Patent Grant
8478695
The invention relates to franking systems and methods, and more particularly to a system and method in which a postal security device (PSD) is used to generate postage indicia.
Stemming from the proliferation of use of personal computers (PCs), software has been made commercially available for installation in a PC to frank or print a postage indicium, serving as proof of postage, on an envelope or a label using a conventional printer connected to the PC. In addition, because of the increasing popularity of the Internet, services have been provided to download postage funds through the Internet to a postal security device (PSD) which may be connected to the PC and is used to account for postage dispensation.
To allow printing of postage indicia using a conventional printer, which is typically unsecured, a postal authority, e.g., the United States Postal Service (USPS), promulgated specifications for the PSD to secure the accounting of the postage dispensation, and for the postage indicia to detect possible fraud. For example, these specifications include the “Information-Based Indicia Program (IBIP) Performance Criteria for Information-Based Indicia and Security Architecture for Open IBI Postage Evidencing Systems,” dated Jun. 25, 1999; and “Information-Based Indicia Program (IBIP) Performance Criteria for Information-Based Indicia and Security Architecture for Closed IBI Postage Metering Systems,” Jan. 12, 1999, respectively.
According to such specifications, a postage indicium includes not only a human readable portion including text such as the date of mailing and amount of postage, but also a machine readable portion in the form of a two-dimensional barcode. The machine readable portion contains information concerning, e.g., the mailing date, the postage amount, an identification (ID) of the PSD being used, a mail class, a software ID, etc. To detect possible fraud, such information is cryptographically signed, resulting in a digital signature, also included in the machine readable portion, for authenticating the postage indicium.
In general, a PSD has a secure housing, and within the secure housing are accounting registers and a cryptographic engine. These accounting registers typically include an ascending register and a descending register. As is well known, the ascending register is used to keep track of the amount of postage dispensed. On the other hand, the descending register is used to keep track of the postage fund amount available for postage dispensation. The cryptographic engine generates the aforementioned digital signature resulting from signing the machine readable information to authenticate the postage indicium, in accordance with a well known public key algorithm. One such public key algorithm may be the Digital Signature Algorithm (DSA) described, e.g., in “Digital Signature Standard (DSS),” FIPS PUB 186, May 19, 1994. The engine also carries out cryptographic authentication and signing for communications with an external device such as a remote computer system maintained by a postage franking machine manufacturer or of the postal authority. For example, such communications may be used to set up and maintain the PSD, and to replenish the postage fund by adjusting the value of the descending register in the PSD.
In accordance with the invention, multiple crypto processors are used in a PSD to participate in franking transactions in a multiplexed manner to dispense postage. Among other things, these crypto processors generate digital signatures for inclusion in postage indicia to authenticate the same. For example, where a digital signature contains a first signature value r independent of any input to the PSD, and a second signature value s dependent on certain inputs to the PSD in accordance with the DSA, the number of crypto processors used is determined based on a first duration for computing the signature value r and a second duration for computing the signature value s.
In an illustrative embodiment, a main processor in the PSD generates accounting data concerning postage dispensation for all of the franking transactions, and creates and stores records of the transactions. Such accounting data includes, e.g., ascending and descending register values. In accordance with an aspect of the invention, as each crypto processor takes turns participating in the franking transactions, the crypto processor independently generates accounting data concerning postage dispensation for the transactions associated with the crypto processor. Advantageously, the independently generated accounting data is used to verify the corresponding accounting data generated by the main processor. When such corresponding accounting data is verified, the crypto processor creates and stores records of the franking transactions associated therewith. As a result, the crypto processors jointly re-create the records of all of the franking transactions, and store the created records in a distributed manner.
Further objects, features and advantages of the invention will become apparent from the following detailed description taken in conjunction with the accompanying drawing, in which:
As is well known, ascending register 230 is used to keep track of the amount of postage dispensed. On the other hand, descending register 235 is used to keep track of the postage fund amount available for postage dispensation. When the descending register value decreases over time below a predetermined limit, system 100 can no longer dispense postage until descending register 235 is reset. Such a reset may be achieved by way of electronic funds transfer, in accordance with a well known telemeter setting (TMS) technique, via a communication connection (e.g., a dial-up connection or an Internet connection) established by modem 120 to a remote computer system handling TMS transactions.
Because the contents of SRAM 207 need to be refreshed from time to time, SRAM 207 is required to be powered by a battery (not shown) in PSD 110. For fear that the battery power should be unexpectedly out, the ascending and descending register values, and the transaction log are redundantly stored in flash memory 209 whose contents, unlike those of SRAM 207, need not be refreshed. Flash memory 209 also contains program instructions for processor 203 to orchestrate the operation of PSD 110. This operation includes generation of digital signatures for inclusion in postage indicia to be franked or printed by printer 115 on envelopes, or labels for application onto mailpieces. The digital signatures are used to authenticate the respective postage indicia.
For example, in accordance with the USPS “Information-Based Indicia Program (IBIP) Performance Criteria for Information-Based Indicia and Security Architecture for Closed IBI Postage Metering Systems,” Jan. 12, 1999, a postage indicium includes not only a human readable portion containing text such as the date of mailing and amount of postage, but also a machine readable portion in the form of a two-dimensional barcode. The machine readable portion contains postal data elements including, e.g., the mailing date, the postage amount, the ascending and descending register values, an identification (ID) of the PSD being used, a mail class and a software ID, and a digital signature resulting from digitally signing such postal data elements.
The generation of the digital signature and subsequent verification thereof require use of the public key and private key pair in buffer 237, in accordance with a well known public key algorithm. In a conventional manner, the pair of keys are generated mathematically. In this particular illustrative embodiment, the public key algorithm used is the Digital Signature Algorithm (DSA) described, e.g., in “Digital Signature Standard (DSS),” FIPS PUB 186, May 19, 1994. Cryptographic engine 220 described below uses the private key in buffer 237 to sign the aforementioned postal data elements. The resulting digital signature, which is distinct for each postage indicium, is included in the machine readable portion thereof.
Unlike the public key which may be made available to the public in the postage indicium, the corresponding private key needs to be securely stored in PSD 110. Otherwise, using the private key which is illegally obtained by, say, tampering with PSD 110, a perpetrator may fraudulently generate postage indicia without accounting for the postage expended. Thus, to prevent fraud, for example, any tampering with PSD 110 may cause the power of the battery therein to be cut off, thereby “zeroizing” or clearing the contents of SRAM 207, including any private key therein.
Similarly, the public and private key pair in key buffer 239, different from the key pair in buffer 237, is used for authenticating communications with the aforementioned remote computer system to set up and maintain PSD 110, and to replenish the postage fund therein in a manner described before.
In accordance with the invention, cryptographic engine 220 includes N crypto processors, denoted 225-1 through 225-N, where N is an integer determined optimally in a manner to be described. In this illustrative embodiment, each crypto processor is structurally identical. For example, similar to every other crypto processor, crypto processor 225-1 comprises, inter alia, processing unit 227 and memory 229. In order to fully appreciate the operation of engine 220 involving crypto processors 225-1 through 225-N in generating digital signatures, the make-up of a digital signature will now be described.
In this instance, a digital signature is composed of a first signature value r which is 20 bytes long, and a second signature value s which is also 20 bytes long. In accordance with the DSA, the generation of the signature value r involves generation of a random (or pseudo-random) integer k in each franking transaction. The value r is a function of the integer k and certain given DSA parameters, and independent of the aforementioned postal data elements to be signed. However, the generation of the signature value s involves applying a secure hash algorithm (SHA) onto the postal data elements to be signed. One such SHA is described in “Secure Hash Standard,” FIPS PUB 180-1, Apr. 17, 1998.
Specifically, the signature value s, dependent on the values of the postal data elements to be signed, may be expressed as follows:
s=(k−1(SHA(M)+xr))mod q, (1)
where “k−1” represents the multiplicative inverse of the random integer k; “M” represents the postal data elements to be signed onto which the SHA is applied; “x” represents the value of the aforementioned private key stored in key buffer 237; “r” represents the aforementioned first signature value; and “mod q” represents a standard modulus operation having a base q, which is one of the given DSA parameters. It should be noted at this point that the time required to calculate r (Tr) is much longer than that required to calculate s (Ts).
Since the first signature value r is independent of the values of the postal data elements to be signed, i.e., M in expression (1), in accordance with an aspect of the invention, engine 220 has crypto processors 225-1 through 225-N each pre-calculate r even before receiving the actual postal data elements to be signed in a franking transaction. When the actual postal data elements are received by engine 220, any crypto processor having an available pre-calculated r can be used to calculate s in accordance with expression (1), thereby generating the digital signature. Thus, with the pre-calculated r, the time that the crypto processor takes to generate the digital signature virtually equals the time required to generate the second signature value s, i.e., Ts, which is relatively short.
To increase the digital signature generation efficiency, multiplex logic 215 of conventional design is employed to feed sets of postal data elements from main processor 203, corresponding to a sequence of franking transactions, to crypto processors 225-1 through 225-N in a multiplexed manner for them to take turns generating digital signatures. It should be noted that the maximum multiplex rate by multiplex logic 215, or the maximum rate of generation of the digital signatures, in this instance is 1/Ts assuming that pre-calculated r's are used. It can be shown that the minimum number of crypto processors (N in this instance) needed can be determined using the following equation so that when multiplex logic 215 distributes a set of postal data elements to be signed, at least one of the crypto processors in engine 220 is available with a pre-calculated r to generate the corresponding s, and thus the corresponding digital signature:
where [•] represents a standard floor function which takes the value of only the integer portion of the argument “•” expressed as a decimal; and Tr and Ts represent the Limes required to calculate r and s, respectively, as mentioned before.
To keep track of the franking transactions handled by PSD 110, main processor 203 maintains counter 233 in SRAM 207, which counts in an ascending order starting from zero. Processor 203 causes counter 233 to increase its count by one each time to account for a new franking transaction. Thus, the current count, denoted TID, is used to identify the franking transaction being conducted. Main processor 203 also maintains transaction log 241 which records past franking transactions.
As mentioned before, crypto processors 205-1 through 205-N generate digital signatures for a sequence of franking transactions in a multiplexed manner. Specifically, crypto processor 205-n, where 1≦n≦N, is assigned by multiplex logic 215 to generate digital signatures for the transactions having TIDs=n, N+n, 2N+n, . . . , kN+n, . . . , where k is an integer greater than or equal to zero.
In accordance with another aspect of the invention, each crypto processor is used not only to generate the digital signature for each franking transaction associated therewith, but also to verify the accounting of the ascending and descending register values leading to the transaction, and to record the transaction in a log when the accounting is verified. To that end, each crypto processor includes an ascending sub-register, a descending sub-register and a sub-log in its memory. For example, crypto processor 225-1 includes ascending sub-register 242, descending sub-register 243, and sub-log 245 in memory 229.
When PSD 110 is initially put in service, the value stored in the ascending sub-register of each crypto processor is set to equal that stored in ascending register 230, hereinafter referred to as the “initial ascending register value.” Similarly, the value stored in the descending sub-register of each crypto processor is set to equal that stored in descending register 235, hereinafter referred to as the “initial descending register value.” When the first franking transaction is conducted to dispense first postage, main processor 203 causes counter 233 to increase its count from zero to one, thereby identifying the first franking transaction with TID=1. In addition, main processor 203 polls the current values of ascending register 230 and descending register 235, respectively. Main processor 203 then deducts the first postage value from the current descending register value (which is the initial descending register value in this instance), and adds the first postage value to the current ascending register value (which is the initial ascending register value in this instance). The resulting ascending and descending register values are temporarily stored in a first buffer (not shown) and a second buffer (not shown) in SRAM 207, which are referred to as the “temporary ascending register value” and “temporary descending register value,” respectively. Main processor 203 thereafter transmits to engine 220, through multiplex logic 215, a first ensemble of information including (a) the TID identifying the current transaction (in this instance TID=1), (b) the first postage value, (c) the temporary ascending register value, (d) the temporary descending register value, and (e) a first set of postal data elements which need to be signed by one of the crypto processors in engine 220 to generate a digital signature.
Multiplex logic 215 is programmed to route the first ensemble having TID=1 to crypto processor 225-1, in accordance with the schedule of
In addition, the values in ascending register 230 and descending register 235 and the newly created record in log 241 are redundantly stored by main processor 203 in flash memory 209.
Continuing the above example, in conducting the second franking transaction, identified by TID=2, to dispense second postage, main processor 203 similarly generates temporary ascending and descending register values based on the second postage value. In this instance, the temporary ascending register value equals the current value of ascending register 230 plus the second postage value; and the temporary descending register value equals the current value of descending register 235, less the second postage value. These temporary values are to be verified by crypto processor 225-2 associated with the second transaction before the second transaction is posted. To that end, main processor 203 creates a second ensemble for transmission to crypto processor 225-2 through multiplex logic 215. This second ensemble contains information including (a) the TID identifying the current transaction (in this instance TID=2), (b) the second postage value, plus the first postage value, (c) the temporary ascending register value, (d) the temporary descending register value, and (e) a second set of postal data elements need to be signed to generate a second digital signature. Thus, the first and second ensembles contain similar information except item (b) therein. Item (b) in the second ensemble includes not only the current, second postage value, but also the past, first postage value. This stems from the fact that crypto processor 225-2, like every other crypto processor in engine 220, is periodically engaged to conduct franking transactions. In this instance, the ascending sub-register and descending sub-register of crypto processor 225-2 stand at the initial ascending register value and initial descending register value, respectively, which correspond to TID=0. With the past, first postage value, the ascending and descending sub-registers can “catch up” with the current values in ascending register 230 and descending register 235 corresponding to TID=1. To that end, crypto processor 225-2 adds the first postage value to the value in the ascending sub-register thereof and deducts the first postage value from the value in the descending sub-register thereof. The second postage value is further added to the ascending sub-register value, and deducted from the descending sub-register value to verify the validity of the temporary ascending register value in item (c) and that of the temporary descending register value in item (d) of the second ensemble, which correspond to TID=2. If the temporary values are valid, i.e., the resulting ascending sub-register value equal to the temporary ascending register value and the resulting descending sub-register value equal to the temporary descending register value, the accounting leading up to and including the current transaction is verified. In that case, crypto processor 225-2 similarly posts the current transaction by creating a record in its sub-log corresponding to TID=2 in the format of
Similarly, crypto processors 225-3 through 225-N are periodically engaged to conduct franking transactions. As a result, the sub-log in crypto processor 225-n, 1≦n≦N, contains transaction records corresponding to TID=n, n+N, . . . , n+kN, . . . . That is, crypto processor 225-1 includes in its sub-log transaction records corresponding to TID=1, N+1, 2N+1, . . . ; crypto processor 225-2 includes in its sub-log transaction records corresponding to TID=2, N+2, 2N+2, . . . ; and so on and so forth. In other words, the transaction records in log 241 corresponding to all of the transactions are re-created by, and stored in, crypto processors 225-1 through 225-N in a distributed manner. Advantageously, the sub-logs of crypto processors 225-1 through 225-N can be jointly used to verify the records in log 241 to detect any tampering therewith.
Because of the periodic engagement of each crypto processor, in order for the ascending sub-register and descending sub-register of the crypto processor to “catch up” with the current values of ascending register 230 and descending register 235, in general, item (b) of the ensemble transmitted to the crypto processor needs to include not only the postage value in the current transaction, say, with TID=p, but the postage values in the last p−1 transactions if p<N, or the postage values in the last N−1 transactions if p≧N.
As mentioned before, a reset of descending register 235 occurs when postage funds are replenished in PSD 110, thereby increasing the value in descending register 235. A reset of ascending register 230 occurs when the ascending register value reaches a predetermined maximum value, thereby re-starting ascending register 230 at a predetermined reset value, e.g., zero. Thus, in order to completely “catch up” with the current ascending and descending register values, the ascending sub-register and descending sub-register of each crypto processor need to take into account any reset of ascending register 230 and descending register 235, respectively. To that end, field 513 includes the TIDA identifying the franking transaction immediately before a reset of ascending register 230 occurs. For example, when ascending register 230 is reset between transactions TID=2250 and TID=2251, TIDa
In addition, main processor 203 determines TIDd
Thus, with ensemble 500, to verify the temporary ascending register value in field 507, a crypto processor receiving the ensemble needs to determine whether TIDa
Referring back to
Field 517 of ensemble 500 includes cyclic redundancy check (CRC) bits, resulting from performing well known binary block CRC coding on the contents of fields 503, 505, 507, 509, 511, 513 and 515, for detecting any error in the ensemble occasioned during its transmission to the crypto processor.
In operation, when a user at computer 105 conducts a franking operation to print a postage indicium, the user is prompted to enter mailing information concerning the destination zip code, weight, mail class (or rate category), any special services, etc., of a mailpiece to be mailed, as indicated at step 705 in
Based on the CRC bits in field 617 of the received ensemble, processing unit 227 at step 723 in crypto processor 225-1 determines whether the received ensemble is error free. If it is determined that the received ensemble is erroneous, unit 227 at step 726 returns a negative acknowledgement to main processor 203 for re-transmission of the ensemble. Otherwise, unit 227 at step 729 verifies the temporary ascending register value and the temporary descending register value by comparing them with the register values independently computed by unit 227 in a manner described above. If the temporary register values cannot be verified, unit 227 in this instance causes an error message to be displayed on computer 105, and franking system 100 to be inoperative until it is satisfactorily audited and re-started by authorized personnel, as indicated at step 732.
Otherwise, if the temporary ascending and descending register values are verified, unit 227 at step 735 updates the values in ascending sub-register 242 and descending sub-register 243, and posts the current franking transaction in sub-log 245 in a manner described above. In addition, unit 227 at step 738 in
The foregoing merely illustrates the principles of the invention. It will thus be appreciated that those skilled in the art will be able to devise numerous other arrangements which embody the principles of the invention and are thus within its spirit and scope.
For example, in the disclosed embodiment, the DSA of the DSS is illustratively used for authenticating postal data in a postage indicium, another well-known data authentication algorithm such as the RSA or Elliptic Curve algorithm may be used, instead.
In addition, in the disclosed embodiment, franking system 100 is configured as an open system. It will be appreciated that the franking system may be configured as a closed system in the form of a postage meter including therein a dedicated printer.
Finally, PSD 110 is disclosed herein in a form in which various functions are performed by discrete functional blocks. However, any one or more of these functions could equally well be embodied in an arrangement in which the functions of any one or more of those blocks or indeed, all of the functions thereof, are realized, for example, by one or more appropriately programmed processors.
This is a continuation of application number 09/674,947 filed Nov. 8, 2000, now abandoned which is a 371 national phase of PCT/US99/24204 filed 15 Oct. 1999, the contents of which are incorporated herein by reference.
| Number | Name | Date | Kind |
|---|---|---|---|
| 313787 | Hoevenbergh | Mar 1885 | A |
| 4447890 | Duwel et al. | May 1984 | A |
| 4632252 | Haruki et al. | Dec 1986 | A |
| 4725718 | Sansone et al. | Feb 1988 | A |
| 4743747 | Fougere et al. | May 1988 | A |
| 4757537 | Edelmann et al. | Jul 1988 | A |
| 4775246 | Edelmann et al. | Oct 1988 | A |
| 4802218 | Wright et al. | Jan 1989 | A |
| 4812994 | Taylor et al. | Mar 1989 | A |
| 4831555 | Sansone et al. | May 1989 | A |
| 4853865 | Sansone et al. | Aug 1989 | A |
| 4853961 | Pastor | Aug 1989 | A |
| 4858138 | Talmadge | Aug 1989 | A |
| 4934846 | Gilham | Jun 1990 | A |
| 4941176 | Matyas et al. | Jul 1990 | A |
| 4949381 | Pastor | Aug 1990 | A |
| 5103478 | Matyas et al. | Apr 1992 | A |
| 5142577 | Pastor | Aug 1992 | A |
| 5181245 | Jones | Jan 1993 | A |
| 5377268 | Hunter | Dec 1994 | A |
| 5448641 | Pintsov et al. | Sep 1995 | A |
| 5510992 | Kara | Apr 1996 | A |
| 5535279 | Seestrom | Jul 1996 | A |
| 5559890 | Obermeier et al. | Sep 1996 | A |
| 5586036 | Pintsov | Dec 1996 | A |
| 5603410 | Kara | Feb 1997 | A |
| 5606507 | Kara | Feb 1997 | A |
| 5666284 | Kara | Sep 1997 | A |
| 5666421 | Pastor et al. | Sep 1997 | A |
| 5682318 | Kara | Oct 1997 | A |
| 5715164 | Liechti et al. | Feb 1998 | A |
| 5717597 | Kara | Feb 1998 | A |
| 5774886 | Kara | Jun 1998 | A |
| 5778076 | Kara | Jul 1998 | A |
| 5781438 | Lee et al. | Jul 1998 | A |
| 5796834 | Whitney et al. | Aug 1998 | A |
| 5796836 | Markham | Aug 1998 | A |
| 5801364 | Kara et al. | Sep 1998 | A |
| 5801944 | Kara | Sep 1998 | A |
| 5805701 | Ryan, Jr. | Sep 1998 | A |
| 5812991 | Kara | Sep 1998 | A |
| 5819240 | Kara | Oct 1998 | A |
| 5822739 | Kara | Oct 1998 | A |
| 5825893 | Kara | Oct 1998 | A |
| 5982506 | Kara | Nov 1999 | A |
| 5983209 | Kara | Nov 1999 | A |
| 6073125 | Cordery et al. | Jun 2000 | A |
| 6128735 | Goldstein et al. | Oct 2000 | A |
| 6347143 | Goff et al. | Feb 2002 | B1 |
| 7272581 | Athens et al. | Sep 2007 | B2 |
| Number | Date | Country |
|---|---|---|
| 2225443 | Oct 1997 | CA |
| 2263437 | Dec 1998 | CA |
| 0 876 026 | Apr 1998 | EP |
| 11-27311 | Jan 1999 | JP |
| Entry |
|---|
| English translation of the abstract for JP11-27311. |
| Information-based indicia program (IBIP), Performance criteria for information-based indicia and security architecture for open IBI postage evidencing systems, XP-002161216, Jun. 25, 1999, 37 pages. |
| Szewerenko et al. “Giving linkers their due”; Electronic Design, Nov. 20, 1995, vol. 43, No. 24, p. 131-132, 134-135 and 139-140 (abstract only). |
| Number | Date | Country | |
|---|---|---|---|
| 20070136216 A1 | Jun 2007 | US |
| Number | Date | Country | |
|---|---|---|---|
| Parent | 09674947 | US | |
| Child | 11703772 | US |
