EP0915435A2 - Method for securely storing variable data - Google Patents

Abstract

When a franking machine [10] is turned on and a remotely generated transaction has been carried out over the telephone with a central data station [18] a check is made on stored data for any errors due to the voltage interruption. This involves comparison of the variable data held in memory with that of the new data set and a correction applied.

Description

The invention relates to a method for the secure storage of changeable data, in particular the data that accumulates during a Can change remote value specification.

A power failure can result in a record in memory saved incorrectly. It is for operating a data processing system therefore already known, a second memory for an identical data set and to provide a state memory for a state identifier, the latter indicates whether the data record is read from the first or the second memory should be when the voltage returns.

Errors in the status code can be saved by redundantly saving the Status identifier can be disabled. The most common condition identifier in the case of a majority check, however, the correct status identifier is not always required his. It is only most likely that the most common condition identifier is also the right one. An additional plausibility check only checks the Belonging to a valid range of values, but does not provide a clear one Statement whether the status identifier is correct or not. With the above described method, therefore, an error is not recognized, the most common is saved and is within the valid range of values.

It is another object of the invention to provide redundant security Saving with simple means to increase and any errors that occur remove.

To solve this problem it is proposed that a by means of a pointer the first data record is determined as the current, unchangeable data record, the Data is available for a query that changes data this change in the non-current second data record occurs that then the second data record for the current data record using the pointer is determined and that the data from the current second data set in the not current first record to be copied.

These process steps described above are used in both Initialize the memory, i.e. when saving the initial data as well as in running operation. The current data set is always unchangeable. His data is not at risk even in the event of a power failure, since one Power failure generally only leads to errors in ongoing write processes can lead. The inventive method works independently of the Detection of a power failure during the storage process. On An essential step of the method according to the invention is that Consistency of the stored data as well as the equality of the two To review and, if necessary, restore data stored in data records, as described in more detail below.

Fig. 1

eine schematische Darstellung einer Frankiermaschine und eines Datenzentrums,

Fig. 2a und 2b

eine schematische Darstellung eines Fernwertvorgabeverfahrens mit Änderung eines Vorgabewertes für das Voice-Verfahren,

Fig. 3a und 3b

eine schematische Darstellung eines Fernwertvorgabeverfahrens mit Änderung eines Vorgabewertes im Modem-Verfahren,

Fig. 4

die Aufteilung eines Speichers für die gesicherte Speicherung von Daten in Form zweier Datensätze,

Fig. 5

ein Flußdiagramm zur Erläuterung der Initialisierung der Daten in den beiden Datensätzen,

Fig. 6

ein Flußdiagramm zur Erläuterung der Speicherung von Daten im laufenden Betrieb und

Fig. 7

ein Flußdiagramm zur Erläuterung der Prüfung und Korrektur von Daten in den beiden Datensätzen.

Further features and advantages of the invention emerge from the further subclaims and the following description, which in connection with the accompanying drawings explains the invention using an exemplary embodiment. Show it:

Fig. 1

1 shows a schematic illustration of a franking machine and a data center,

2a and 2b

1 shows a schematic representation of a remote value specification method with a change in a specification value for the voice method,

3a and 3b

1 shows a schematic representation of a remote value specification method with a change in a default value in the modem method,

Fig. 4

the division of a memory for the secure storage of data in the form of two data records,

Fig. 5

a flowchart to explain the initialization of the data in the two data records,

Fig. 6

a flowchart to explain the storage of data during operation and

Fig. 7

a flow chart to explain the checking and correction of data in the two data sets.

In FIG. 1, 10 denotes a user station, which is a franking machine 12 and a telephone 14 includes. This phone or communication terminal, such as. a modem, is connected to a via a telephone line 15 Telephone or communication terminal 16 in a data center 18, which further contains a billing device 20.

The franking machine 12 includes one generally designated 22 Data processing device with a CPU 24, a credit memory 26, a default value memory 28 and a cryptographic device 30 which includes a key store 12. The data processing device 22 of course includes other parts, memories and registers here but are not shown, since they are used to describe the invention Procedures are not needed. In an advantageous variant, instead of separate device 30 software means or program storage means of the CPU 24 used in connection with the non-volatile key memory 32 to perform the encryption. In the case of an automatic The data processing device 22 is data exchange (modem method) connected to the communication terminal modem 14 via a line 23, which then replaces the phone 14. With the data processing device 22 an input device 34, for example a keyboard, is also connected, a display device 36 and a printing device 38.

The accounting device 20 in the data center 18 comprises one Input device 40 and a data processing device 42 with a CPU 44, a default value memory 45, an accounting memory 46 and a cryptographic device 48 with a key store 50. Here too encryption can take place in device 48 in conjunction with the CPU 44 and the non-volatile key memory by software. For the The data processing device 42 is a modem method via a line 51 connected to the modem, which in this case replaces the telephone 16.

With the voice process, data is exchanged between the user station 10 and the data center 18 via the telephones 14 and 16 preferably by telephone exchange between the user of the Franking machine 12 and an operator in the data center 18. The with the Sequence of the remote value specification procedure in the franking machine and the data center The essential processes connected are now to be explained with reference to FIGS and 2b are explained, which left the processes in the user station or Franking machine (FM) and on the right show the processes in the data center (DZ).

The value change and remote value specification method shown in FIG. 2 begins by entering input device 34 of franking machine 12 enters an identity number (PAN) (S1) which is activated by a special key 52 (FIG. 1) is confirmed. The one stored in the default value memory 28 appears in the display Default value. In the event that this value is to be changed, the program of the data processing device branches that of the transaction "Value change" corresponding routine (S2). Then the Desired default value by means of the input device 34 in the data processing device entered and by pressing the special key 52 approved.

The user now calls the operator in the data center 18 (S4) and shares it with him Identity number (PAN) with. The operator enters the identity number in the Input device 40 of the billing device 20 to the caller and to identify the franking machine 12 of the user station 10. Checking the Identity number is shown at S6. If the check is negative, it will Procedure canceled and repeated if necessary. Can the franking machine however, the process continues. Thereby the Operator of the user's default request and any other Information about the franking machine, in particular values in the Billing registers communicated.

In the franking machine, the Identity number, the default request and additional information, for example, another register value using a key K1 calculates first code number (S7), which in the display device 36 Franking machine 12 displayed and by the user the operator in the data center 18 is transmitted. In step S8, this code number in the Data center 18 checks using that stored in the data center Key K1. If the result of the test is negative, the test is compared to that of the key used in previous transaction repeated. If it succeeds Verification now, it means that the previous transaction in the Franking machine was not or not completely and correctly executed. The previous transaction is therefore canceled and the procedure continues. If the code number cannot be verified with the previous key, the process is terminated. However, the first code number can be Successfully verify, the default value in memory 45 of the data center stored and the data processing device 42 in the data center 18 calculates a second code number from the identity number, the additional information and the key K1. A second key K2 (S9) is also calculated. This second code number, in which the new key K2 is integrated, is the User communicated to them in the input device 34 of the franking machine enters. The cryptrographic device 30 is verified in the franking machine the second code number, extracted from the transmitted second code number Key K2 and stores it in place of the key K1. With negative The procedure is terminated, if the result is positive the entered default request stored in the default value memory 28, the previous default value is deleted (S11).

This completes the first transaction and changes the default value. The User now has the option to end the process and by Pressing another special key 54 the franking machine 12 in the Reset franking mode or by pressing the first one again Special key 52 to initiate the reloading process (S12). If the latter happens, will in the franking machine using the identity number and the Additional information by means of the stored key K2 a third Calculates the code number that is communicated to the data center (S13). in the The third code number is verified in the data center (S14). If the result is negative the process is terminated, if the result is positive, the system calculates Data center from the identity number, the additional information and the Key K2 is a fourth code number (S15) that the franking machine together is transmitted with a new key K3. The franking machine is like in the first transaction, the fourth code number is verified (S16) and the new one Key K3 is extracted from the fourth code number and stored, as is the case with the first transaction with the key K2. Be in the data center the old and the new key are saved. If the result is negative the procedure was terminated. If the result is positive, the Default value memory 28 of the franking machine stored value at Remaining credit in the credit memory 26 of the franking machine and in Preset value memory 45 to the billing device 20 stored value the remaining credit in the billing memory 46 of the data center 18 added (S17). This also includes the second transaction, i.e. the remote value specification changed default value completed. The franking machine returns automatically back into franking mode.

If you do not want to change the default value, use Actuation of the special key 52 or an optionally provided third Special key confirms the default value stored in the default value memory 28 and the method goes from step S2 directly to step 4 'in Fig. 2b. The User calls the data center and gives the operator the identity number (PAN) and possibly further information with (S5 '). Is the If the identity number is correct (S6 '), the remote value specification procedure then runs accordingly the above description from step S13 to step S17.

It goes without saying that the operator has further data about the franking machine, in particular can query further register statuses to ensure the correctness of all Billing data in the franking machine and the data center check. It is also possible to get more information and more subkeys to be included in the calculation of the code number if this is to increase the Security seems reasonable. If in the data center in step S14 one of the Postage meter transmitted code number is checked, and the result is negative is always with the in the franking machine at the direct previous transaction, keys used the check again repeated. This will capture a case where a transaction in the Franking machine was not completed correctly without this Data center has received knowledge of this. In this case it would be from the data center did not transmit new keys in the franking machine saved and the franking machine is therefore encrypted with the old one Key. This gives the opportunity to cancel or cancel the last transaction correct and damage the user or the data center avoid.

The flow chart according to FIGS. 3a and 3b shows the value change and Reload procedure in the event that communication between the Franking machine and the data center is done automatically via modem. There the steps of the procedure are essentially the same as for the The individual steps are also using the method according to FIGS. 2a and 2b the same reference numbers increased by the number 20.

As with the method described with reference to FIGS. 2a and 2b, the Users of the franking machine after switching on the Postage call number or identity number PAN and confirms this entry by pressing the special key 52. The saved one is now Default value is displayed. Either the user confirms this value with the Pressing the special key 52 or overwrites it with a new one Default value, which is also confirmed by pressing the special key 52 becomes. All further steps now run automatically without the intervention of the user Franking machine between the franking machine and the data center from time to time in the same way as in the case of FIGS. 2a and 2b described voice method was explained. The only difference is in that in the modem process between the franking machine and the Data center only the crypto messages, i.e. the encrypted messages and the shortened code numbers obtained from these are not exchanged.

4 to 7, a method for storing security-relevant data, especially during remote value specification described.

FIG. 4 shows the division of the storage space in a schematic manner non-volatile memory, for example an NVRAM that is in the Postage meter and possibly also in the data center. The memory must have space to store two data records, namely sentence 1 and sentence 2 as well to save a pointer. Each record contains a variable Sentence "var", which can consist of any number of bytes. Each also includes Record a counter variable "nr updates" which is the number of changes of the data set, i.e. every time the data is changed or renewed of a sentence is increased by 1. Finally, there is another record Checksum, which includes at least a portion of variable data of the data set is determined.

The Act Pointer pointer can only have two allowable values that indicate which of the two records is currently considered the current record. The values 0 and 1 are not saved because none of these values Bit error can be detected. Rather, the values become 0 x A5 and 0 x 5A used, where 0 x indicates that the values are in hexadecimal notation. At This number, constructed symmetrically in binary representation, can cause bit errors the number itself can be recognized.

1. Initialisierung des Speichers für das Speicherverfahren;

2. Abspeichern von Variablen im laufenden Betrieb und

3. Überprüfung der Variablen auf Konsistenz und ggf. Korrektur.

The entire process is divided into three steps:

1. Initialization of the memory for the storage process;

2. Save variables during operation and

3. Check the variables for consistency and correct them if necessary.

According to FIG. 5, the initialization of the memory comprises the following steps:

First, the pointer is set to set 1 (step S50). That means that the Sentence 1 is considered to be current storage, the data of which cannot be changed. Then in step S51 the variables of data record 2 are reset to their initial values set. The count nr updates in data record 2 receives the value 0 (S52). Then the checksum is calculated using at least a part of the variable values of data record 2 are generated and at the provided for this Location of data record 2 saved (S53, S54). Now the pointer to the second record set, i.e. the second record becomes the current one Data set determined (S55), on the data of which is now reliable and immutable data can be accessed. Finally, in step S56 copies the entire contents of data record 2 into data record 1 so that both records contain identical data.

During operation, data is only changed in the non-current one Record. According to FIG. 6, it is first determined during operation that which data record is the not current data record (S60). In step S61 changing data is written into the non-current data record. Because in Step S61 have changed the data of the data set, the count value no updates increased by 1 in step S62. Then the checksum is made up of data of the non-current memory newly formed (S63) and in the non-current data record saved (S64). Now the pointer is directed to the data record in which the data has just been changed so that this record is now the current one Record is (S65). Finally, the entire data of the now copied current data record into the other, not current data record (S66). Both data records in turn contain the identical data.

When switching on the franking machine and before calling up the Remote value specification must be checked whether a previous transaction for example, was interrupted by a voltage drop and therefore Operations are required to avoid inconsistencies in the stored data to fix.

1. Der Zeiger Act Pointer muß einen zulässigen Wert haben. Wie bereits oben erläutert wurde, sind nur zwei Werte erlaubt, wobei solche Werte gewählt werden, in denen aus dem Wert selbst heraus Bitfehler erkannt werden können.

2. Der aktuelle durch den Zeiger bezeichnete Satz muß eine gültige Prüfsumme haben.

The following basic requirements are made for the examination:

1. The Act Pointer pointer must have a permissible value. As already explained above, only two values are allowed, values being selected in which bit errors can be recognized from the value itself.

2. The current record identified by the pointer must have a valid checksum.

If at least one of the above requirements is not met, then there is a fatal error and the franking machine goes into service mode.

The following steps are carried out to check the consistency Figure 7 are to be explained.

First, it is checked in step S70 whether the value of the pointer is permissible. In Step S71 checks whether the checksum of the current through the pointer designated record is valid. If one of the two steps is not fulfilled, then switches the franking machine to service mode, as already mentioned above.

On the other hand, the tests in steps S70 and S71 are positive Result is carried out, the validity of the checksum is not in step S72 current memory checked. If this test is negative, i.e. is the checksum not valid, it can be assumed that the data storage or the Mirroring was interrupted. To correct this error, the Mirroring repeated, i.e. all data of the current data record are stored in the Copied non current record (S73). However, the checksum has turned out to be proven valid, it is checked in S74 whether the checksums of the two data records and therefore your data is the same. If this is the case, the test is finished. If, on the other hand, both checksums are valid but not the same, then that is Backup process has been interrupted before mirroring. In this The data record whose count "nr updates" is greater than that will be the case Count value of the other, selected as the current record. His data is in the copied another record (S75).

In a modified embodiment, the franking machine can be used both for the voice procedure as well as for the modem procedure. Means a selection button 58 (Fig. 1) on the franking machine, the user can type the communication method with the data center.

Claims (4)

Method for the secure storage of changeable data by generating and storing two matching datasets, characterized in that a pointer is used to determine a first dataset as the current unchangeable dataset, the data of which are available for a query that when the data changes, this change in the second record, which is not current, is followed by the pointer being used to determine the second record for the current record and the data from the current second record being copied into the non-current first record. Method according to claim 1, characterized in that a variable of the variable data of each data record is a count value representative of the number of changes made. Method according to claim 1 or 2, characterized in that a variable of the variable data of each data set is a checksum calculated from at least a part of the variable data. Method according to one of claims 1 to 3, characterized in that the value of the pointer for consistency and selected data of the data records are checked for consistency and equality and corrected if necessary.

Images