Method for securely storing variable data

0001The invention relates to a method for the secure storage of variable data, especially the data while a can change telesetting.

0002A power failure can lead to a record in a memory is stored incorrectly. To operate a data processing system, it is therefore already known, a second memory for an identical record and provide a state memory for a state identifier, the latter indicating whether the data set from the first or second memory read will be when the power returns.

0003Error in the Status code can store the redundant State identification are rendered ineffective. The most common condition identifier at a majority test but does not always have the correct status identifier be. It is only most likely that the prevailing state identification also the right one. Also an additional plausibility check only checks the but belonging to a valid range, provides no clear State whether the state identifier is correct or not. With the above- The method described is therefore not detected an error, the most common is stored while in the acceptable range of values.

0004It is another object of the invention, the safety when redundant to increase saving by simple means and possibly occurring errors clear off.

0005To achieve this object it is proposed that a means of a pointer first data is determined as the current steady record whose available data for a query are available, that with a change of data this change is made in the non-current second record that then by means of the pointer of the second data set to the current record is determined and that the data from the current data set in the second not the current first data to be copied.

0006These process steps described above are both at Initializing the memory, ie also in the storage of the initial data as operation executed. The current record is always invariable. His data also after a power failure is not at risk because one Power failure usually only to errors in ongoing writes can lead. The inventive method is independent of the Detection of a power failure during the storage process. On essential step of the method lies in the fact that Consistency of the stored data, and the equality of the both in the Records to check the stored data and, if necessary, to restore, as will be described in more detail below.

0007Further features and advantages of the invention result from the further Subclaims and the following description, which in conjunction with the Drawings accompanying the invention of an exemplary embodiment explained. Show it:<dl tsize="15"><dt>Fig. 1</dt><dd>a schematic diagram of a franking machine and a data center, </dd><dt>FIGS. 2a and 2b</dt><dd>a schematic representation of a remote value setting process with changing a default value for the voice method,</dd><dt>FIGS. 3a and 3b</dt><dd>a schematic representation of a remote value setting process with changing a default value in Modem methods</dd><dt>Fig. 4</dt><dd>the allocation of memory for the secure Storing data in the form of two data sets,</dd><dt>Fig. 5</dt><dd>a flowchart for explaining the initialization of the Data in the two data sets,</dd><dt>Fig. 6</dt><dd>a flow chart illustrating the storage of Data during operation and</dd><dt>Fig. 7</dt><dd>a flowchart for explaining the examination and Correction of data in the two data sets.</dd></dl>

0008In Figure 1, 10 a user station called, the meter a 12 and a phone 14 comprises. This telephone or communication terminal, such as a modem, is a telephone line 15 in conjunction with a Telephone or communication terminal 16 in a data center 18, further an accounting device 20 contains.

0009The postage meter 12 includes a generally denoted by 22 Data processing device having a CPU 24, a credit memory 26, a preset value storage 28 and a cryptographic device 30, which a key memory 12 includes. The data processing device 22 includes of course even more parts, memory and registers here are not shown, since they for the description of the invention are not required procedure. In an advantageous variant, instead of the separate means 30 software agents or program storage means of the CPU 24 used in connection with the non-volatile memory key 32 are to perform the encryption. In the case of an automatic Data interchange (modem method) is the data processing device 22 connected via a line 23 to the communication terminal modem 14, which the phone 14 then replaced. With the data processing device 22 is further connected an input device 34, such as a keyboard, a display means 36 and printing means 38th

0010The accounting device 20 in the data center 18 includes a Input device 40 and a data processing device 42 with a CPU 44, a preset value memory 45, an accounting memory 46 and a cryptographic device 48 with a key memory 50. Again, the encryption can take place in the device 48 in connection with the CPU 44 and carried out the non-volatile key storage means of software. For the Modem procedures, the data processing means 42 via a conduit 51 connected to the modem, which replaces the telephone 16 in this case.

0011When Voice method of data exchange between the user station is 10 and the data center 18 via the telephones 14 and 16, namely preferably by telephonic exchange between the users of the Postage meter 12 and an operator in the data center 18. The by Expiration of telesetting method in the meter and the data center material relevant operations will now reference to the figures 2a and 2b will be explained, the left or the processes in the user station Meter (FM) and the right processes in the data center (DC) show.

0012The change in value and telesetting method illustrated in Figure 2 begins characterized in that, in the input device 34 of the postage meter 12 an identity number (PAN) inputs (S1) by a special key 52 (Fig. 1) is confirmed. the stored in Vorgabwertspeicher 28 appears in the display Default value. In the event that this value is to be changed, branched the transaction, the program of the data processing device "Value change" corresponding routine (S2). Subsequently, the desired preset value by means of the input means 34 in the data processing device entered and by pressing the special button 52 confirmed.

0013The user now calls the operator in the data center 18 to (S4) and tells him that Identity number (PAN) with. The operator enters the identity number in the Input device 40 of the settlement device 20 a to the caller and the meter 12 of the user terminal 10 to identify. The examination of Identity number is shown at S6. If the check is negative, the canceled procedures and optionally repeatedly. Can the franking machine identify the other hand, the process continues. Here are the The operator of the user's default request and optionally further Information about the postage meter, in particular values ​​in the notified accounting registers.

0014The meter is the continuation of the process of the Identity number, the default request and an additional information, For example, a further register value using a key K1 a first code number is calculated (S7) that the in the display device 36 Meter display 12 and from the user to the operator in the data center is transmitted 18th At step S8, this code number will be in the Data center 18 checks using the data stored in the data center Key K1. With a negative test result, the test with at will Keys used previous transaction repeatedly. succeed the Verification now, it means that the previous transaction in the Meter was not running or not completely and correctly. The previous transaction will therefore be canceled and the process continued. Can the code number with the preceding key can not be verified, the method is terminated. Is it possible to contrast the first code number successfully verify the default value is in the memory 45 of the data center stored and the data processing means 42 in the data center 18 calculates a second code number from the identity number of the additional information and the key K1. Further, a second key K2 (S9) is calculated. This second code number, in which the new key K2 is integrated, is the informed user, who in the input means 34 of the franking machine enters. The device 30 kryptrographische verfiziert in the meter the second code number extracted from the transmitted second code number to K2 key and stores it in place of the key K1. With negative Result is aborted the process, a positive result is the entered default request stored in the standard value memory 28, the deletes previous default value (S11).

0015Thus, the first transaction is completed and changed the default value. Of the User now has the option to terminate the procedure and by Actuating a further special key 54, the franking machine 12 in the reset franking or by repeated actuation of the first Special button 52 to initiate the reloading process (S12). Happens latter is in the meter using the identity number and the Additional information using the stored key K2, a third Code number is calculated, which is communicated to the data center (S13). in the Data center is the third code number verified (S14). If negative, the process is aborted, the result is positive, the calculated Data center from the identity number of the additional information and the K2 key a fourth code number (S15) that the franking machine together is received with a new key K3. In the postage meter as in the first transaction, the fourth code number is verified (S16) and the new extracted key K3 from the fourth code number, and stored, as shown at the first transaction with the key K2 was made. be in the data center each of the old and the new key is stored. If negative, is the process aborted. A positive result is the in Default value memory 28 of the postage meter to the stored value Funds remaining in the bank memory 26 of the postage meter and the Default value memory 45 of the settlement device 20 stored value to the remaining balance in the accounting memory 46 of the data center 18 adds (S17). This is also the second transaction, ie the telesetting with modified default completed. The meter returns automatically in the back franking.

0016When a change of the default value is not wanted, is Actuating the special key 52 or an optionally provided third confirmed special key the stored in the standard value memory 28 default and the process proceeds directly from step S2 to step 4 'in Fig. 2b. Of the User calls the data center and tells the operator the identity number (PAN) and optionally other information with (S5 '). Is the Identity number correctly (S6 '), the remote valuation process then correspondingly the above description of step S13 to step S17.

0017It is understood that the operator further data on the franking machine, in particular further register readings can query to the correctness of all Accounting data in the franking machine and data center to check. It is also possible, further information and additional subkey included in the calculation of the code number, if to increase the Security seem sensible. If the data center in a step S14 of the Meter transmitted code number is checked, and the result is negative is, is always with the in the meter in just previous transaction used key testing again repeated. Thus, a case will be detected, in which a transaction in the Franking machine has not been completed correctly, without the Data center has received knowledge thereof. In this case, would be the from the data center sent new keys not in the meter stored and therefore the meter encrypted with the old Key. This gives the possibility to have canceled the last transaction or correct and therefore damage to the user or the data center to avoid.

0018The flow chart of Figures 3a and 3b shows the change in value and Afterloading for the case that the communication between the Meter and the data center via the modem automatically. There the steps of the method are essentially the same as those in the Process according to Figures 2a and 2b are the individual steps with the the same reference numbers increased provided the number 20th

0019As in the method described with reference to Figures 2a and 2b are the Users of the meter after switching the same Porto call number or PAN Identitatsnummer and confirms this entry by operation of the special button 52. It will now be of the stored Default value displayed. Either the user confirms this value by the Actuating the special key 52 or overwriting it with a new Default value, which is also confirmed by the operation of the special key 52 becomes. All other steps are now automatically without user of A franking machine between the meter and the data center and from in the same manner as in the reference to the Figures 2a and 2b described voice procedure was explained. The only difference is in that the modem procedure between the postage meter machine and the Data center only the crypto messages, ie the encrypted messages and not exchanged obtained from these shortened code numbers.

0020Reference to the figures 4 to 7 is now a method for storing security-related data, in particular during the telesetting described.

0021Figure 4 shows schematically the allocation of storage space in a non-volatile memory such as an NVRAM, which in the is meter and possibly also present in the data center. The memory has space to store two sets of data, namely, Clause 1 and 2 and have to store a pointer. Each record includes a variable Set "var", which can consist of any number of bytes. Further, each comprising Record a counter variable "nr update" which the number of changes the record indicates that for each amendment or renewal of the data a set is increased by 1. Finally, associated with one record a Checksum "checksum", the inclusion of at least a portion variable data of the data set is determined.

0022The pointer "act pointer" can have only two permissible values ​​indicating, which of the two data sets is considered just as the current record. In this case, not the values ​​0 and 1 are saved, as these values ​​no Bit errors can be detected. Instead, the values ​​are 0 x 0 x A5 or 5A used, where 0 x indicates that the values ​​are listed in hexadecimal. at This symmetrically constructed in binary representation the number of bit errors can the number visible themselves out.

0023The whole process is divided into three steps: <sl><li>1. Initialization of the memory of a data store;</li><li>2. Storage of variables in operation and</li><li>3. Review of the variables for consistency and if necessary correction.</li></sl>

0024According to Figure 5, the initialization of the memory comprises the following steps:

0025First, the pointer is set to sentence 1 (step S50). This means that the Sentence 1 is considered the current memory whose data are immutable. Then the variables of the data set 2 in step S51 to their initial values set. The count no updates in data set 2 is assigned the value 0 (S52). Then, the checksum is calculated using at least a portion of the variable values ​​of the data set 2 is generated and provided to the purpose Place the record 2 stored (S53, S54). Now the pointer is on the second data set, ie, the second record is the current Data determined (S55), whose data is now as reliable and invariable data can be used. Finally, in step copied S56, the entire contents of the data set 2 to the record 1, so that both records contain identical data.

0026During operation, a change of data occurs only in the non-current Record. According to Figure 6 is detected during operation, first, which record the no current record is (S60). In step S61, changing data written in the non-current record. As in Step S61 have changed the data of the data set, the count is no updates increased in step S62 in order. 1 Next, the checksum of data the non-current memory newly formed (S63) and in the non-current record stored (S64). Now, the pointer is directed to the record in which just the data has been changed, so that this sentence now the current Record is (S65). Finally, the entire data of the now current record in the other, not the current record copied (S66). turn Both records contain identical data.

0027When you turn on the meter and before calling the Telesetting must be checked whether a previous transaction was interrupted for example by a voltage drop and, therefore, Operations are required to inconsistencies in the stored data fix.

0028For the test, the following basic requirements are made:<sl><li>1. The pointer Pointer Act must have a valid value. As already discussed above, only two values ​​are allowed, whereby such values be selected, in which detected from the value itself out bit error can be.</li><li>2. The current designated by the pointer set must be a valid have checksum.</li></sl>

0029If at least one of the above conditions are not met, there is a fatal error and the meter will enter the service mode.

0030For consistency check following steps are carried out, the reference to the Figure 7 will be explained.

0031It is first checked in step S70 whether the value of the pointer is permitted. In Step S71 checks whether the checksum of the current by the pointer is valid designated record. If one of the steps is not met, on the meter, as mentioned above, in the service mode.

0032If the checks in steps S70 and S71 on the other hand to a positive out result, in step S72, the validity of the non-checksum Current memory checked. If the test is negative, that is the checksum not valid, it can be assumed that the data storage or the Data mirroring were interrupted. To correct this error, the Reflection repeated, ie all data of the current record are in the no current record copied (S73). Did the checksum against it as proved valid, it is checked in S74 whether the checksums of the two records and therefore their data are the same. If this is the case, the test is terminated. By contrast, if both checksums valid but not equal, then the Backup process was interrupted before mirroring. In this Case, the data whose count "nr Updates" is greater than the Count of the other, selected as the current block. Its data is in the other data copied (S75).

0033In a modified embodiment, the postage meter can be used both for the voice process as also be set up for the modem method. by means of a dial key 58 (Fig. 1) to the postage meter, the user may type the choose the communication method with the data center.