Classifications

• • G—PHYSICS
  • G07—CHECKING-DEVICES
  • G07B—TICKET-ISSUING APPARATUS; FARE-REGISTERING APPARATUS; FRANKING APPARATUS
  • G07B17/00—Franking apparatus
  • G07B17/00733—Cryptography or similar special procedures in a franking system
• • G—PHYSICS
  • G07—CHECKING-DEVICES
  • G07B—TICKET-ISSUING APPARATUS; FARE-REGISTERING APPARATUS; FRANKING APPARATUS
  • G07B17/00—Franking apparatus
  • G07B17/00733—Cryptography or similar special procedures in a franking system
  • G07B2017/00741—Cryptography or similar special procedures in a franking system using specific cryptographic algorithms or functions
  • G07B2017/00758—Asymmetric, public-key algorithms, e.g. RSA, Elgamal
  • G07B2017/00766—Digital signature, e.g. DSA, DSS, ECDSA, ESIGN
• • G—PHYSICS
  • G07—CHECKING-DEVICES
  • G07B—TICKET-ISSUING APPARATUS; FARE-REGISTERING APPARATUS; FRANKING APPARATUS
  • G07B17/00—Franking apparatus
  • G07B17/00733—Cryptography or similar special procedures in a franking system
  • G07B2017/00959—Cryptographic modules, e.g. a PC encryption board

Definitions

• the invention relates to a method for creating counterfeit-proof documents or data sets, key information being generated and encrypted checking information being formed from the key information and a transaction indicator.
• the invention further relates to a value transfer center and a cryptographic module.
• cryptographic module is used when creating the document.
• Such known cryptographic modules are distinguished by the fact that they contain electronic data or process data in their interior
• a cryptographic module can be viewed as a secure, sealed unit in which security-related processes can be viewed carried out that cannot be manipulated from the outside.
• a globally recognized standard for such cryptographic modules is the standard for cryptographic modules with the designation FIPS Pub 140 published by the US national authority for standardization NIST.
• a cryptographic module is used to create tamper-proof documents, the authenticity of which third parties are interested in, a common realization is that the cryptographic module is used to securely store cryptographic keys that are stored within the module and only there, serve to encrypt test values.
• So-called signature cards are known, for example, as are issued by certification authorities or trust centers for the creation of digital signatures.
• This signature card designed as a microprocessor chip card, also contains a cryptographic module in this microprocessor chip.
• Such modules usually contain one or more asymmetrical key pairs, which are characterized by the fact that encryption that is generated with the so-called private key can only be undone with the associated public key and that encryption that is created with the public keys are generated, can only be undone with the associated private key.
• public keys are intended for publication and distribution, whereas private keys may not be issued and, when used together with cryptographic modules, may never leave these modules.
• modules contain algorithms, for example for generating checksums or / in the example of the digital signature, for creating a so-called digital fingerprint or “hash value”, which is distinguished by the fact that it relates any data content to information that is generally significantly quantitatively shortened - art depicts that the result is irreversible and unambiguous and that different results are produced for different data contents with which the algorithm is fed.
• Such a digital signature is usually checked as follows: The recipient receives the document and the encrypted check value. The recipient also needs, and this is what the invention described later aims at, and uses the public key of the document manufacturer to decrypt the verifier that the document manufacturer had encrypted with his private key within the cryptographic module. After decryption, the recipient has the unencrypted check value. Furthermore, in the next step, the recipient applies the same algorithm for creating a check value to the received document. In the third step, the recipient finally compares the self-generated test value with the decrypted test value of the document manufacturer. If both test values match, the document has not been tampered with and the authenticity of the document has been proven beyond any doubt. In the case of known digital signatures, the authenticity of the document ' tested by the manufacturer.
• the public key of the document manufacturer is also digitally signed by a so-called certification body or "CA" and is assigned to a specific cryptographic module or a specific owner of the cryptographic module.
• CA certification body
• the recipient of the document takes the public key of the document manufacturer not simply given as given, but also checks that it belongs to the document manufacturer by checking the digital signature of the public key in the manner described above.
• this problem can be described using an example in such a way that in order to test the authenticity of a conventional digitally signed document, it is necessary to have the public key or the key certificate of the document manufacturer or its cryptographic module available during the check. If, as usual, documents from different document manufacturers are to be checked on a test part, it is necessary to have all public keys or all key certificates of all documents to have available.
• Attaching the key or key certificate is disadvantageous if. the scope of the document must be kept as ⁇ low and an attached key to would be printed, to be transmitted or processed record enlarge excessively.
• Storing a public key at the test center is particularly disadvantageous if access to keys stored at the test center is not possible due to practical or time considerations, for example with a very high number of keys that have to be accessed in a very short time ,
• German patent specification DE 100 20 563 C2 it is known from the applicant's German patent specification DE 100 20 563 C2 to generate a secret in a generic method in a security module, which encrypts the secret together with information that provides information about the identity of the security module hand over to a certification body, decrypt the secret in the certification body, thereby recognizing the identity of the security module, then the secret together with information to encrypt the identity of the document manufacturer in such a way that only one verifier can decrypt it and then transmit the secret to a document manufacturer.
• the document manufacturer enters his own data into the security module, the security module irreversibly linking the data himself brought in by the document manufacturer with the secret, and no conclusions about the secret are possible.
• This known method is characterized in that the result of the irreversible linkage of the data brought in by the document manufacturer with the secret, the data brought in by the document manufacturer and the encrypted information from the certification body form the document which is transmitted to the testing body.
• This known method is particularly suitable for producing and checking counterfeit-proof stamps of a postal company. Such stamps are generated by customers of a postal company using a personal cryptographic module and applied to the shipment as a machine-readable barcode. The machine-readable barcode has only a very limited amount of data and therefore does not allow the customer's public key to be included. In addition, in the so-called letter production, the digital stamps must be read and checked in the shortest possible time, which also eliminates the possibility of accessing a database of potentially many millions of public keys in a split second.
• the invention is based on the object of further developing a known method such that it can be carried out independently of direct communication between the cryptographically trustworthy contact point and the document manufacturer.
• this object is achieved in that the creation of the random key information and the formation of the encrypted check information from the key information and the transaction indicator take place in a cryptographically trustworthy contact point, that the cryptographically trustworthy contact point encrypts the key information, and that the encrypted check - Information and the encrypted key information are transmitted from the cryptographically trustworthy contact point to an intermediate point, so that the intermediate point temporarily stores the encrypted key information and the encrypted test information and at a later point in time from the transmission between the cryptographically trustworthy contact point and the intermediate point decoupled transmitted to a cryptographic module of a document manufacturer.
• the invention therefore provides that the cryptographic module is also supplied with two types of data when it is fed via an intermediate point, for example via communication partners that are not trustworthy in the cryptographic sense, which data remain on the one hand in the cryptographic module and on the other hand to the document appended, whereby the information remaining in the cryptographic module is used to secure the document information about a check value and the information transferred into the document is used to ensure that the document is secured by the Evidence of cryptographic module.
• the invention has a number of advantages. It enables the generation of forgery-proof documents in a large number of applications, especially in those cases in which there is no direct connection between the document ment manufacturer and the trustworthy contact point. For example, this makes it possible to create tamper-proof documents without the use of computers and / or a data connection to the trustworthy contact point.
• the key information is created by generating it randomly, although the invention can be carried out with a predefinable set of key information.
• the respective random generation of the key information is particularly advantageous because it avoids storing a large number of key information.
• the encrypted key information and / or the encrypted test information are such that they cannot be decrypted in the intermediate point.
• Decrypting the key information by the cryptographic module has several advantages. This makes it possible for a user of the cryptographic module, in particular a document manufacturer, to receive confirmation that they have received information from the trustworthy contact point, in particular money value information created by the trustworthy contact point. This also makes it possible for the cryptographic module to use the key information it contains for subsequent encryption. A preferred use of the key information is used to encrypt the document manufacturer's own data.
• the document manufacturer expediently transfers its own data to the cryptographic module in a process that is as automated as possible.
• a particularly preferred embodiment of the invention is characterized in that the cryptographic module irreversibly links the data introduced by the document manufacturer with the key information.
• the result of the irreversible linkage of the data introduced by the document manufacturer with the decrypted key information form a document and / or a data record which is transmitted to a test center.
• the encrypted test information is introduced into the document transmitted to the test center.
• the ones that remain in the cryptographic module Information is encrypted in such a way that it can be decrypted in the cryptographic module and that the information remaining in the cryptographic module is a value that is difficult or impossible to predict.
• the cryptographic module is supplied via cryptographically untrustworthy communication partners in such a way that an exchange of information within a dialog is not necessary.
• the cryptographic module is supplied via cryptographically untrustworthy communication partners in such a way that the forwarding of the information to the cryptographic module is time-decoupled.
• the cryptographic module is supplied by a trustworthy body, even if it is fed via cryptographically untrustworthy communication partners, on whose information the test center can rely.
• cryptographic encryption is used by a trustworthy body to provide trustworthy information for the cryptographic module, which the checkpoint can undo.
• the method is advantageously carried out in such a way that. that the tamper-proof documents or data records created contain monetary information.
• the monetary information is cryptographically linked to the document or the data record in such a way that a check value can be formed by a comparison between the monetary information and the document or the data record.
• the monetary information contains evidence of the payment of postage amounts.
• Another advantage is that the monetary information proving payment of a postage amount is linked to identification information from the document manufacturer.
• a very important field of application of the invention is the generation of postage indicia.
• Various intermediate points can be used in this essential application.
• a value transfer center from a franking machine manufacturer can be used as an intermediate point.
• Another object of the invention is a value transfer center with an interface for loading amounts of value.
• the value transfer center advantageously functions as an interface for receiving encrypted information from a cryptographically trustworthy contact point and for temporarily storing the received encrypted information.
• the information is encrypted in such a way that it cannot be decrypted in the value transfer center.
• a cryptographic module for generating counterfeit-proof documents with means for outputting encrypted test information and a test value is particularly advantageous.
• the cryptographic module contains at least one means for receiving and decrypting key information and at least one means for receiving a document or a data record, and that the cryptographic module has at least one means for generating a check value for the document or has the record.
• FIG. 1 shows the basic principle of a known cryptographic method
• FIG. 2 is a schematic diagram for a schematic representation of a generation of digital frankings
• Fig. 3 is a schematic representation of particularly preferred
• German patent DE 100 20 563 C2 a method for creating counterfeit-proof documents is known from German patent DE 100 20 563 C2, in which the need to use information from the cryptographic module of the document manufacturer for checking is eliminated. Instead, this method is based on the fact that a random number is formed in the customer's cryptographic module. The exact process with its three parties involved (1st document manufacturer with cryptographic module, 2nd verification body and 3rd trustworthy contact point) is shown in the attached FIG. 1. The numbers referred to in the following text re- late to the illustrated in Fig. 1 steps of • procedure.
• a random number is generated and stored in the cryptographic module of the document manufacturer (1), which, together with the identity or identification number of the document manufacturer or the cryptographic module, is transmitted in encrypted form (2) to a trusted location (3).
• This trustworthy body decrypts the random number and the identification number (4), checks the legality of the request (5) and then encrypts the random number and a newly formed transaction indicator in such a way that only the verifier is able to do so Undo encryption (6).
• the random number encrypted in this way and the transaction indicator are returned to the document manufacturer (7).
• the document manufacturer now enters the document to be secured in the cryptographic module (8).
• a test value is formed there using the plain text of the document and the random number that is still stored (9).
• the document is now transmitted in plain text, the encrypted random number transmitted by the trustworthy body and the encrypted transaction indicator, as well as the test information (10) generated in the cryptographic module.
• the authenticity is determined after a rough check of the document structure (11) by decrypting the random number and the transaction indicator that were encrypted in the trustworthy contact point (12).
• a test value is formed from the random number just decrypted (13).
• This test value is finally compared with the test value transmitted by the document manufacturer (14). If the two match, then it is ensured that the document was generated using a specific cryptographic module, since the required random number is only available there and this module has cryptographically secured exchange of information with the trustworthy contact point. Since, on the one hand, a certain cryptographic module was used and, on the other hand, the test value matches, both the identity of the document manufacturer and the authenticity of the document are ensured.
• the described method is used by Deutsche Post for the production of Internet stamps under the name "PC franking".
• PC franking the authenticity of the documents is checked without using key information. mations that are specific to the cryptographic module. Rather, the inspection body relies in part on information from a trustworthy contact point.
• a method for generating digital documents and data sets is created, which can take place without direct contact between a cryptographically trustworthy contact point and the cryptographic module, or a document manufacturer using the cryptographic module.
• the generation of the documents and data records is in no way limited to the generation of postage indicia or to postal items provided with postage indicia, the use of the method and device features shown in a method for generating digital postage is a particularly preferred embodiment of the invention.
• FIG. 2 The schematic model or the mode of operation of the new digital franking is shown in FIG. 2 outlined and described below:
• the postal company electronically provides the provider with machine-related information for future feeding into the digital franking machine.
• This information includes, among other things, key information for use in the machine and a so-called “ValidityString”, which is used for later Exam- used in the mail center as well as information on customer creditworthiness. Parts of this information are encrypted in such a way that they can only be decrypted within the franking machine.
• a default loading process is carried out between the customer's digital franking machine and the manufacturer's remote dialing specification center with the aim of increasing the available postage value in the franking machine.
• the machine-related information (previously provided by Deutsche Post) is also transferred to a tamper-proof area of the digital franking machine.
• Such a loading process in which the information (provided by the postal company) is transferred to the machine, should be carried out regularly within certain tolerances, for example once within a predeterminable time interval, for example monthly. If no new specifications are to be loaded, a corresponding communication process must be carried out once a month between the free stamp machine and the specification center, in which the information provided by the postal company is also transferred to the machine. Communication between the specification center and the digital franking machine must be secured in an appropriate and verifiable manner.
• step 3 After the default loading process (step 1), secure, electronic communication about the purchase of a certain postage amount for a customer takes place between the provider's default center and the postal company's Postage Point, which acts as a trustworthy contact point. With this data transfer, billing and usage information is transferred to the postal company. Since the provision of information for the next loading process described above can be done clearly in advance, it is possible, but not necessary, to combine steps 3 and 1, so that step 3 • the charging process just completed meets step 1 for the subsequent charging process.
• the postal company will invoice the customer directly by direct debit for the postage amount purchased from the trustworthy contact point, the postal company's postage point.
• the digital franking imprints contain a two-dimensional matrix code (2D barcode), which contains additional data which, as described in step 1, was made available in advance by the postal company and which is used in the letter center to check the validity become.
• 2D barcode two-dimensional matrix code
• mailpieces with digital franking imprint can be admitted, for example, mailbox, post office can be provided by the postal service opportunities'.
• the postage values loaded by the customer can be compared with the postage values read in the mail center.
• the key information m key is encrypted by the post company's Postage Point, which serves as trustworthy communication parts, in such a way that decryption is only possible in the tamper-proof the digital franking machine (cryptographic module) is possible.
• the test information VS which is already encrypted, can be transmitted to the franking machine or the cryptographic module without further transport encryption. By encrypting the key information m ⁇ y , decryption is only possible in the cryptographic module of the franking machine, but not on the untrustworthy communication path.
• FIG. 3 shown schematically:
• key information is formed in a trustworthy contact point, which corresponds in practice to the postage point of the postal company. This key information will later be used in the cryptographic module to create a test value. It makes sense to keep this key information later in the cryptographic module and will not leave it.
• a so-called test information is created. This is compiled from the key information from step 1, a transaction indicator that contains additional information about the customer's next charging process, and further information.
• the compilation and subsequent encryption of these elements of the test information takes place in such a way that only the test body is later able to undo this encryption.
• the compilation and subsequent encryption of these elements of the test information also takes place in such a way that even with knowledge of the key information in plain text, which, however, is theoretically outside the trustworthy contact point and outside of the cryptographic module is hardly possible, a detection of the key for encrypting the test information for subsequent decryption at the test point is avoided.
• the key information generated in the first step is encrypted in such a way that decryption can only take place in the cryptographic module at the document manufacturer, but not on the transmission route to it.
• a fourth step the two types of information are transferred, preferably together with other information that further increases the security against manipulation, about the upcoming charging process of the customer.
• this is the key information created in step 1 and encrypted in step 3, which is later loaded into the cryptographic module, decrypted there and also remains there for the creation of tamper-proof documents.
• this is the encrypted check information formed in step 2, which can only be decrypted by the checkpoint and which is appended to each document that is later created by the document manufacturer.
• Information that is relevant in the context of this invention, together with other information about the upcoming charging process of the customer, is temporarily stored in the untrustworthy location. It is not possible to decrypt the two relevant types of information at this point. In particular, is a detection of the key that was used in the trusted agency to the. Encrypting test information in such a way that only the test center can decrypt it again, if only because the clear text of the key information, which would be necessary for such a so-called clear text tack, is not available. 6. In a sixth step, the information provided by the trustworthy body is decoupled in time, for example as part of the next loading process, and transferred to the cryptographic module at the document manufacturer.
• the seventh step indicates communication between the untrustworthy entity and the cryptographic module, which is preferably secured cryptographically by additional suitable means.
• the practical implementation involves communication between a manufacturer's default center and its franking machine with cryptographic module, which must be protected against manipulation due to the electronically exchanged loading amount. If this communication had not been protected, an unauthorized increase in the loading amount would be possible. Therefore, only in the sense of this invention does the manufacturer's default center count as an "untrustworthy" place. In practical implementation, the default center can be classified as trustworthy.
• the key information which was encrypted in step 3, is decrypted and then stored. This key information will be used later to secure documents by creating a check value. To avoid the plaintext attacks mentioned above, it is important that the key information cannot be read from the cryptographic module, but is only used within the module by processes that are also included.
• Test information from step 2 saved. Since this information is already encrypted and is no longer required in the cryptographic module for data processing, its storage is outside the cryptographic module possible. The encrypted test information is later attached to each saved document for use in the test center.
• the customer or document manufacturer enters the content of the document to be secured into the cryptographic module.
• Plain text information of the document using the key information still stored from step 1 is a test value.
• the formation of the test value takes place using a standard test value method, e.g. MAC, HMAC symmetrical signature etc.
• MAC MAC
• HMAC symmetrical signature
• a common feature of several particularly preferred embodiments is that the plain text of the document is usually shortened irreversibly and is encrypted simultaneously or subsequently with a key, in this case the key information from step 1.
• the overall document preferably consists of several, in particular three ingredients.
• a first component is the actual plain text information of the document.
• the encrypted check information from step 2 is appended to the document text, which was stored in step 9 in the cryptographic module or outside the module and from then on is added to each document to be secured.
• the test value formed in step 11 is attached as a third component of the overall document.
• the document reaches the inspection agency, where it is checked for structural completeness and integrity. In the specific application of the invention for checking postage indicia, further conclusiveness checks can also take place at this point. Find. In this case, since the secured document corresponds to the machine-readable franking mark, this can be used against other mailing information such as address and postal address. Type of delivery and general information such as the date are checked. In this way it can be excluded that a valid franking mark is used to frank a consignment that does not match this franking mark.
• test information encrypted in step 2 is decrypted again.
• the test information which is composed of several components, is broken down into its components again.
• the key information and the transaction indicator are obtained in particular. The latter can serve as an additional check. For example, the identity of the customer or document manufacturer stored in the transaction indicator can be compared with a positive list of desired document manufacturers or a negative list of undesired document manufacturers stored in the test center.
• a test value is created in analogy to step 11. Following the same procedure as in step 11, the plain text information of the document that is present in the checking station is now extracted using the key information just decrypted
• Step 14 formed a test value. If different methods for creating test values can be possible in the cryptographic module, the specific choice of the method must also be appended to the document or in the document from the document manufacturer to the test center.
• test value created in the cryptographic module and attached to the document is compared with the test value created in the test center. Only if both test values match it is guaranteed that the document was created by the document manufacturer using the cryptographic module.
• the invention makes it possible to generate tamper-proof documents and to reliably check the authenticity of the data contained in the document and / or the identity of the document manufacturer.
• test information required for this is preferably provided by the trustworthy contact point and / or the cryptographic module.
• the invention is suitable for the production of any documents. However, it is particularly advantageous to use the invention for generating digital documents of a relatively small amount of data in the order of magnitude of a few bits up to documents with a total size including checking information up to approximately 60 bytes. Particularly preferred documents within the meaning of the invention are validity notes for a large number of application areas. It is particularly advantageous to use the invention for checking digital postage indicia for postal items, since it enables the postage indicia to be generated particularly quickly and easily. It can also be used for other areas as proof of payment of money amounts - digital tokens - or as another carrier of money value information.
• the invention is particularly suitable for all applications where in addition to the document creator at least one auditor have an interest in the integrity of the réelles- '.
• the invention is suitable for wide areas of application, in particular for the creation of digital tokens for a large number of areas of application, for example as flight tickets, tickets, theater or cinema tickets.
• such documents can be printed out by the document manufacturer himself, it being possible for the document manufacturer to use existing credits - or loan amounts - for this purpose and in this way receive reliable proof of the payment.
• documents can be generated, for example, using a conventional personal computer or a cryptographically unsecured printer.
• a particular advantage of the invention is that the creation of the documents can take place without a connection between the generation of the documents without a direct connection between the document manufacturer and the trustworthy contact point.
• document production is also possible with the interposition of one or more intermediate points, or with communication via data paths that are cryptographically impossible or difficult to secure.
• the cryptographically trustworthy contact point and / or the test center receive means to ensure that no unauthorized documents have been generated or that no documents have been falsified. This makes it possible to a 'particularly simple and reliable way to generate testable secure digital documents and to verify those documents reliably.
• Such a check can be carried out in various ways, the cryptographic process steps mentioned being simple and reliable to use.
• the means and method steps shown according to the invention can also be applied to documents which are also encrypted before or during the creation of the counterfeit security in the sense of this invention.
• the method is preferably not applied to an unencrypted plain text, but rather to an encrypted text, but the methods of this invention do not differ.
• the encryption it would also be possible for the encryption to also take place in the cryptographic module and thus, as shown in FIG. 3, an intermediate step of the encryption to take place between steps 10 and 11 described here.

Priority Applications (1)

Applications Claiming Priority (3)

Publications (2)

Family

ID=27815639

Family Applications (1)

Country Status (17)

Families Citing this family (3)

Family Cites Families (21)

• 2002
  • 2002-03-13 DE DE10211265A patent/DE10211265A1/de not_active Withdrawn
• 2003
  • 2003-03-10 PL PL03373765A patent/PL373765A1/xx not_active Application Discontinuation
  • 2003-03-10 JP JP2003577477A patent/JP4286150B2/ja not_active Expired - Fee Related
  • 2003-03-10 RU RU2004126947/09A patent/RU2323531C2/ru not_active IP Right Cessation
  • 2003-03-10 DE DE50301269T patent/DE50301269D1/de not_active Expired - Lifetime
  • 2003-03-10 ES ES03722214T patent/ES2250889T3/es not_active Expired - Lifetime
  • 2003-03-10 AU AU2003229491A patent/AU2003229491B8/en not_active Ceased
  • 2003-03-10 DK DK03722214T patent/DK1486028T3/da active
  • 2003-03-10 AT AT03722214T patent/ATE305684T1/de not_active IP Right Cessation
  • 2003-03-10 WO PCT/DE2003/000760 patent/WO2003079609A1/fr active IP Right Grant
  • 2003-03-10 CN CNB038082381A patent/CN100473004C/zh not_active Expired - Fee Related
  • 2003-03-10 EP EP03722214A patent/EP1486028B1/fr not_active Expired - Lifetime
  • 2003-03-10 CA CA002479144A patent/CA2479144A1/fr not_active Abandoned
  • 2003-03-10 US US10/506,908 patent/US7409062B2/en not_active Expired - Fee Related
  • 2003-03-10 NZ NZ535247A patent/NZ535247A/en unknown
• 2004
  • 2004-09-10 ZA ZA200407274A patent/ZA200407274B/en unknown
  • 2004-10-08 NO NO20044277A patent/NO20044277L/no not_active Application Discontinuation
• 2005
  • 2005-05-18 HK HK05104169A patent/HK1071488A1/xx not_active IP Right Cessation
• 2008
  • 2008-01-03 US US11/968,919 patent/US20080109359A1/en not_active Abandoned

Non-Patent Citations (1)

Also Published As

Similar Documents

Legal Events