EP1398741A2 - Secure storage of journal data - Google Patents

Abstract

Printer, especially a journal or voucher printer has an interface via which it receives data to be printed. At least a part of the received data comprises a signature and at least the signature is sent back over the interface. The invention also relates to a corresponding filter module for use with a printer, with the filter connected to the printer input and having an exchangeable cryptographic unit, e.g. a chip card.

Description

The invention relates to the backup of journal data in POS systems and self-service stations.

In cash register systems it is usually mandatory to have one Part of the data is permanently protected against falsification to document. These data are especially the amounts which have been acknowledged by the cash register. The easiest way to do this is If a paper strip is used on which the data to be printed. This facility is common Called Journal. Such is also found in self-service stations, for example ATMs to the Document payment transactions and amounts. For the The journal and the receipt are therefore two printing units or one Printer with two printing stations required. A loss the printer for the journal is sought.

Patent application DE 44 35 902 A1 describes that for this purpose also a memory card with processing function, often referred to as a smart card or chip card, is usable. In the patent DE 44 37 460 C2 such a module between the controller and receipt printer connected. The journal is kept in the module. By the processing function of the card ensures that only information added, but none changed or deleted can be. The module thus provides a write-only memory The operating program of the cash register then does not need to be certified and protected; the memory card performs this function. Then there are the data firmly with the data carrier, here the memory card, connected. This is an advantage in some areas of application.

However, the data is linked to the memory card also disadvantageous, for example not by simple Type of data can be secured against loss and because the storage capacity of a memory card is relatively small is. Therefore, a solution is needed that is tamper-proof Storage of data from a journal with allows conventional rewritable mass storage devices, even if the operating programs using the mass storage not certified and protected against change are.

To protect against falsification of data are one Series of cryptographic measures known as common to watch. This particularly affects the formation of cryptographic Checksums, also called signature, the one Make falsification of data practically impossible. Be here especially the use of the 'data encryption standard', DES, with which a 'message authentication code', MAC, can be formed. For protection against adulteration Also usable are processes that are called 'one way hash functions', hereinafter referred to as hash functions, are known. The result of calculating a Hash function is also called hash for short. By on the data of the secret key is logically appended (or is inserted or inserted), the hash can only be used with Knowledge of the secret key can be generated or checked. In both cases one and the same is to be kept secret Key for both education and for Verification of the signature necessary.

Methods known as asymmetrical are also known where a signature with a first secret key formed and with a second public, from the first different, key is checked. This and others cryptographic methods are known below provided and can possibly the known textbooks about cryptography, e.g. the volume 'Applied Cryptography' taken from Bruce Schneier, Wiley & Sons 1996 become.

US Pat. No. 6,199,049 B1 proposes to provide an electronic journal. In doing so the journal data in a non-volatile buffer Memory (NVRAM) accumulates and blocks on one Mass storage written outside of the cash register can be located. An incremental Checksum ('running message digest') formed. Their authenticity becomes cryptographic through signature creation secured, whereby an asymmetrical ('public key ') method is preferred and the public key with is saved in the file. So it will be one the known cryptographic procedures for securing integrity through cryptographic signatures on a journal file applied. That for the secure use of cryptographic Key management methods become necessary not described. It remains unclear how the secret Key is secured against spying and authenticity the public stored in the journal file Key is secured. Since the formation of the signature in the cash register itself, the operating software must continue secured against manipulation, for example by sealing the cash register. It is advantageous that the Journal file on an operationally removable memory, e.g. a diskette or an IBM Microdrive can be.

For backing up a journal in an unsecured one The control computer is not an application of the known methods unproblematic. If the cryptographic algorithms like other programs also run on the control computer of the cash register falsification of the data cannot be ruled out because the cryptographic signatures at all times can be formed again. This also applies if the formation of the signature by an autonomous and against Manipulation of secured cryptographic module takes place, as he is known from the neighboring area of ATMs is. It is then ensured that the secret Key is not exposed and that is why the singnature was formed in the cryptographic module. A appropriate manipulated control can still Provide manipulated data for signing.

US Pat. No. 5,136,646 describes a method with a time stamp on the document can be. For this, a hash function is placed on the document applied, the result of which is sent to a central office ('time stamping authority ', TSA) is sent, which one Timestamp and hash value of the previous registration adds a new hash and the result as confirmation. Every request is made at the TSA recorded and kept. This solution is obvious for cash registers and self-service systems because of permanent network connection and large amount of data in the TSA is not generally applicable.

This publication is described in US Pat. No. 5,978,475 taken up in relation to a journal called 'log'. It is found that this is a chain of signatures arises, the falsification of a certain Place require that all subsequent signatures be new be formed. This solution is also in cash registers and Self-service systems not applicable, as here too there is local falsification.

The above-mentioned task of tamper-proof storage of journal data with conventional rewritable Mass storage is solved by the invention in that that the cryptographic signature by the control program of the cash register or self-service station is formed immediately before printing. It deals are printers, especially receipt printers, which use receive an interface to print out data and then a cryptographically secure signature of this data return. The signature preferably includes one Sequence number or a timestamp.

Further features and advantages of the invention result from the following description, which in connection with the accompanying drawings, the invention using a Exemplary embodiment explained.

Brief description of the drawings

Fig. 1

schematisch den Aufbau einer Kasse mit kryptographisch gesichertem Journal.

Show it

Fig. 1

schematically the structure of a cash register with a cryptographically secured journal.

Description of an embodiment of the invention

1 shows the structure of a cash register schematically, in which the invention is used. The borders serve to represent the structure and do not imply any special modularization.

The cash register uses a control 10 and - not shown - Displays and input keyboards. It also includes one Interface 11 to which a cable 19 is connected.

With a modular structure using pluggable modules, the cable can 19 omitted.

A printer 20 for receipts belongs to the cash register. This one has an interface 24 corresponding to the interface 11 and a printing unit 21 for receipts. The printer also includes a controller 22 which is connected to both the interface 24 and is also connected to the printing unit 21.

There is also a cryptographic unit 30 in the printer contain a cryptographic processor 31 and a Key store 32 includes. The cryptographic unit is preferably constructed as a module, because in many cases describing the key store in a special secure environment and the module thus initialized, where the key (s) can no longer be removed are installed in the prepared printer. The latter can possibly only take place at the customer. Appropriately the module in the form of a chip card or a PCMCIA / PC-CARD Unity designed.

Included in the cash register 10 and in Fig. 1 only for the better A mass storage device 13 is shown outside, on which journal records 14 are stored.

The process of printing a receipt is as follows:

Data that is generated via operator inputs 15 a suitable (software) journal module 12 to the Interface 11 are passed on and from there on Cable 19 to interface 24 of the printer. she are divided into two data streams by the controller. The print data stream 25a arrives at the printing unit and is printed out. A mosaic printer is usually used as the printing unit used that the information to be printed out Composed of pixels. The conversion of the interface received coded (alphanumeric) into uncoded Pixel data occurs either in the controller 22 or in the printing unit 21.

The controller simultaneously routes the receiving data or a predetermined part thereof to be signed Data 25b to the cryptographic module 30. This determines a signature 26 about the data to be signed 25b and returns them to the controller, which controls them Data via interfaces 11 and 24 back to the checkout sends.

In the cash register 10, the journal module 12 receives the signature 26 and stores them together with those via the interface 11 data sent to the printer 20 in the journal file. The format of the storage is designed so that the signatures are easily assigned to the journal data can. The easiest way to do this is by using the signature is appended to the respective journal dates.

If the interfaces 11, 24 a fast Allow bidirectional transmission, as is the case with both Use of the 'universal serial bus' USB as well as the EPP variant of the conventional printer interface 'centronics' is the case, not only is preferred Signature, but the entire journal record transferred back. This has the programming Advantage that the purchase of data to be signed and Signature not only in the journal module 12 needs to be restored.

In a first, preferred variant, the printer control 22 determines which parts of the expression are relevant and are transferred to a journal data record. This can be done using control codes such as those known for formatting are used. These parts are made by the Printer control connected to a journal record and signed by means of the cryptographic module 30. thereupon the signature 26 is appended to the data record and this Complete journal record to the cash register for filing sent back to the mass storage device 13. In this like in the following variants only the printer is required certified, tested and against modifications of the operating software to be assured. The software of the actual Cash register 10 incl. Journal module 12 does not have to be modified be secured.

The signature is initially only the integrity of the individual Data record saved. For an electronic journal however, is the consistency and integrity of the overall inventory relevant. Therefore, in the above US patent 6,199,049 also the signature across the entire database of the journal. In particular, should prevent individual records are deleted without being noticed can.

A first solution according to the invention is in the Part of the journal record over which the signature is formed will also include the signature of the previous record, for example from the journal module in the record is inserted and, if necessary, taken from the journal file can be. It can then be easily inserted or deleted or both are easily recognized. (The simple manipulation of a single record is already made recognizable by the signature.) Should be part of a Manipulation deleting or inserting multiple records remain undetected, the following are not deleted Re-sign records, which is the case with the present Invention only by printing out the corresponding documents is possible. As will be described later, this can be done by an imprint of the signature or a 'fingerprint' of the same are encountered on the receipt. This is already a big one Solution offering counterfeit security has the Advantage that the printer and its cryptographic module do not need non-volatile memory.

Another solution is that the cryptographic Module or the sealed control of the printer has non-volatile memory. In this, for example the last signature saved and used Formation of the signature of the next data record also used are preferred, by inserting them into this data record. The The case of manipulation described above thus takes effect prevented.

A value can be used instead of the last signature can be saved, hereinafter referred to as the run number becomes. This run number is created after each creation passed a signature and flows during formation the signature. This is achieved by, for example the sequence number in a predetermined field of the data record is used before the signature is formed. If not the cryptographic module the whole, with the respective one Modified the run number and added the signature Returns record must at least for synchronization the current status of the cryptographic module the order number can be queried. Usually the solution look so that the record to be signed in the cryptographic Module is written. The cryptographic functions meanwhile form the signature, for which purpose a storage of the entire data set is not necessary. Subsequently the input becomes the saved sequence number switched and thus logically attached to the data record. The is then returned to the controller 22 Sequence number and the signature provided by the controller in turn appended to the record. It is irrelevant whether the data record is buffered in memory or already was sent back via the interface 24. As Sequence number is preferably a whole number increased by one Number used because it pauses the order the journal records are immediately visible. As good as can also use a pseudo-random number after the known one Modulo process (see e.g. the standard work of D.E. Knuth, The Art of Computer Programming) which creates a permutation of the integers. For a complete control of the journal file is required anyway the entire database will be checked so that control the sequence of the pseudo-random numbers does not matter falls.

Alternatively or additionally, the controller 22 or the Cryptography module 30 provided with a day clock, the respective status in the same way as a serial number in the Formation of the signature is included. This variant also has the advantage of quick verifiability the journal file. The printer control can also be designed in this way that the time and date do not depend on the Cash register 10 itself is placed in the data to be printed, but only substitute symbols are used for this are replaced by the printer controller becomes. In such a case, the return is the whole Journal record particularly useful. However then determine a procedure for setting the clock, the one Manipulation difficult. There is a simple solution in allowing only one actuation per 24 hours.

Another solution is that the adjustment processes in a diagnostic file of the printer or the cryptographic Module are stored and on request via the printing unit be printed out with a receipt. To this Art can also be any other special events, for example the overflow of the run number or the value of the last signature.

The count number, the timestamp or the combination of Both are also called serialization fields summarized.

For the formation of a signature there are a number of cryptographic ones Commonly known procedures using either work with one or two keys. First are too known as the 'private key' process. This will be the same Key to the formation of the signature as well as to its verification used. The signature can only be falsified as long as how the private key can be kept secret. This is the case, for example, if the cryptographic module 30 the key cannot be read out in the key store 32 stores, the control body writes it into the module and used a module in the exam in which there is an identical copy.

In a variant of the invention, the cryptographic Module and uses a random private key this then for signature. Should the signature be checked the cryptographic module is initiated, the Hand out the key and no longer use it, but to create a new one. Then this is useful if the electronic journal from a trustworthy Person copied from the mass storage and then is kept safe with other measures. The Journal can then be deleted from the mass storage. In this case, the expression with the associated, now no longer secret, key of the backed up copy of the Journals can be assigned.

If the processing power of the cryptographic module it allows the two different ones to be better Public key cryptography used. Here, the key to the formation of the signature must logically against reading from the cryptographic module 30 be stored securely. The second, public Keys, on the other hand, can be read out as desired and unprotected be disseminated, especially in the journal file be included. Again, it is an advantage if over a command the printer 20 can be initiated to the public Part of the key currently in use to output the printing unit 21. Because with the 'public key' Cryptography becomes the problem of secrecy through that (more manageable) problem that replaces authenticity of the public key is to be secured. By the method of expression on an otherwise against manipulation secured printer, this authenticity is simple ascertainable.

In the preferred embodiment, in which the cryptographic Module 30 is easily interchangeable Temporarily remove the inspector, in a separate one Device read the public key and thus then check the journal file. In this case, the cryptographic Module equipped with optical authenticity features be or via another key store and a cryptographic process for identity or authenticity control to prove authenticity.

The variant given above, in which the cryptographic Module forms the secret key itself as a random number, is essential when using 'public key' cryptography more applicable because the cryptographic module only equipped for the announcement of the public key have to be. There is no possibility, depending on the set private key or give it to the outside. It a module that is no longer prepared is then used and initiated via a special command, the previous one overwrite secret key with a new one and then output the associated public key. The public key can be issued as often as required be repeated. The public key is used if necessary in a message about commissioning passed on to the competent authority.

It is great in the formation of private keys Meaning that a random number that cannot be reproduced from the outside despite the deterministic function of the cryptographic Module can be formed because otherwise the search space essential for search of the secret key is reduced. This can be an extension of the invention are used at such a value constantly formed will and both the previous print and signature data as well as the times when this data is passed were, in terms of an internal clock in the random number incorporated. When it is newly formed, it simply does not readable value of this generator. Basically the cryptographic module is designed so that there is always a future one secret key or the required random number "in stock" and constantly on one of outside is difficult to understand modified.

In order to increase operational safety, a confirmation is sent the receipt of the signature by the journal module. Only after the journal module has received the journal data, storage on the mass storage included, the receipt is printed out. This prevents that in the event of memory problems, especially if the hard disk is full, receipts without Journal entry to be printed. This procedure corresponds the 'two-way commit' known from databases for secure Completing a transaction.

In other cases, a reverse approach may be desirable where the signature is only returned after the receipt is printed in full. This solution can can be combined with the previous one in two different Signatures are formed; one before and one after printing. Whether two keys are used or the Data record predetermined, at least by changing one bit or insert a time counter, is changed, the user left. The selection is based on which solution by the licensing authorities as appropriate is seen.

In all cases where the printer already has one Fiscal memory, it can of course be used be, run numbers, keys and other events stored securely.

For the purpose of securing the authenticity of a cryptographic, public key in particular is considered a Technique called fingerprinting used. A public one The key is usually more than 512 bits long and includes thus more than 90 characters in printable form. You educate however a hash value of e.g. 16 hexadecimal digits using a one-way function, this can be used order with high probability with different Keys to generate different hash values and so the direct comparison of the keys by comparing the to replace hash values used as a fingerprint. This Technology is applicable, for example, by the public Key is stored in the journal file. During the exam the journal file, which is already checked by another Program must be done, the fingerprint of the public key formed and displayed. The Examiner needs the fingerprint that he either brought with him or print out from the cryptographic module on the printing unit leaves. If the fingerprint matches, is with high probability the public key of the right keys. Without this measure, the entire public key can be compared. The application on the other cases described above where the authenticity of the key used must be secured, is similar.

A variant of the invention is in addition to that of Control delivered data on the receipt additional data provided by the cryptographic module. In the case of a meter number, this is meter number or the last digits of the count number. It can turn into a printed Document easily found the right journal entry become. The manipulation specified above when making entries deleted and the subsequent ones created and if necessary the printed receipts are destroyed is not here more possible because the count number differs significantly. The same applies if a fingerprint of the signing key is also printed out becomes. This is preferred for public closings applied. With private keys is a direct one Inference of the private key is not possible; however, the fingerprint allows, provided the hash algorithm is faster than the encryption itself, an acceleration of a direct attack.

So far, the description has referred to variants in which the print data alphanumeric characters, i.e. encoded data, and not pixels, i.e. uncoded data. This preferred version requires little space on the journal and facilitates the extraction of the data to be signed. It is also possible that the print data has already been rendered are and only represent pixel data. Here can the signature is formed over the entire receipt and if necessary the entire receipt can be saved in graphic form.

Another variant of the invention uses a printer, where both the printer control and the cryptographic module on a removable insert are housed, the whole against manipulation and regarding of the key store secured against spying is ('tamper resistant'). This module has a connection to the interface 24, via which encoded data is sent and an exit to the printing unit, through which Pixel data are sent. In this case the fuse is of the cable connections and a seal combined them Module against exchange in many applications unnecessary. Although the user can easily use the module exchange for another who prints the same receipts. However, such a module is not possible generate valid journal data since the module does not have has the secret key. In some areas of application This eliminates any sealing of interfaces and connections because the effort to recreate the module disproportionate to the possible gain from manipulation of the journal.

The CPU and the RAM remain outside the Module, such a module is preferred as a PCMCIA / PC card Can be designed with both a CD-ROM for the operating software as well as an interface for the provides cryptographic module. This is for the protocol used for the SCSI interface is well suited, because several devices of different types can be addressed are. Because the software and cryptographic module can be addressed separately are to be ensured by other measures that from the CPU only the programs stored on the module be carried out.

Based on journal storage, which acts as a filter module the interface 24 of the printer plugged in and then secured against exchange by sealing, this solution is also possible for the cryptographic module. For this purpose, a filter module with a simple control provided, which monitors the data stream to the printer and of the relevant parts through the cryptographic module have the signature formed as described and send it back or inserts into the print data stream.

The invention has the advantage that the journal file or Parts of the same copied at any time and via data carrier or Remote data transmission means can be sent. So can, for example, use a conventional floppy disk at the end of the day be created or at the end of the day the daily sales by remote data processing transmitted to the responsible tax office become. Any form of data backup is suitable to protect the journal against loss.

Claims (23)

Printer, especially receipt printer, which has a Interface then receives data to be printed about this data or a predetermined part of it forms a signature and at least the signature over the interface sends back. Printer, especially receipt printer, which has a Interface then receives data to be printed about this data or a predetermined part of it forms a signature and together with those on the Data to be printed out the signature or prints a fingerprint determined from it. Printer according to one of claims 1 or 2, wherein the Data over which the signature is formed in order to Printer serialization field added become. The printer of claim 3, wherein the serialization field or a predetermined part thereof via the interface is sent back. Printer according to one of claims 1 or 2, wherein the Data contain a serialization field, which in the Printer is checked and the formation of the signature incorrect serialization field is suppressed. A printer according to any one of claims 3 to 5, wherein the serialization field a sequential number or its Permutation includes. Printer according to one of claims 3 to 6, wherein the Printer includes an autonomous clock and in the serialization field a timestamp made with the clock is included. A printer according to any one of claims 3 to 7, wherein the serialization field or a predetermined part thereof is printed out. Printer according to one of the preceding claims, in which the last signature created on request is also sent back several times. Printer according to one of the preceding claims, in which an acknowledgment signal after the signature has been sent back expected for the successful storage of the signature and the expression of the receipt of the acknowledgment signal is determined. Printer according to one of the preceding claims, in which the signature is sent back after the data has been completely printed becomes. Printer according to one of the preceding claims, wherein the Printer a controller and a cryptographic unit which contains a secret key, and control those data about which a signature is to be extracted, extracted to the cryptographic Passes unit and receives the signature from it. Printer according to the preceding claim, wherein the cryptographic Unit is interchangeable and preferably is designed as a chip card. Printer according to the preceding claim, wherein the control, at least their program memory, and the cryptographic unit together in a common Module are housed, the tamper-proof is encapsulated. Printer according to one of the three preceding claims, the cryptographic unit using a signature forms a procedure in which the test is carried out via public key is done and includes a function by means of which the non-readable stored private key public key is readable. Printer according to the preceding claim, wherein the controller includes a function by means of which the public Key is read out and output via the printing unit becomes. Printer according to one of the two preceding claims, being instead of or in addition to the public key a fingerprint is issued. A printer according to any one of claims 12 to 17, wherein the cryptographic module comprises a function by means of a secret key in the cryptographic module is formed and saved. Printer according to the preceding claim, wherein a random value is provided by the operation of the module is constantly changing and in the formation of the secret Key is used. Printer according to one of claims 12 to 19, wherein the secret keys can be read out, however afterwards the formation of further signatures is blocked until the secret key is replaced. Filter module to provide a printer after a of the preceding claims, wherein the filter module Output that matches the input of the printer is connected, and an input instead of the Input of the printer occurs. Filter module according to the preceding claim, wherein the cryptographic unit is interchangeable and preferably is designed as a chip card. Filter module according to one of the two preceding claims, the filter module directly with the Interface of the printer forming connection connected is and means of sealing the mechanical Connection are provided.

Images