WO2000039676A1

WO2000039676A1 - Device and method for protecting sensitive data and franking machine using same

Info

Publication number: WO2000039676A1
Application number: PCT/FR1999/002992
Authority: WO
Inventors: Jean-Marc Dery; Frédéric L'HOTE
Original assignee: Secap; Ascom Autelca Ag
Priority date: 1998-12-29
Filing date: 1999-12-02
Publication date: 2000-07-06
Also published as: CA2371059A1; EP1141826A1; FR2787899A1

Abstract

The invention concerns a method for protecting data sensitive to the use of a routine acting on the data. It comprises an operation, performed by said routine, an operation which consists in verifying the identity of each software task invoking said routine (400). Preferably, said verification operation (400) comprises an operation which consists in reading an identifier of said task (304) and an operation which consists in comparing (305) said identifier with predetermined identifiers.

Description

D ⁱ device and method for protecting sensitive data and franking machine using them

The present invention relates to a device and a method for protecting sensitive data and to a franking machine using them.

It applies in particular to franking machines provided with a program executing in a multi-task environment and more generally to the protection of sensitive data, representing for example, sums of money, or of sensitive tasks handling the sensitive data.

In a multitasking environment, each task can call each routine, whatever security is necessary on said routine. In a franking machine, certain tasks involve amounts representing sums of money. In particular, the operating phases of a franking or recharging machine use the routines that handle sums of money.

The correct implementation of each of these tasks must be guaranteed. By correct implementation is meant the fact that a task is executed in the normal course of operation of the machine. In other words, the invention aims to prevent sensitive data from being tampered with or modified in an inappropriate manner.

To this end, the present invention aims at having at least one routine acting on sensitive data verify the identity of tasks which call on it. Thus, if an unauthorized task attempts to use said routine, it can limit its execution and therefore avoid damaging the sensitive data considered.

According to a first aspect, the present invention relates to a method for protecting sensitive data against the use of a routine acting on said data, characterized in that it comprises, implemented by said routine, a verification operation of identity of each software task calling said routine.

Thanks to these provisions, if an unauthorized task is used to access said routine which uses sensitive data, by verifying its identity, this routine detects that it is not authorized and prevents access to the sensitive data considered.

In the case of a franking machine, for example, the routines concerned include the routine of incrementing the postage amount counter consumed and decrementing the postage amount counter remaining available and the counter incrementing routine number of postage made.

According to particular characteristics, said verification operation comprises an operation of reading an identifier of said task and an operation of comparing said identifier, on the one hand, and predetermined identifiers, on the other hand.

Thanks to these provisions, all the tasks authorized to carry out the routine in question are identified in a particular list, which facilitates the programming of the routine and the updating of this programming. According to other particular characteristics, each routine acting on said data implements said verification operation.

Thanks to these provisions, whatever the routine which attempts to access sensitive data, the protection offered by the present invention is ensured by said routine. According to a second aspect, the present invention relates to a device for protecting sensitive data against the use of a routine acting on said data, characterized in that it includes a means of verification. adapted to verify the identity of each software task calling said routine, the verification means being implemented by said routine.

The invention also relates to a franking machine, characterized in that it comprises a device as succinctly set out above. The invention also relates to:

a means of storing information readable by a computer or a microprocessor retaining instructions of a computer program characterized in that it allows the implementation of the method of the invention as succinctly set out above, and - a removable information storage means, partially or totally, and readable by a computer or a microprocessor keeping instructions of a computer program characterized in that it allows the implementation of the method of the invention as briefly described above.

This device, this franking machine and these storage means having the same particular characteristics and the same advantages as the method succinctly described above, these advantages are not repeated here.

Other advantages, aims and characteristics will emerge from the description which follows, made with reference to the appended drawings in which: - Figures 1A and 1B show, respectively in top view and in elevation, a franking machine implementing the data protection device and method which are the subject of the present invention,

FIG. 2 schematically represents an electronic circuit incorporated in the franking machine illustrated in FIGS. 1A and 1B, and FIG. 3 represents an algorithm for operating the electronic circuit illustrated in FIG. 2.

The franking machine 1 illustrated in the drawings (FIGS. 1A and 1B) comprises a device for printing, on a flat object such as the letter 2, on the one hand, a franking mark and, optionally, a destination address of the envelope.

To print the franking mark on the standardized space provided for this purpose, the letter 2 must be passed through a corridor 5 that comprises the machine 1, this corridor being delimited by elements integral with the frame, respectively a sliding support 6 which forms the ceiling of the corridor 5, a table 7 which forms the floor thereof and a ramp which forms a lateral limit thereof, the corridor being open opposite this ramp. To pass the letter 2 in the corridor 5, we place the letter on the part of the table 7 which projects from the side provided for the introduction (side that we see on the left in Figure 1B) then we enter the letter in the corridor 5, as shown in FIGS. 1A and 1B, until it is driven by the means provided for this purpose in the machine 1, the printing of the franking mark taking place automatically during that the letter 2 is driven in the corridor 5, the franked letter being expelled from the machine at the other end of the corridor 5 (end that can be seen on the right in FIG. 1B).

To drive the letter 2, the machine 1 comprises two rollers 9 and 10 each passing through an opening of the table 7, and two counter-rollers 12 and 13, respectively for the roller 9 and for the roller 10, passing through through an opening in the support 6.

The rollers 9 and 10 are mounted for rotation relative to the frame of the machine 1, by means of suspension means 14 shown diagrammatically in FIG. 1 B. The counter-rollers 12 and 13 are mounted for rotation on the frame of machine 1, without being suspended from it. An electric motor, not shown, serves to drive the counter-rollers 12 and 13 in synchronous rotation, for example by means of a belt (not shown) which rotates around three pinions carried respectively by the motor, by the counter-roller. 12 and by the counter-roller 13.

Since the suspension means 14 urge the rollers 9 and 10 towards the support 6, and therefore towards the counter-rollers 12 and 13, the rollers 9 and 10 are driven by friction on the counter-rollers 12 and 13, directly or through an object, such as the letter 2, being passed through the machine 1.

The letter 2, when it is introduced into the corridor 5 as shown in FIG. 1B, ends up meeting the roller 9 then the counter roller 12 which drives it in the direction shown in Figure 1 B by the horizontal arrow pointing from left to right. Simultaneously, the roller 9 is lowered while the letter 2 is introduced between the rollers 9 and 12 so that the letter 2 progresses in the machine 1 with its printing face 4 which is pressed and which slides against the surface 17 of the sliding support 6.

To print the franking mark at the standardized location which corresponds to it and / or the destination address at the standardized location which corresponds to it, the machine 1 comprises printing means 19 shown very diagrammatically in FIGS. 1A and 1 B. In general, the printing means 19 deposit the franking mark while the letter 2 or the article to be franked circulates in the machine 1 with its printing face which is pressed against the surface 17 of the sliding support 6, the means 19 being located between the counter-rollers 12 and 13. In the example illustrated, the printing means 19 are mounted directly on the frame of the machine, and are therefore fixed relative to the support of sliding 6.

So that the printing means 19 are controlled in synchronism with the advancement of the object in the machine, there is a detector for the presence of the object (referenced 110 in FIG. 2) which triggers a printing process drop down automatically.

More specifically, there is a first presence detector which controls the starting of the engine (not shown) when an object begins to be introduced into the machine 1, and a second presence detector (not shown) which triggers the process of impression when the object has reached a predetermined location.

In Figure 2, there is shown an electronic circuit for controlling the device as presented in Figures 1A and 1 B. This circuit is illustrated in the form of a block diagram and shown under general reference 100. It comprises, connected together by a bus addresses and data 102: a central processing unit 106; a random access memory RAM 104; a ROM 105; an input port output 103 used to receive:

• the weight of the postal item to be franked, and

• the detection of the postal object by each of the detectors (not shown in the figures) and to be transmitted:

• motor control signals, and and, independently of the bus 102: stepping motors 109; - presence detectors 110; a display screen 108 connected to the input / output port 103; a scale 112 connected to the input / output port 103 and providing bytes representative of the weight of a postal item; a keyboard 101 connected to the input / output port 103 and providing bytes representative of the keyboard keys successively used; and a print controller 120 which controls the operation of the print means 19.

Each of the elements illustrated in FIG. 2 is well known to those skilled in the art of postage meters having a microprocessor circuit and, more generally, information processing systems. These elements are therefore not described here.

The main memory 104 stores data, variables and intermediate processing results in memory registers bearing, in the following description, the same names as the data whose values they store. The random access memory 104 notably comprises registers keeping information representative of the weight of the postal object to be franked, the format of the postal object being processed, the number of postal objects in the batch being processed, values up and down counters which correspond to postage amounts already deposited and remaining to be deposited before reloading the machine. These latter registers operate according to techniques known in the field of franking machines (during each franking, when the amount of the descending counter is greater than the amount of the franking mark to be deposited, it is decremented by the amount of this mark and the ascending counter is incremented by the same amount).

The read-only memory 105 is adapted to keep the operating program of the central processing unit 106, in a register

"programl", and the data necessary for the operation of this program as well as the correspondence table relating weights, on the one hand, to postage amounts, on the other hand.

The read-only memory 105 keeps, moreover, in a register "list of identifiers", a list of identifiers of software tasks authorized to access the routines which use sensitive data (here amounts of postage).

In fact, the so-called “dead” memory 105 is a rewritable memory which does not erase when the device is switched off. It can only be rewritten using secure procedures and only by certain authorized persons, so that, for the daily user, it appears as a read only memory.

The central processing unit 106 is suitable for implementing the program stored in read-only memory 105, a program for which an operating algorithm is illustrated in FIG. 3.

The postage meter program or software is multitasking software, which involves allocation, by the processor, of memory space, or stack, associated with each task. This memory space is contained in the random access memory 104. During an operation 301:

the electronic card 10 is initialized by the central processing unit 106, according to known techniques, and

the central processing unit 106 assigns an identifier (here consisting of a number) to each task of the application. During an operation 302, the central unit 106 executes a part of a program requiring no call to a routine using sensitive data. During an operation 303, the central unit 106 implements a task which calls on one of the routines which use the sensitive data.

During an operation 304, the routine 400 considered (represented in broken lines) reads the identifier of the task in progress by using a routine called "system" of known type, intended for this reading.

Then, during a test 305, the routine 400 compares the identifier of the task with the content of the list of identifiers kept in read-only memory 105 and determines if this identifier of task is in the list. When the result of the test 305 is positive, the task is authorized to access the routine and the use of sensitive data is executed, during an operation 306. Then the central unit 106 returns to the operation represented in 302.

When the test result 305 is negative, the task is not authorized to access the routine. The operation of the central unit 106 is then stopped and an alarm is triggered, operation 307, until the franking machine is switched off, operation 308.

It is understood that the method of protecting sensitive data against the use of a routine acting on said data aimed by the present invention comprises, implemented by said routine, an operation 400 of identity verification of each software task calling said routine.

It is easy to understand that, thanks to the organization of the task 400, and, in particular, thanks to the monitoring of the identity of the tasks which call upon it, the modification of sensitive data, by means of this routine is impossible .

As a variant, the routines 400 (that is to say those which verify the identity of the task calling them before making access to sensitive data) not only include the routines which access the postage amount counters , but also routines acting on statistical data or operating parameters of the franking machine.

In the embodiment described and shown, said verification operation 400 includes an operation of reading an identifier of said task 304 and a comparison operation 305 of said identifier, on the one hand, and predetermined identifiers, on the other hand.

In the embodiment described and shown, each routine acting on the sensitive data implements said verification operation 400.

The device for protecting sensitive data against the use of a routine acting on said data, characterized in that it comprises, as a means of verification the central unit 106, associated with memories 104 and 105, for verifying the identity of each software task calling said routine, this verification means being implemented by said routine.

Claims

1. A method of protecting sensitive data against the use of a routine acting on said data, characterized in that it comprises, implemented by said routine, an operation of identity verification of each software task calling said routine (400).

2. Protection method according to claim 1, characterized in that said verification operation (400) comprises an operation of reading an identifier of said task (304) and a comparison operation (305) of said identifier, of a on the one hand, and predetermined identifiers on the other.

3. Protection method according to any one of the claims

1 or 2, characterized in that each routine acting on said data implements said verification operation (400).

4. Device for protecting sensitive data against the use of a routine acting on said data, characterized in that it includes verification means (104, 105, 106) adapted to verify the identity of each calling software task said routine, the verification means being implemented by said routine.

5. Protection device according to claim 4, characterized in that said verification means (104, 105, 106) comprises means for reading (104, 105, 106) of an identifier of said task and a comparison means ( 104, 105, 106) of said identifier, on the one hand, and predetermined identifiers, on the other hand.

6. Protection method according to any one of claims 4 or 5, characterized in that each routine acting on said data implements said verification means (104, 105, 106).

7. Franking machine (1), characterized in that it comprises a device according to any one of claims 4 to 6.