FR2787899A1 - DEVICE AND METHOD FOR PROTECTING SENSITIVE DATA AND POSTAGE MACHINE USING THE SAME - Google Patents

Abstract

The invention concerns a method for protecting data sensitive to the use of a routine acting on the data. It comprises an operation, performed by said routine, an operation which consists in verifying the identity of each software task invoking said routine (400). Preferably, said verification operation (400) comprises an operation which consists in reading an identifier of said task (304) and an operation which consists in comparing (305) said identifier with predetermined identifiers.

Description

The present invention relates to a device and a method for

  protection of sensitive data and a franking machine using them. It applies in particular to franking machines provided with a program executing in a multitasking environment and more generally to the protection of sensitive data, representing for example, sums of money, or of sensitive tasks handling the sensitive data. In a multitasking environment, each task can call each routine, whatever security is necessary on said routine. In a franking machine, certain tasks use amounts representing sums of money. In particular, the operating phases of a franking or recharging machine use the routines which

handle sums of money.

  The correct implementation of each of these tasks must be guaranteed. By correct implementation is meant the fact that a task is executed in the normal course of operation of the machine. In other words, the invention aims to prevent sensitive data from being altered or

inappropriately changed.

  To this end, the present invention aims to ensure that at least one routine

  acting on sensitive data verifies the identity of tasks which call upon it.

  Thus, if an unauthorized task tries to use said routine, it can limit its execution and therefore avoid damaging the data

sensitive considered.

  According to a first aspect, the present invention relates to a method for protecting sensitive data against the use of a routine acting on said data, characterized in that it comprises, implemented by said routine, a verification operation of identity of each software task

calling said routine.

  Thanks to these provisions, if an unauthorized task is used to access said routine which uses sensitive data, by verifying its identity, this routine detects that it is not authorized and prevents access to

sensitive data considered.

  In the case of a franking machine, for example, the routines concerned include the routine of incrementing the postage amount counter consumed and decrementing the postage amount counter remaining available and the counter incrementing routine

  number of postage made.

  According to particular characteristics, said verification operation comprises an operation of reading an identifier of said task and an operation of comparing said identifier, on the one hand, and of identifiers

predetermined, on the other hand.

  Thanks to these provisions, all the tasks authorized to carry out the routine in question are identified in a particular list, which

  facilitates the programming of the routine and the updating of this programming.

  According to other particular characteristics, each routine acting

  on said data implements said verification operation.

  Thanks to these provisions, whatever the routine that attempts to access sensitive data, the protection offered by the present invention

is ensured by said routine.

  According to a second aspect, the present invention relates to a device for protecting sensitive data against the use of a routine acting on said data, characterized in that it comprises a verification means suitable for verifying the identity of each software task calling said routine the

  means of verification being implemented by said routine.

  The invention also relates to a franking machine, characterized in that

  that it includes a device as succinctly set out above.

  The invention also relates to: - a means of storing information readable by a computer or a microprocessor retaining instructions of a computer program characterized in that it allows the implementation of the method of the invention as briefly described above, and - a removable information storage means, partially or totally, and readable by a computer or a microprocessor keeping instructions of a computer program characterized in that it allows the setting

  using the process of the invention as succinctly described above.

  This device, this franking machine and these storage means having the same particular characteristics and the same advantages as the process succinctly described above, these advantages are not

recalled here.

  Other advantages, purposes and features will emerge from the

  description which follows, made with reference to the appended drawings in which:

  - Figures 1A and lB show, respectively in top view and in elevation, a franking machine implementing the device and the data protection method objects of the present invention, - Figure 2 shows, schematically, an electronic circuit incorporated in the franking machine illustrated in FIGS. 1A and 1B, and - FIG. 3 represents an algorithm for operating the circuit

  electronics illustrated in figure 2.

  The franking machine 1 illustrated in the drawings (FIGS. 1A and 1B) comprises a device for printing, on a flat object such as the letter 2, on the one hand, a franking mark and, optionally, an address for

destination of the envelope.

  To print the franking mark on the standardized space provided for this purpose, it is necessary to pass the letter 2 through a corridor 5 that comprises the machine 1, this corridor being delimited by elements integral with the frame, respectively a sliding support. 6 which forms the ceiling of the corridor, a table 7 which forms the floor and a ramp which forms a limit

  lateral, the corridor being open opposite this ramp.

  To pass the letter 2 in the corridor 5, the letter is placed on the part of the table 7 which projects from the side provided for the introduction (side which we see on the left in Figure 1B) then we enter the letter in the corridor 5, as shown in FIGS. 1A and 1B, until it is driven by the means provided for this purpose in the machine 1, the printing of the franking mark being effected automatically during that the letter 2 is driven in lane 5, the franked letter being expelled from the machine

  the other end of lane 5 (end which can be seen on the right in FIG. 1B).

  To drive the letter 2, the machine 1 has two rollers 9 and 10 each passing through an opening of the table 7, and two countergalets 12 and 13, respectively for the roller 9 and for the roller 10, passing through

a support opening 6.

  The rollers 9 and 10 are mounted for rotation relative to the frame of the machine 1, by means of suspension means 14 shown diagrammatically in FIG. 1 B. The counter-rollers 12 and 13 are mounted for rotation on the frame of machine 1, without being suspended from it. An electric motor, not shown, serves to drive the counter-rollers 12 and 13 in synchronous rotation, for example by means of a belt (not shown) which rotates around three pinions carried respectively by the motor, by the counter-roller.

12 and by the counter-roller 13.

  Since the suspension means 14 urge the rollers 9 and 10 towards the support 6, and therefore towards the counter-rollers 12 and 13, the rollers 9 and are driven by friction on the counter-rollers 12 and 13, directly or by through an object, such as the letter 2, being passed through the

machine 1.

  The letter 2, when it is introduced into the corridor 5 as shown in FIG. 1B, ends up meeting the roller 9 then the counter-roller 12 which drives it in the direction indicated in FIG. 1B by the oriented horizontal arrow of left and right. Simultaneously, the roller 9 is lowered while the letter 2 is introduced between the rollers 9 and 12 so that the letter 2 progresses in the machine 1 with its printing face 4 which is pressed and which slides against the surface 17 of the sliding support 6. To print the postage mark at the standardized location which corresponds to it and / or the destination address at the standardized location which corresponds to it, the machine 1 comprises printing means

  19 shown very diagrammatically in FIGS. 1A and 1B.

  In general, the printing means 19 deposit the franking mark while the letter 2 or the article to be franked circulates in the machine 1 with its printing face which is pressed against the surface 17 of the sliding support. 6, the means 19 being located between the counter-rollers

12 and 13.

  In the example illustrated, the printing means 19 are mounted directly on the frame of the machine, and are therefore fixed relative to the support

sliding 6.

  So that the printing means 19 are controlled in synchronism with the advancement of the object in the machine, there is a detector for the presence of the object (referenced 110 in FIG. 2) which triggers a

  printing process taking place automatically.

  More specifically, there is a first presence detector which controls the starting of the engine (not shown) when an object begins to be introduced into the machine 1, and a second presence detector (not shown) which triggers the process of impression when

  the object has reached a predetermined location.

  In Figure 2, there is shown an electronic circuit for controlling the device as shown in Figures 1A and IB. This circuit is illustrated in the form of a block diagram and represented under general reference 100. It comprises, interconnected by an address and data bus 102: a central processing unit 106; - a random access memory RAM 104; - ROM 105; - an input port output 103 used to receive: The weight of the postal object to be franked, and the detection of the postal object by each of the detectors (not shown in the figures) and to transmit: control signals from motors, and and, independently of the bus 102: stepping motors 109; - presence detectors 110; - a display screen 108 connected to the input / output port 103; - a scale 112 connected to the input / output port 103 and providing bytes representative of the weight of a postal item; - a keyboard 101 connected to the input / output port 103 and providing bytes representative of the keyboard keys successively used; and a print controller 120 which controls the operation of the

printing facilities 19.

  Each of the elements illustrated in FIG. 2 is well known to those skilled in the art of postage meters having a microprocessor circuit and, more generally, information processing systems. These elements

are therefore not described here.

  The random access memory 104 stores data, variables and intermediate processing results, in memory registers carrying,

  in the following description, the same names as the data they

  keep the values. The random access memory 104 notably comprises registers keeping information representative of the weight of the postal object to be franked, the format of the postal object being processed, the number of postal objects in the batch being processed, values up and down counters which correspond to postage amounts already deposited and remaining to be deposited before reloading the machine. These latter registers operate according to techniques known in the field of franking machines (during each franking, when the amount of the down counter is greater than the amount of the franking mark to be deposited, it is decremented by the amount of this mark and

  the ascending counter is incremented by the same amount).

  The read-only memory 105 is suitable for keeping the operating program of the central processing unit 106, in a register "programl", and the data necessary for the operation of this program as well as the correspondence table relating weights, d 'a part,

  to postage amounts, on the other hand.

  The read-only memory 105 keeps, in addition, in a register "list of identifiers", a list of identifiers of software tasks authorized to access the routines which use sensitive data (here amounts of postage). In fact, the so-called “dead” memory 105 is a rewritable memory which does not erase when the device is switched off. It can only be rewritten according to secure procedures and only by certain authorized persons, so that, for the daily user, it appears as a

dead memory.

  The central processing unit 106 is suitable for implementing the program kept in read-only memory 105, a program including an algorithm for

  operation is illustrated in figure 3.

  The postage meter program or software is multitasking software, which involves allocation, by the processor, of memory space, or stack, associated with each task. This memory space is contained

in RAM 104.

  During an operation 301 - the electronic card 10 is initialized by the central processing unit 106, according to known techniques, and the central processing unit 106 assigns an identifier (constituted here

  a number) for each task in the application.

  During an operation 302, the central unit 106 executes a part of a program requiring no call to a routine using sensitive data. During an operation 303, the central unit 106 implements a

  task that uses one of the routines that use sensitive data.

  During an operation 304, the routine 400 considered (represented in broken lines) reads the identifier of the task in progress by using a routine called "system" of known type,

intended for this reading.

  Then, during a test 305, the routine 400 compares the identifier of the task with the content of the list of identifiers kept in read-only memory

  and determines if this task identifier is in the list.

  When the result of the test 305 is positive, the task is authorized to access the routine and the use of sensitive data is executed, during an operation 306. Then the central unit 106 returns to operation

shown in 302.

  When the test result 305 is negative, the task is not authorized to access the routine. The operation of the central unit 106 is then stopped and an alarm is triggered, operation 307, until the

  franking machine is switched off, operation 308.

  It is understood that the method of protecting sensitive data against the use of a routine acting on said data aimed by the present invention comprises, implemented by said routine, an operation 400 of

  identity verification of each software task calling said routine.

  It is easy to understand that, thanks to the organization of the task 400, and, in particular, thanks to the monitoring of the identity of the tasks which call upon it, the modification of the sensitive data, by means of this routine is

impossible.

  As a variant, the routines 400 (that is to say those which verify the identity of the task calling them before making access to sensitive data) include not only the routines which access the postage amount counters , but also routines acting on data

  metering or operating parameters of the franking machine.

  In the embodiment described and shown, said verification operation 400 comprises an operation of reading an identifier of said task 304 and a comparison operation 305 of said identifier, on the one hand, and

  of predetermined identifiers, on the other hand.

  In the embodiment described and shown, each routine acting on sensitive data implements said verification operation 400. The device for protecting sensitive data against the use of a routine acting on said data, characterized in that it comprises, as a means of verification the central unit 106, associated with memories 104 and 105, for verifying the identity of each software task calling said routine, this

  means of verification being implemented by said routine.

Claims (7)

  1. A method of protecting sensitive data against the use of a routine acting on said data, characterized in that it comprises, implemented by said routine, an operation of identity verification of each software task calling said routine (400). 2. Protection method according to claim 1, characterized in that said verification operation (400) comprises an operation of reading an identifier of said task (304) and a comparison operation (305)   said identifier, on the one hand, and predetermined identifiers, on the other hand.   3. Protection method according to any one of the claims   1 or 2, characterized in that each routine acting on said data puts   implementing said verification operation (400).   4. Device for protecting sensitive data against the use of a routine acting on said data, characterized in that it includes verification means (104, 105, 106) adapted to verify the identity of each calling software task said routine, the verification means being implemented work by said routine.   5. Protection device according to claim 4, characterized in that said verification means (104, 105, 106) comprises means for reading (104, 105, 106) of an identifier of said task and a comparison means ( 104, 105, 106) of said identifier, on the one hand, and predetermined identifiers, on the other hand.   6. Protection method according to any one of the claims   4 or 5, characterized in that each routine acting on said data puts   using said verification means (104, 105, 106).   7. Franking machine (1), characterized in that it comprises a   device according to any one of claims 4 to 6.