WO2001097441A2 - Method, systems and computer program for reducing hacking susceptibility - Google Patents
Method, systems and computer program for reducing hacking susceptibility Download PDFInfo
- Publication number
- WO2001097441A2 WO2001097441A2 PCT/EP2001/006668 EP0106668W WO0197441A2 WO 2001097441 A2 WO2001097441 A2 WO 2001097441A2 EP 0106668 W EP0106668 W EP 0106668W WO 0197441 A2 WO0197441 A2 WO 0197441A2
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- private
- encryption key
- public
- viability
- time
- Prior art date
Links
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/30—Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
- H04L2209/12—Details relating to cryptographic hardware or logic circuitry
- H04L2209/127—Trusted platform modules [TPM]
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
- H04L2209/56—Financial cryptography, e.g. electronic payment or e-cash
Definitions
- the present invention relates in general to data processing systems, and in particular, to fiscal printers that contain hardware for collecting and storing information used for tax collection purposes.
- point-of-sale terminal (cash register) printers must have additional hardware that collects and stores that cash register's sales totals data for reporting to the government, for tax collection purposes. These printers are known as “fiscal printers”.
- the additional hardware in the fiscal printer that collects and stores these totals is tamper-evident (has features which show tampering) , which is accepted by these governments as “secure”.
- This secure hardware controls print requests to the customer receipt print station from the terminal's application program, and it also generates printing itself, based on certain circumstances. All printing on customer receipts is also either printed on a separate "journal” paper roll, or stored electronically inside the secure hardware.
- the public key can be printed on the receipt printer as a trusted method of revealing the public key for use in signature authentication.
- Any encryption algorithm's private key can be determined by employing enough time and money to the effort. The larger the private key, the more difficult it is to determine, but a larger private key also takes longer to legitimately encrypt a signature within the fiscal printer. The goal is to use a private key small enough to be practically manageable, but large enough to be impractical to "hack".
- the present invention provides a method to automatically and continuously reduce hacking susceptibility of data from an output device comprising the steps of: generating within said output device a private/public encryption key pair; calculating a viability time for said private/public encryption key pair; selectively publishing a public encryption key of said private/public encryption key pair while keeping a corresponding private encryption key stored in secured hardware in said output device; modifying said viability time based on inputted parametric data; and modifying said private/public encryption key pair based on comparison of a real time date to said viability time.
- the present invention also provides a computer program comprising program code adapted to perform the method as described in the previous paragraph .
- the output device's private key is small enough to allow for as fast a signature encryption as possible and secure enough to make it impractical to break the key, for the life of the device, without requiring manual intervention of every device installed.
- a method and system are disclosed for optimizing the security of information generated by an output device. While private/public key encryption has been used, the present invention preferably discloses a method and system for applying this encryption technique to systems where employing latest technology may not be the most effective system.
- Output devices have hardware that is tamper-evident and as such are accepted by certain governments as secure .
- Embodiments of the present invention extend this hardware with circuits and components that allow a private/public key pair to be generated once during manufacture and will cause erasure of the private key if the security of the hardware is broached without authorization.
- Embodiments of the present invention incorporate algorithms internal to the secure hardware that calculate the viability of a given length of private/public keys based on inputted parameters which include length the code has been in existence, technology advances and other factors with the intent of optimizing the length of time to encrypt as well as insuring a commensurate security level with the economic risk of unauthorized private key discovery.
- the present invention further provides a system for automatically and continuously reducing hacking susceptibility of data from a output device comprising: an algorithm circuit for generating a private/public encryption key pair internal to secure hardware of said output device; a viability time circuit for calculating a viability time for said private/public key pair; a public circuit for sending a public key of said generated private/public key pair external to said output device; a first modifying circuit receiving inputted parametric data, said first modifying circuit operable for modifying said viability time using said inputted parametric data; and a second modifying circuit operable to change said generated private/public key pair based on a comparison of a real time date to said viability time.
- the present invention further provides a data processing system, comprising: a central processing unit (CPU) ; shared random access memory (RAM) ; read only memory (ROM) ; an I/O adapter; an output device system as described in the previous paragraph; a display adapter; and a bus system coupling said CPU to said ROM, said RAM said display adapter, and the output device system described in the previous paragraph.
- CPU central processing unit
- RAM shared random access memory
- ROM read only memory
- I/O adapter an output device system as described in the previous paragraph
- display adapter a display adapter
- a bus system coupling said CPU to said ROM, said RAM said display adapter, and the output device system described in the previous paragraph.
- the output device is a fiscal printer.
- FIG. 1 illustrates a table having date, cost and time to break or hack a private key
- FIG. 2 illustrates a flow diagram of method steps in an embodiment of the present invention
- FIG. 3 illustrates a system block diagram of an embodiment of the present invention
- FIG. 4 is a system block diagram used in conjunction with embodiments of the present invention.
- private, public or private/public keys may be used synonymously to mean private, public, or private/public encryption keys.
- the word encryption may not be used in all cases for the sake of brevity.
- Encryption involves the encoding and decoding of information by use of an algorithm.
- private/public key encryption there are two "keys".
- the public key is made available for use by anyone who wants to send a message to the owner of the private key.
- the sender uses the public key to encrypt the message which can then only be decrypted by use of the private key.
- the private key may also be used to encrypt a message which can be decrypted by anyone with access to the public key.
- the primary purpose of the private/public key encryption is to maintain message integrity in the sense that the message can be identified as having originated from the person with access to that private key, that is, authorship integrity. To some degree it also protects the security of the information in transit, although it may be read by anyone, in addition to the addressee, who has the sender's public key.
- the public key is not public in the sense that it is broadcast to everyone, it is public in that it is given only to those with authorized access to a secured fiscal printer.
- the fiscal printer now (e.g., by algorithm) destroys the old private key and sends a message encrypted with the new private key to holders of the new public key instructing these holders to destroy the old public key.
- a secure link is now established.
- Hardware 302 has been accepted as secure by governments requiring fiscal printers if the hardware is tamper-evident (has features which indicate tampering) or has locking measures in place.
- the secure hardware in the fiscal printer has in one embodiment features that destroy the private key if it is tampered with and forces an intervention to reset the breached communication link.
- a private/public key pair is generated at the time of installation.
- the public key is extracted and then the hardware is secured. Since the public key is in the hands of a "trusted" source and the private key is in the secured hardware secure communication can be transacted by the "trusted" source and the fiscal printer secured hardware. Since the private key, generated at this time, is available only to the hardware 302, secure communication can be established to the hardware 302 via the public key encryption (only the hardware can read the input) to input data (e.g., Input data 303) necessary for the hardware to execute security routines of the preferred embodiment.
- input data e.g., Input data 303
- the secure hardware has read once inputs (the secure hardware accepts an external command from these inputs only once) that direct the hardware to generate a first private/public key pair at manufacturing time.
- the public key so generated is made available for additional communication such as reading in parameters pertinent to algorithms of the preferred embodiment as well as commanding the hardware to generate a new private/public key pair.
- the read once inputs allow a first time start or power up, provided the hardware 302 is secured.
- the generated private key is erased and internal circuitry would have to be replaced before a new power up and another read once could be commanded.
- the report generating hardware 307 encrypts a signature for the entire tax reports with an installation generated private key
- journal printing station 309 likewise prints a record of all entered transactions with an encrypted signature (encrypted by a private key ensuring the source is known and verifiable by an authorized holder of the corresponding public key generated at installation) insuring it was the product of the fiscal printer 306 generating a particular private/public key pair.
- a system such as the one described in embodiments of the present invention, could preferably be defeated only by "hacking" the private key or by attempting to break into the secure hardware 302 of the fiscal printer 306 which in embodiments of the present invention destroy the private key and require a hardware installation too once again establish the integrity of the fiscal printer system.
- the preceding has detailed how a private/public key system may be used to ensure that the information from a fiscal printer, data or just a digital signature, may be verified as to its source (whether a particular fiscal printer is the source) .
- the present invention preferably provides for a way to allow a fiscal printer's logic in the secure hardware to automatically change its private/public key pair periodically.
- the fiscal printer microcode does not simply change its key pair at regular intervals. Rather it uses an algorithm that takes into account the changes in technology to always stay one step ahead of a hacker, while remaining as efficient as possible to legitimately encrypt a signature or data.
- this algorithm is written into the fiscal printer's microcode at manufacture time.
- the parameters for the algorithm are data from publicly available encryption industry estimates of time and money needed to break a key of a certain length (over the life of the printer) , along with estimates of how much tax money could be saved by creating false tax reports (e.g., signed with a hacked private key) for a particular fiscal printer (over the life of the printer) .
- a hypothetical example of an industry estimate of the time required to break a key length of 128 bits might look like the chart in FIG. 1. Similar industry estimates may be determined for a 256-bit key, a 764-bit key, a 1024 bit key, etc. Obviously the larger the key size, the longer it takes and the more expensive it is to break the key.
- the proposed algorithm takes this information for all key sizes, along with estimates of maximum taxes collected from any particular fiscal printer per year, and using the fiscal printer's built-in real-time clock 301, the algorithm estimates the life or viability time of the security of a particular private key at any point in time. In one embodiment the algorithm calculates the viable secure lifetime expectancy of a 128-bit private key put into service on a particular date. The algorithm in the secure hardware 302 continuously tests the 128-bit key's viability using updated information provided using a present public key. If the printer's microcode determines that the present key is not viable because of the length of time the present key has existed, in one embodiment it generates a new 128-bit key pair, which has a life expectancy that is again viable.
- the analysis may determine that generating a new 128-bit key is not viable and the secure hardware 302 automatically generates a new, longer, 256-bit key that is good for a viable period of time. This process continues, with new keys of the same length being generated, at ever decreasing intervals, until a new larger sized key is required.
- Data related to how may samples of encrypted data samples have been "presented" to the outside world may also be considered in the considerations of the viability of a public/private key pair. Sheer volume of the samples of data signed by encryption is one of the resources used by someone attempting to break the code.
- Embodiments of the present invention use the number of data samples that have been encrypted and sent external to the fiscal printer in the algorithm used to determine the public/private key viability.
- the algorithm preferably strikes a balance between increasing frequent changes of keys of the same length and simply changing to larger length keys, which initially require less frequent changes.
- the new public key is revealed outside the secure hardware 302.
- the new public key is preferably part of a message that has a digital signature that was created using the printer's previous private key, " and can thus be authenticated as having come from the secure fiscal printer by using the previous public key.
- FIG. 2 illustrates the method steps used in embodiments of the present invention.
- a read once system start up is employed. This causes the secure hardware 302 to generate a first private/public key pair wherein the private key is retained inside the secure hardware 302 and the public key is delivered to selected users for use in further communications to the fiscal printer.
- step 214 a check is done to see if the hardware is secure. If the hardware is not secure, then the private key is erased in step 213.
- step 212 the read once circuits are re-installed, the hardware secured and a return is issued to step 201. If the hardware is secure in step 214, a check is done in step 215 to test if new data is available.
- step 215 If new data is available in step 215, then data on encryption economics is read in step 203.
- Fiscal printer tax data is read in step 204 and a branch is issued to step 210.
- step 210 real time clock data is read and next in step 206 the private key birth data is compared to check point data and an action plan is determined using stored algorithms. The requirement for an action plan is checked in step 207. If an action plan is required, the required key length is determined, new keys are generated, new check point dates are set and a return is issued to step 214. If no action plan is required a branch is made to step 214.
- FIG. 4 an example is shown of a data processing system 400 which is used for a preferred embodiment of the present invention.
- the system has a central processing unit (CPU) 410, which is coupled to various other components by system bus 412.
- Read-only memory (“ROM”) 416 is coupled to the system bus 412 and includes a basic input/output system (“BIOS”) that controls certain basic functions of the data processing system 400.
- RAM random access memory
- I/O adapter 418 I/O adapter 418, and communications adapter 434 are also coupled to the system bus 412.
- I/O adapter 418 may be a small computer system interface (“SCSI”) adapter that communicates with a disk storage device 420 or tape storage device 440.
- SCSI small computer system interface
- Communications adapter 434 interconnects bus 412 with an outside network enabling the data processing system to communicate with other such systems.
- Input/Output devices are also connected to system bus 412 via user interface adapter 422 and display adapter 436.
- Keyboard 424, track ball 432, mouse 426 and speaker 428 are all interconnected to bus 412 via user interface adapter 422.
- Display monitor 438 is connected to system bus 412 by display adapter (controller) 436. In this manner, a user is capable of inputting to the system through the keyboard 424, trackball 432 or mouse 426 and receiving output from the system via speaker 428 and display 438.
- the fiscal printer system 441 may include additional devices such as a fiscal printer system 441 containing a secure hardware 302 for receiving or generating private/public encryption keys.
- the fiscal printer system 441 preferably receives and outputs data via user interface adapter 422.
- Fiscal printer system 441 preferably also includes circuits for erasing a generated private key if the secure hardware 302 is broached in an unauthorized manner.
- Fiscal printer system 441 also includes circuits that enable a read once command to generated, internal to the secure hardware 302, a private/public key pair and also require the read once circuits to be replaced if the secure hardware 302 is breached in an unauthorized manner.
Landscapes
- Engineering & Computer Science (AREA)
- Computing Systems (AREA)
- Theoretical Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Storage Device Security (AREA)
- Control Of Vending Devices And Auxiliary Devices For Vending Devices (AREA)
Abstract
Description
Claims
Priority Applications (3)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
CA002405613A CA2405613A1 (en) | 2000-06-16 | 2001-06-13 | Method, systems and computer program for reducing hacking susceptibility |
AU2001276363A AU2001276363A1 (en) | 2000-06-16 | 2001-06-13 | Method, systems and computer program for reducing hacking susceptibility |
EP01953977A EP1290822A2 (en) | 2000-06-16 | 2001-06-13 | Method, systems and computer program for reducing hacking susceptibility |
Applications Claiming Priority (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US59597300A | 2000-06-16 | 2000-06-16 | |
US09/595,973 | 2000-06-16 |
Publications (2)
Publication Number | Publication Date |
---|---|
WO2001097441A2 true WO2001097441A2 (en) | 2001-12-20 |
WO2001097441A3 WO2001097441A3 (en) | 2002-05-16 |
Family
ID=24385468
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
PCT/EP2001/006668 WO2001097441A2 (en) | 2000-06-16 | 2001-06-13 | Method, systems and computer program for reducing hacking susceptibility |
Country Status (5)
Country | Link |
---|---|
EP (1) | EP1290822A2 (en) |
AU (1) | AU2001276363A1 (en) |
CA (1) | CA2405613A1 (en) |
MY (1) | MY136255A (en) |
WO (1) | WO2001097441A2 (en) |
Cited By (4)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
EP1398741A2 (en) * | 2002-09-10 | 2004-03-17 | Wincor Nixdorf International GmbH | Secure storage of journal data |
US8214296B2 (en) | 2006-02-14 | 2012-07-03 | Microsoft Corporation | Disaggregated secure execution environment |
WO2016098303A1 (en) * | 2014-12-16 | 2016-06-23 | パナソニックIpマネジメント株式会社 | Signature verification device, signature generation device, signature processing system, signature verification method, and signature generation method |
US9819495B2 (en) | 2014-10-02 | 2017-11-14 | Qualcomm Incorporated | Systems and methods of dynamically adapting security certificate-key pair generation |
Citations (1)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
WO2000019387A1 (en) * | 1998-09-30 | 2000-04-06 | International Business Machines Corporation | Verifiable electronic journal for a point of sale device and methods for using the same |
-
2001
- 2001-06-11 MY MYPI20012701 patent/MY136255A/en unknown
- 2001-06-13 WO PCT/EP2001/006668 patent/WO2001097441A2/en not_active Application Discontinuation
- 2001-06-13 EP EP01953977A patent/EP1290822A2/en not_active Withdrawn
- 2001-06-13 AU AU2001276363A patent/AU2001276363A1/en not_active Abandoned
- 2001-06-13 CA CA002405613A patent/CA2405613A1/en not_active Abandoned
Patent Citations (1)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
WO2000019387A1 (en) * | 1998-09-30 | 2000-04-06 | International Business Machines Corporation | Verifiable electronic journal for a point of sale device and methods for using the same |
Non-Patent Citations (1)
Title |
---|
MENEZES, OORSCHOT, VANSTONE: "Handbook of Applied Cryptography" HANDBOOK OF APPLIED CRYPTOGRAPHY, CRC PRESS SERIES ON DISCRETE MATHEMATICS AND ITS APPLICATIONS, BOCA RATON, FL, CRC PRESS, US, 1997, XP002191738 ISBN: 0-8493-8523-7 * |
Cited By (6)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
EP1398741A2 (en) * | 2002-09-10 | 2004-03-17 | Wincor Nixdorf International GmbH | Secure storage of journal data |
EP1398741A3 (en) * | 2002-09-10 | 2004-07-28 | Wincor Nixdorf International GmbH | Secure storage of journal data |
US8214296B2 (en) | 2006-02-14 | 2012-07-03 | Microsoft Corporation | Disaggregated secure execution environment |
US9819495B2 (en) | 2014-10-02 | 2017-11-14 | Qualcomm Incorporated | Systems and methods of dynamically adapting security certificate-key pair generation |
WO2016098303A1 (en) * | 2014-12-16 | 2016-06-23 | パナソニックIpマネジメント株式会社 | Signature verification device, signature generation device, signature processing system, signature verification method, and signature generation method |
JP2016116134A (en) * | 2014-12-16 | 2016-06-23 | パナソニックIpマネジメント株式会社 | Signature verification device, signature generation device, signature processing system, signature verification method, and signature generation method |
Also Published As
Publication number | Publication date |
---|---|
MY136255A (en) | 2008-09-30 |
AU2001276363A1 (en) | 2001-12-24 |
WO2001097441A3 (en) | 2002-05-16 |
CA2405613A1 (en) | 2001-12-20 |
EP1290822A2 (en) | 2003-03-12 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US7047222B1 (en) | Secure encryption of data packets for transmission over unsecured networks | |
US6829711B1 (en) | Personal website for electronic commerce on a smart java card with multiple security check points | |
JP4638990B2 (en) | Secure distribution and protection of cryptographic key information | |
US5426700A (en) | Method and apparatus for verification of classes of documents | |
EP2801061B1 (en) | Data protection with translation | |
CN104217327B (en) | A kind of financial IC card internet terminal and its method of commerce | |
EP0166541B2 (en) | Communications network using an enciphering and deciphering device | |
US20050044377A1 (en) | Method of authenticating user access to network stations | |
JPS62140A (en) | Communication system | |
US20040068470A1 (en) | Distributing public keys | |
JPH103257A (en) | Method and device for adding electronic signature, and method for verifying electronic signature | |
KR100991855B1 (en) | System for Issuing and Verifying Electronic Document, Method for Issuing Electronic Document and Method for Verifying Electronic Document | |
US6237098B1 (en) | System for protecting weight verification device private key | |
US6246967B1 (en) | Weight verification device | |
US20110296191A1 (en) | Method for securely drawing up a virtual multiparty contract capable of being physically represented | |
JP2002281019A (en) | Portable information storage medium and method for authenticating the same | |
CN101212301B (en) | Authentication device and method | |
KR100598573B1 (en) | Creating and authenticating one time card data using smartcard and the system therefor | |
EP1290822A2 (en) | Method, systems and computer program for reducing hacking susceptibility | |
JPH10200522A (en) | Ic card use enciphering method, system therefor and ic card | |
JP2606827B2 (en) | Encryption device using IC card | |
RU2207617C1 (en) | Method and electronic cryptographic module for information protection and authenticity control | |
EP0808535A1 (en) | Electronic negotiable documents | |
CN1154291C (en) | Apparatus and method for preventing disclosure through user-authentication at a printing node | |
US20010048747A1 (en) | Method and device for implementing secured data transmission in a networked environment |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
AK | Designated states |
Kind code of ref document: A2 Designated state(s): AE AG AL AM AT AU AZ BA BB BG BR BY BZ CA CH CN CR CU CZ DE DK DM DZ EE ES FI GB GD GE GH GM HR HU ID IL IN IS JP KE KG KP KR KZ LC LK LR LS LT LU LV MA MD MG MK MN MW MX MZ NO NZ PL PT RO RU SD SE SG SI SK SL TJ TM TR TT TZ UA UG UZ VN YU ZA ZW |
|
AL | Designated countries for regional patents |
Kind code of ref document: A2 Designated state(s): GH GM KE LS MW MZ SD SL SZ TZ UG ZW AM AZ BY KG KZ MD RU TJ TM AT BE CH CY DE DK ES FI FR GB GR IE IT LU MC NL PT SE TR BF BJ CF CG CI CM GA GN GW ML MR NE SN TD TG |
|
DFPE | Request for preliminary examination filed prior to expiration of 19th month from priority date (pct application filed before 20040101) | ||
121 | Ep: the epo has been informed by wipo that ep was designated in this application | ||
AK | Designated states |
Kind code of ref document: A3 Designated state(s): AE AG AL AM AT AU AZ BA BB BG BR BY BZ CA CH CN CR CU CZ DE DK DM DZ EE ES FI GB GD GE GH GM HR HU ID IL IN IS JP KE KG KP KR KZ LC LK LR LS LT LU LV MA MD MG MK MN MW MX MZ NO NZ PL PT RO RU SD SE SG SI SK SL TJ TM TR TT TZ UA UG UZ VN YU ZA ZW |
|
AL | Designated countries for regional patents |
Kind code of ref document: A3 Designated state(s): GH GM KE LS MW MZ SD SL SZ TZ UG ZW AM AZ BY KG KZ MD RU TJ TM AT BE CH CY DE DK ES FI FR GB GR IE IT LU MC NL PT SE TR BF BJ CF CG CI CM GA GN GW ML MR NE SN TD TG |
|
WWE | Wipo information: entry into national phase |
Ref document number: 2405613 Country of ref document: CA |
|
WWE | Wipo information: entry into national phase |
Ref document number: 2001953977 Country of ref document: EP |
|
WWP | Wipo information: published in national office |
Ref document number: 2001953977 Country of ref document: EP |
|
REG | Reference to national code |
Ref country code: DE Ref legal event code: 8642 |
|
NENP | Non-entry into the national phase in: |
Ref country code: JP |
|
WWW | Wipo information: withdrawn in national office |
Ref document number: 2001953977 Country of ref document: EP |