Patent Grant
7043631
1. Field of the Invention
The present invention is directed to an arrangement and method for modifying the functionality of a security module.
2. Description of the Prior Art
Security modules operate in a potentially unfriendly environment in products representing different functionalities, such as automatic teller machines, automatic transport ticket machines, cash registers, electronic purses, computers for personal use (laptops, notebooks, organizers), cell phones and devices that combine several of these products. The assemblies are cast with a casting compound. A postal security module is used in a postage meter machine or mail processing machine or a computer with mail-processing function (PC frankers).
European Application 417 447 discloses the use of special modules in electronic data processing systems that are equipped with means for protecting against a break-in into their electronics. Such modules are included among security modules as that term is used herein.
Modern postage meter machines or other device for franking postal matter are equipped with a printer for printing the postage stamp onto the postal matter, a controller for controlling the printing and the peripheral components of the postage meter machine, an accounting unit for debiting postage fees that are maintained in non-volatile memories, and a unit for cryptographically protecting the postage fee data. A security module (European Application 789 333) can have a hardware accounting unit and/or a unit for protecting the printing of the postage fee data. For example, the former can be realized as an ASIC (application specific integrated circuit) and the latter can be realized as an OTP (one-time programmable) processor. An internal OTP processor stores sensitive data (cryptographic keys) in a manner protected against readout. Such data, for example, are required for replenishing a credit. An encapsulation with a security housing offers further protection.
Further measures for the protection of a security module against intrusion are disclosed in German OS 198 16 572, German OS 198 16 571, European Application 1 035 516 (corresponding to co-pending U.S. application Ser. No. 09/522,621, European Application 1 035 517, European Application 1 035 518 (corresponding to co-pending U.S. application Ser. No. 09/522,619, filed Mar. 10, 2000), European Application 1 035 513 (corresponding to co-pending U.S. application Ser. No. 09/524,118, filed Mar. 13, 200), and German Utility Model 200 20 635 (corresponding to co-pending U.S. application Ser. No. 10/007,899, filed Nov. 5, 2001.
The various techniques that have been conventionally employed, such as encapsulation with a secure housing and the use of various event detectors that can cause the security module to erase security-relevant data (European Application 1 035 518 and German OS 200 20 635), can only offer a dependable protection against manipulation for the one particular functionality for which it is designed.
U.S. Pat. No. 4,528,644 discloses a method for customer-specific setting of the firmware of an electronic postage meter machine after the assembly thereof, whereby an input of a configuration message is stored in a non-volatile memory which collaborates with the operating program in order to adapt the postage meter machine to the customer's wishes. Further access to the configuration data is prevented after the end of the configuration. Beyond the secure environment at the manufacturer, however, it is difficult to provide a dependable protection against manipulation. Therefore, no security-relevant program data for achieving a different application functionality are installed outside the secure environment at the manufacturer.
Memories referred to as flash-EEPROMs are utilized as program memories in modern postal devices. These allow sector-by-sector erasure and storage of data as well as a byte-by-byte insertion of individual data into a memory area (sector). European Application 724 141 discloses a method for the input of data into a scale, whereby the appertaining memory areas in the flash-EEPROM of the scale are erased before a reprogramming is undertaken in order, for example, to at least partially modify a postage rate table. The data, which are preferably loaded via modem of a postage meter machine, for example JetMail®, are stored in compressed form in the flash-EEPROM and are decompressed before the application and stored in a separate application memory. A programmable security means also is provided in the scale that prevents an unauthorized erasure of data blocks in the flash-EEPROM memory areas. Sub-image datafiles and a control datafile are defined for the postage meter machine, that are downloaded into the memory of the postage meter machine from a data center together with the data intended for the scale. In addition to a dataset that, among other things, contains a version information, the processing status is stored in order to non-volatilely conserve the program status that was achieved prior to a program abort. However, no security-relevant program data are stored in the postage meter machine or in the scale.
An electronic device with flash memory and a method for reprogramming the flash program memory are disclosed in European Application 788 115. The programming of the flash program memory module ensues by processing a sub-program contained in a memory bank for this purpose, with the appertaining memory areas of the respectively other memory bank being erased before a reprogramming is undertaken. The program is usually longer or shorter than the free memory sector created by the erasure and thus cannot be fully utilized. In addition to the aforementioned limitation with respect to the complete utilization of the memory space, such a component is more expensive than a comparable component without multiple memory banks. Whether the reprogramming has been completed is determined by checking a checksum. It cannot thus be precluded that the device was reprogrammed with manipulated data.
Reprogrammable memory components (FLASH or EEPROM) can also be utilized for a function-specific program storage in postal security modules. The programming of these components can be undertaken by the manufacturer in a known way using various methods:
Compared to the second method, the first method has the disadvantage that a faulty programs cannot be replaced. The second method disadvantageously requires a module that has at least two different memory banks, which makes it more expensive given the aforementioned limitations on the use of the memory space. Special demands are made of postal security modules with respect to the replacement and the expandability of functions. The programming of the aforementioned program modules must not be capable of being implemented at arbitrary times and, in particular, not by every operator.
An object of the present invention is to meet the aforementioned, special demands with little outlay and while avoiding the disadvantages and to provide an arrangement and a method for modifying the functionality of a security module that assure a replacement of the functionality in status-dependent and authorized fashion.
In the inventive security module that has been developed, a microprocessor is utilized that enables the implementation of a program in a main memory. In addition to this main memory, a FLASH program memory is likewise utilized for the application-specific program. Both memories are connected to the processor via the bus.
At the time the security module is manufactured, a so-called “boot loader” is introduced as a start loading program into the program memory according to the aforementioned, first known method. A specific procedure for modifying the functionality of the other free program memory enables:
During its production, thus, the security module is programmed with program data and receives an identifier for a first basic condition. After being turned on, a first program part from the memory area of the program memory is copied into the main memory by means of a start-up program. The program state (or status) that has been achieved is verified in order to be able to implement the program functionality in a state-dependent manner. A state variable for the program state that has been achieved can, for example, be stored in the program memory or in a non-volatile memory of the security module. A light-emitting diode (LED) signals that the microprocessor is processing a second program part and is waiting for the modification of the program functionality of the free program memory. Via a communication interface contained in the security module, at least application program data are loaded into a free or non-active memory area of the program memory. Moreover, appertaining identifier data and a cryptographic signature of the application program are loaded into the non-volatile memory of the security module or are likewise loaded at the aforementioned or some other free or non-active memory area of the same program memory. To this end, the microprocessor, controlled by the second program part, first verifies the identifier of the previously stored program. The identifier describes the properties of the program data and is stored at a memory location having a specific address. If the identifier stored at this address represents a valid predecessor of the identifier of the new application program data, then the functionality of the first program part copied into the main memory is used in order to load the application program data obtained via the communication interface into the free memory area of the program memory. Before every programming of the program memory, it is additionally assured that no data can proceed into the currently active boot loader memory area, in order to prevent an overriding of the start loading program (boot loader). After all application program data have been stored in the free memory area of the program memory in this way, the employment of the application program is enabled when the application program has been verified. For example, a certification code is verified, preferably the cryptographic signature of the loaded application program data, and the loaded application program is identified as valid by a flag when the verification is successful, or the state of the application program that has been reached is updated in another suitable way. The appertaining identifier also is stored. The modification of the functionality thus has been ended. After the security module has been re-booted, the start loading program (boot loader) determines that the new program state indicates a valid application program functionality and now implements it. This is additionally indicated by a LED of a different color. A modification of the current functionality of the program memory is now no longer possible as long as the program state is not again modified.
In order to continue to assure this modification of the program functionality, each re-loaded functionality likewise contains a sub-program for copying and implementing programming instructions in the main memory. This functionality can likewise be called via the communication interface located in the security module. When called, the state variable changes such that the identifier of the program is in fact retained but the boot loader is notified at the next booting that the application-specific software now again represents a free program memory area. As a result, the boot loader is reactivated at the next booting and receives application program data.
The invention is based on the recognition that a fast microprocessor and additional function units (some of which are conventional) create a security module that meets all demands. The fast processor enables symmetrical and/or asymmetrical encryption methods to be utilized for different applications. Corresponding to the particular application, a real-time processing of events as well as a registration or, respectively, booking are enabled. An internal battery of the security module provides the voltage supply for a real-time clock and for components for non-volatile storage of the payload data, for permanent monitoring of all security-relevant functions as well as of the operational readiness of the security module when the system voltage of the device is switched off. In case of fault and when the security module is removed, a status change is stored in a fashion that can be interrogated. The status of the security module can also be interrogated by the device after the erasing. An existing display unit of the device can be utilized for signaling the status or a signaling means of the security module can be utilized as well.
The manufacturer device supplies a system voltage and, optionally, a second battery voltage. With the manufacturer device turned on, the security module 100 is operated with system voltage. For modifying the functionality, the security module 100 is equipped with a reprogrammable FLASH program memory 128 that stores a start loading program, and with a microprocessor 120 that partially copies the start loading program into the main memory SRAM 121. The integrated communication interface 150 of the specific circuit 160 enables the setup of a communication connection to the manufacturer device that offers the application program data for the security module. The microprocessor 120 is in communication via a bus with the main memory SRAM 121, with the FLASH program memory 128 and with the communication interface 150. The communication interface 150 offers data of at least one part of an application program, an appertaining certificate code and identifier data, and the microprocessor 120 is programmed, by the start loading program partially copied into the main memory 121, to store the data of the part of the application program at a free memory location of the FLASH program memory 128 when the identifier data identify a successor of the stored predecessor identifier, and to check the authenticity of the loaded part or parts of the application program by means of the certificate code and, given authenticity of the loaded part or parts of the application, to store the latter as valid.
The microprocessor 120 determines whether the identifier data identify a successor for the stored predecessor identifier by comparing the identifier data to corresponding comparison data that are stored in a further memory area of the FLASH program memory 128, wherein information data for a program that has already been loaded are listed. The identifier data include the program type, the version data and the revision data. A microprocessor type is employed that enables the execution of a program in a main memory 121 in order to reprogram the FLASH. The employment of an expensive FLASH program memory module with separate memory banks can thus be foregone.
The power manager 11 has a number of function units that, given a low power consumption, assure the functionability of the security module even when the device is turned off. The power manager 11 has a DC/DC converter (not shown) and a voltage regulator (not shown) for the corresponding operating voltages (3V, 5V and 8V), and a temperature and voltage monitoring circuit (not shown). These latter two can generate a reset signal. The supplied system voltage is monitored for upward or downward transgression of limit values. The DC/DC supplies a predetermined operating voltage UB. A voltage generation unit generates therefrom all necessary voltages that the function units of the security module require.
When the device is turned off, only a real-time clock RTC and the main memory are supplied with battery voltage in addition to the monitoring circuits and the destruction detection unit. An uninterrupted supply of the battery-operated units has also been disclosed in the aforementioned German Utility Model 200 20 635. This includes, at least one of the postal memories, some of the detectors and the SRDI memory. Two independent batteries can be connected to the security module. The first battery voltage derives from the internal battery 134 that can be optionally supported by a second, separate battery.
Alternatively to the internal real-time clock, a separate real-time clock RTC 124 can be connected. The microprocessor 120, for example, is of the type ARM7, and the separate real-time clock is of the type EPSON RTC-4543. The microprocessor 120 is connected via a bus to the program memory FLASH 128, the main memory SRAM 121, the main memory SRDI-RAM 122 and to the specific circuit FPGA 160. The bus is shown with broad, white arrows. The specific circuit FPGA 160 is an application-specifically programmed FPGA (one-time programmable). The FPGA contains a hardware accounting unit (not shown), a drive circuit for two further memories NVRAM I and II as well as an input/output interface (digital interface of the security module; not shown) to the device (not shown). The specific circuit FPGA 160 is connected to two non-volatile memories 114 (NVRAM I) and 116 (NVRAM-II) that, among other things, contain the postally relevant data. The two non-volatile memories NVRAM I and II are physically separated and implemented in different technologies. They can be addressed for writing and reading by the processor, can be modified by the FPGA and can be read from outside the security module. One of the non-volatile memories is implemented in a mixed EEPROM-SRAM technology and the other is an SRAM with traditional technology.
The delivery of the system voltage (main power supply interface) and of the battery voltages to the interface has been identified with broad black arrows. Thin black arrows identify the supply of assemblies with a corresponding operating voltage from the power manager 11 or from the monitoring unit 12. Thin white arrows identify query and control lines.
The erase hardware include a portion of the power manager, a control line CL and a bus driver unit 127. The control lines of the destruction detection unit 15 and the voltage monitoring unit 12 are interconnected to form a shared control line CL that is shown with broken lines. The units 12 or 15 control an electronic switchover unit S via the common control line CL that selectively applies operating voltage UB or erase voltage UC (or ground potential UM) to the VCC pin of the SRDI main memory 122. This SRDI-RAM memory is not directly connected to the processor bus. All digital signals are supplied via driver circuits of the bus driver unit 127 that have outputs that can be switched high-impedance. The bus thus can be decoupled from the SRDI main memory 122. The bus driver unit 127 is likewise driven by the common control line CL.
The following detector and monitoring units monitor the proper operation of the security module:
When they respond (or-operation), the units 12 and 16 cause erasure of the data in the SRDI memory.
The unit 13 can only produce a status change and can only be queried by the processor during the operation or given the system start of the program of the security module.
The temperature sensor monitors the operating temperature of the module and triggers a reset if the temperature drops below a predefined value or rises above another predefined value. Improper use thus is prevented and the user data are protected. A reset is likewise triggered when the input voltage of the module is too low or too high or when the internal operating voltage drops below a specific level. The status of all other voltages can be interrogated by the system software. The security module 100 contains an LED (not shown) for status indication and is cast with a hard, opaque casting compound 105 in which a sensor membrane 153 is embedded. One of the event detectors, the destruction detection unit 15, is connected to conductor loops of the sensor membrane 153.
An open secure socket layer library is located in the middle layer; the layers (pre-initializer and application software) lying above this can use it. The collection (open SSL library) contains a large number of sets of cryptographic algorithms (DES triple-DES, RSA, DAS, SHA-1, HMAC, etc.) and PKCS and ASN.1 formatting tools such as, for example, the X.509v3 certification standard. The open SSL library also contains a small and efficient collection of elliptic curve digital signature algorithms (ECDSA) that allow a selection of one or more different elliptical curves—that are recommended by NIST.
The loader contains a start loading program (boot loader with an integrated code-checking program. The start loading program first undertakes a loading of the pre-initialization program that, once loaded and implemented, cannot be replaced by a different pre-initialization program but at most by a part of the application program. Before the start loading program stores the status of a loaded part of the application program as being valid, the latter is checked by means of certificate code. The certificate code is offered together with each part of the application program. A code-checking key is required for the review, this being loaded during the manufacture during the framework of a pre-initialization.
A hash value is formed from the data of the application program, this being encrypted to form a message authorization code (MAC), for example with a key according to the known DES method (data encryption standard). The MAC is attached to the application program as certificate code. The code review key, however, must be stored in the security module protected against readout when the code review key is a key of a symmetrical encryption method (DES).
Read-out protected storage is not needed if a public code review key is loaded. Preferably the code review key is a public verification key, and the public verification key and an appertaining, secret signing key form a key pair, and the certificate code is generated by the manufacturer using the secret signing key and appertains to the data of at least a part of an application program. To that end, a hash value is formed from the data of the application program, this being encrypted to form a digital signature, for example with a secret signing key according to the known RAS method (Rivest, Shamir and Adleman). The code review key is generated, stored and constantly checked for veracity by a trustworthy center of the manufacturer, whereby the manufacturer utilizes a world-wide public key infrastructure. The following standards exist for the public key infrastructure that is employed:
After a manufacturer device (not shown) is turned on, energy is made available and a check is made in Step 200 to determine whether the turn-on had the intended result, so that a system voltage is present at the security module. If not, then a branch is made to a wait loop and the query is constantly repeated. When the system voltage is present at the security module, a startup program is started in Step 201 and at least a first part of the start loading program with the programming functionality is copied into the main memory SRAM 121. The microprocessor 120 is programmed by the start loading program so that the memory area of the FLASH program memory wherein the start loading program is located can only be copied but not overwritten. Information about an application program that was already loaded can be stored in non-volatile fashion at another memory area of the FLASH program memory 128 or at some other location. The information includes a status variable. In the subsequent program execution, the microprocessor determines in Step 202 on the basis of this information whether a valid status of an application program is present. If so, then the application program is started in Step 209. Subsequently, a constant check is made in Step 210 to determine whether data for erasing the application program are present in the communication interface. When this is not the case, then a branch is made back to the Step 209 and the application program is started. Otherwise, a branch is made from Step 210 to a Step 211 wherein the existing application program is identified as “invalid” by means of a status variable.
At the next booting, the start loading program (boot loader) is reactivated and can store new application program data
First, the microprocessor determines in Step 202 that the existing application program has been characterized as “invalid”, or, that there is no valid status of the application program; a branch is then made from Step 202 to Step 203 wherein a second part of the start loading program is started with a communication interface call and a functionality check. A check is made in a following query Step 204 as to whether application program data and identifier data are present in the communication interface. When this is not the case, then a branch is made to a waiting loop and the query is constantly repeated. Given a positive result in Step 204, a branch is made to a query Step 205 wherein a check is made to determine whether the identifier data identify a successor of the stored predecessor. To that end, the microprocessor compares the supplied identifier data to store identifier data. The identifier data can be stored in the further memory area of the FLASH program memory wherein all information about a program that has already been loaded are listed. The manufacturer also supplies information data belonging to the application program data at the communication interface, such as: start and end address of the program, check sum (CRC), program type, version, revision. The identifier data include the program type, the version data and the revision data.
If the identifier data in the communication interface do not relate to a successor of the stored predecessor, a branch can be made back to a waiting loop to Step 204. If the identifier data present in the communication interface relate to a successor of the stored predecessor, then a branch is made to a Step 206. The microprocessor is controlled with the programming functionality corresponding to the aforementioned, first sub-program of the start loading program. The copied application program data are stored at a memory location of the program memory provided for the application program.
A validity certificate, for example a cryptographic signature, belonging to the application program is used in the following query Step 207 for checking the legitimacy of the application program. When, however, no legitimacy is present, then a branch is made back to the query Step 204. In the following Step 208, a verified application program initiates storage of information about a valid status in non-volatile fashion, and a branch is then made back to the query Step 204. Given authenticity of the loaded program part (including at least one part of the application program, for example) a status variable is stored in the non-volatile memory of the security module or is written into the aforementioned, further memory location for information data that identify said loaded program part as valid. Preferably, the status variable is a flag with which the loaded application program is identified as valid after a cryptographic signature was verified that proves the authenticity of the loaded application program.
New, valid program data, whose appertaining identifier data identify a successor are only written onto a memory location only when the program that already exists was previously identified in the Step 211 with the status variable “invalid”. The latter assumes that data for erasing the application program are present in the communication interface (Step 210).
As a result of the modification of its functionality that is thereby achieved, the security module can be adapted to various devices and can be utilized for performing a multitude of jobs.
The security module, which is intended primarily for utilization in postal devices, particularly for utilization in a postage meter machine, is referred to as postal security device or as security accounting device. A PSD, just like an SAD, is based on an identical hardware. The PSD uses an asymmetrical encryption algorithm (RSA, ECDSA), but the SAD uses a symmetrical encryption algorithm (DES, triple-DES). The security module also can include further structure that allows it to operate in different devices. The invention enables the security module to be plugged, for example, onto the motherboard of a personal computer that, as PC franker, drives a commercially obtainable printer.
Although modifications and changes may be suggested by those skilled in the art, it is the intention of the inventors to embody within the patent warranted hereon all changes and modifications as reasonably and properly come within the scope of their contribution to the art.
| Number | Date | Country | Kind |
|---|---|---|---|
| 101 37 505 | Jul 2001 | DE | national |
| Number | Name | Date | Kind |
|---|---|---|---|
| 4849927 | Vos | Jul 1989 | A |
| 5144659 | Jones | Sep 1992 | A |
| 5359659 | Rosenthal | Oct 1994 | A |
| 5386469 | Yearsley et al. | Jan 1995 | A |
| 5421006 | Jablon et al. | May 1995 | A |
| 5778070 | Mattison | Jul 1998 | A |
| 5844986 | Davis | Dec 1998 | A |
| 6151657 | Sun et al. | Nov 2000 | A |
| Number | Date | Country |
|---|---|---|
| 0 402 683 | Dec 1998 | EP |
| 1 087 294 | Mar 2001 | EP |
| 1 100 014 | May 2001 | EP |
| WO 9820461 | May 1998 | WO |
| Number | Date | Country | |
|---|---|---|---|
| 20030014673 A1 | Jan 2003 | US |
