key to holders of the new public key instructing these holders to destroy the old public key.
• a secure link is now established.
• Hardware 302 has been accepted as secure by governments requiring fiscal printers if the hardware is tamper-evident (has features which indicate tampering) or has locking measures in place.
• the secure hardware in the fiscal printer has in one embodiment features that destroy the private key if it is tampered with and forces an intervention to reset the breached communication link.
• a private/public key pair is generated at the time of installation.
• the public key is extracted and then the hardware is secured. Since the public key is in the hands of a "trusted" source and the private key is in the secured hardware secure communication can be transacted by the "trusted" source and the fiscal printer secured hardware. Since the private key, generated at this time, is available only to the hardware 302, secure communication can be established to the hardware 302 via the public key encryption (only the hardware can read the input) to input data (e.g., Input data 303) necessary for the hardware to execute security routines of the preferred embodiment.
• input data e.g., Input data 303
• the secure hardware has read once inputs (the secure hardware accepts an external command from these inputs only once) that direct the hardware to generate a first private/public key pair at manufacturing time.
• the public key so generated is made available for additional communication such as reading in parameters pertinent to algorithms of the preferred embodiment as well as commanding the hardware to generate a new private/public key pair.
• the read once inputs allow a first time start or power up, provided the hardware 302 is secured.
• the generated private key is erased and internal circuitry would have to be replaced before a new power up and another read once could be commanded.
• the report generating hardware 307 encrypts a signature for the entire tax reports with an installation generated private key
• journal printing station 309 likewise prints a record of all entered transactions with an encrypted signature (encrypted by a private key ensuring the source is known and verifiable by an authorized holder of the corresponding public key generated at installation) insuring it was the product of the fiscal printer 306 generating a particular private/public key pair.
• a system such as the one described in embodiments of the present invention, could preferably be defeated only by "hacking" the private key or by attempting to break into the secure hardware 302 of the fiscal printer 306 which in embodiments of the present invention destroy the private key and require a hardware installation too once again establish the integrity of the fiscal printer system.
• the preceding has detailed how a private/public key system may be used to ensure that the information from a fiscal printer, data or just a digital signature, may be verified as to its source (whether a particular fiscal printer is the source) .
• the present invention preferably provides for a way to allow a fiscal printer's logic in the secure hardware to automatically change its private/public key pair periodically.
• the fiscal printer microcode does not simply change its key pair at regular intervals. Rather it uses an algorithm that takes into account the changes in technology to always stay one step ahead of a hacker, while remaining as efficient as possible to legitimately encrypt a signature or data.
• this algorithm is written into the fiscal printer's microcode at manufacture time.
• the parameters for the algorithm are data from publicly available encryption industry estimates of time and money needed to break a key of a certain length (over the life of the printer) , along with estimates of how much tax money could be saved by creating false tax reports (e.g., signed with a hacked private key) for a particular fiscal printer (over the life of the printer) .
• a hypothetical example of an industry estimate of the time required to break a key length of 128 bits might look like the chart in FIG. 1. Similar industry estimates may be determined for a 256-bit key, a 764-bit key, a 1024 bit key, etc. Obviously the larger the key size, the longer it takes and the more expensive it is to break the key.
• the proposed algorithm takes this information for all key sizes, along with estimates of maximum taxes collected from any particular fiscal printer per year, and using the fiscal printer's built-in real-time clock 301, the algorithm estimates the life or viability time of the security of a particular private key at any point in time. In one embodiment the algorithm calculates the viable secure lifetime expectancy of a 128-bit private key put into service on a particular date. The algorithm in the secure hardware 302 continuously tests the 128-bit key's viability using updated information provided using a present public key. If the printer's microcode determines that the present key is not viable because of the length of time the present key has existed, in one embodiment it generates a new 128-bit key pair, which has a life expectancy that is again viable.
• the analysis may determine that generating a new 128-bit key is not viable and the secure hardware 302 automatically generates a new, longer, 256-bit key that is good for a viable period of time. This process continues, with new keys of the same length being generated, at ever decreasing intervals, until a new larger sized key is required.
• Data related to how may samples of encrypted data samples have been "presented" to the outside world may also be considered in the considerations of the viability of a public/private key pair. Sheer volume of the samples of data signed by encryption is one of the resources used by someone attempting to break the code.
• Embodiments of the present invention use the number of data samples that have been encrypted and sent external to the fiscal printer in the algorithm used to determine the public/private key viability.
• the algorithm preferably strikes a balance between increasing frequent changes of keys of the same length and simply changing to larger length keys, which initially require less frequent changes.
• the new public key is revealed outside the secure hardware 302.
• the new public key is preferably part of a message that has a digital signature that was created using the printer's previous private key, " and can thus be authenticated as having come from the secure fiscal printer by using the previous public key.
• FIG. 2 illustrates the method steps used in embodiments of the present invention.
• a read once system start up is employed. This causes the secure hardware 302 to generate a first private/public key pair wherein the private key is retained inside the secure hardware 302 and the public key is delivered to selected users for use in further communications to the fiscal printer.
• step 214 a check is done to see if the hardware is secure. If the hardware is not secure, then the private key is erased in step 213.
• step 212 the read once circuits are re-installed, the hardware secured and a return is issued to step 201. If the hardware is secure in step 214, a check is done in step 215 to test if new data is available.
• step 215 If new data is available in step 215, then data on encryption economics is read in step 203.
• Fiscal printer tax data is read in step 204 and a branch is issued to step 210.
• step 210 real time clock data is read and next in step 206 the private key birth data is compared to check point data and an action plan is determined using stored algorithms. The requirement for an action plan is checked in step 207. If an action plan is required, the required key length is determined, new keys are generated, new check point dates are set and a return is issued to step 214. If no action plan is required a branch is made to step 214.
• FIG. 4 an example is shown of a data processing system 400 which is used for a preferred embodiment of the present invention.
• the system has a central processing unit (CPU) 410, which is coupled to various other components by system bus 412.
• Read-only memory (“ROM”) 416 is coupled to the system bus 412 and includes a basic input/output system (“BIOS”) that controls certain basic functions of the data processing system 400.
• RAM random access memory
• I/O adapter 418 I/O adapter 418, and communications adapter 434 are also coupled to the system bus 412.
• I/O adapter 418 may be a small computer system interface (“SCSI”) adapter that communicates with a disk storage device 420 or tape storage device 440.
• SCSI small computer system interface
• Communications adapter 434 interconnects bus 412 with an outside network enabling the data processing system to communicate with other such systems.
• Input/Output devices are also connected to system bus 412 via user interface adapter 422 and display adapter 436.
• Keyboard 424, track ball 432, mouse 426 and speaker 428 are all interconnected to bus 412 via user interface adapter 422.
• Display monitor 438 is connected to system bus 412 by display adapter (controller) 436. In this manner, a user is capable of inputting to the system through the keyboard 424, trackball 432 or mouse 426 and receiving output from the system via speaker 428 and display 438.
• the fiscal printer system 441 may include additional devices such as a fiscal printer system 441 containing a secure hardware 302 for receiving or generating private/public encryption keys.
• the fiscal printer system 441 preferably receives and outputs data via user interface adapter 422.
• Fiscal printer system 441 preferably also includes circuits for erasing a generated private key if the secure hardware 302 is broached in an unauthorized manner.
• Fiscal printer system 441 also includes circuits that enable a read once command to generated, internal to the secure hardware 302, a private/public key pair and also require the read once circuits to be replaced if the secure hardware 302 is breached in an unauthorized manner.

Landscapes

• Engineering & Computer Science (AREA)
• Computing Systems (AREA)
• Theoretical Computer Science (AREA)
• Computer Security & Cryptography (AREA)
• Computer Networks & Wireless Communication (AREA)
• Signal Processing (AREA)
• Storage Device Security (AREA)
• Control Of Vending Devices And Auxiliary Devices For Vending Devices (AREA)

Applications Claiming Priority (3)

Publications (1)

Family

ID=24385468

Family Applications (1)

Country Status (5)

Families Citing this family (4)

Family Cites Families (1)

• 2001
  • 2001-06-11 MY MYPI20012701 patent/MY136255A/en unknown
  • 2001-06-13 WO PCT/EP2001/006668 patent/WO2001097441A2/en not_active Ceased
  • 2001-06-13 AU AU2001276363A patent/AU2001276363A1/en not_active Abandoned
  • 2001-06-13 CA CA002405613A patent/CA2405613A1/en not_active Abandoned
  • 2001-06-13 EP EP01953977A patent/EP1290822A2/de not_active Withdrawn

Non-Patent Citations (1)

Also Published As

Similar Documents

Legal Events