WO1996010811A1

WO1996010811A1 - Process for generating electronic signatures and use of a pseudo-random generator therefor

Info

Publication number: WO1996010811A1
Application number: PCT/DE1995/001326
Authority: WO
Inventors: Hartmut Schrenk
Original assignee: Siemens Aktiengesellschaft
Priority date: 1994-09-30
Filing date: 1995-09-25
Publication date: 1996-04-11

Abstract

A process is disclosed for generating electronic signatures in a data carrier arrangement with at least a non-volatile memory and a pseudo-random generator. The non-volatile memory is subdivided into at least one value zone that works as a counter, a zone for counting carried out signature calculations and a zone for storing a secret signature code. The contents of said memory zones are used as input data by the pseudo-random generator to calculate a signature and the result of said calculation represents the electronic signature of the institution associated with the secret code for the contents of the value zone.

Description

Method for generating electronic signatures and using a pseudo-random generator for this

The invention relates to a method for generating electronic signatures, in particular in a portable data carrier arrangement, which can be designed, for example, as a chip card, and to the use of a pseudo-random generator for generating such an electronic signature.

Portable data carrier arrangements implemented as chip cards are used in a variety of ways as electronic means of payment according to the principle of an electronic wallet. Here, a prepaid amount of money is entered in a non-volatile memory of the EEPROM type. In many cases, the EEPROM is switched by the internal chip logic in such a way that it only allows a reduction in the counter value as a value counter in the field. This reduction takes place at the cash registers or vending machines according to the value of the goods purchased. The value counter of the wallet can only be increased again at special charging stations, whereby the holder of the card must pay the corresponding value.

Cash transfer transactions are naturally a manipulation incentive and are therefore subject to manipulation risk. Fraud can affect all three partners who participate in the payment system: the owner of the exchange (buyer), the owner of the sales terminal (seller) and the system operator (bank, clearing house).

Fraud risks in electronic payment systems can be greatly reduced with modern electronic processes and powerful card chips. The authenticity check of a stock exchange chip (counterfeit ?, simulation?, Copy?) Can be done in one Sales terminal can be checked using the familiar Challenge & Response procedures. To do this, the examiner (here the terminal) sends a random number to the candidate (here the card). Only the real examinee is able to return this challenge, correctly modified, as a response. In order to determine the correct response, the card contains a secret as evidence. This secret is protected against exploration from a response by a cryptologically effective arithmetic unit.

Conversely, the owner of the sales terminal could of course also manipulate his device in such a way that he draws too much money from his wallet, or that he submits changed or copied data records to the clearing house for settlement. This also requires authentication of the terminal, the check being carried out with roles exchanged as described above.

Electronic authenticity or authorization checks based on the Challenge & Response principle can be implemented today both with the powerful and flexible microprocessor cards and with the less expensive memory cards in which the security logic is hard-wired.

However, fraud could also occur with real cards in such a way that amounts of money after the authenticity check during their transmission by fraudulent manipulation on the transmission links exchange-sales terminal; Sales terminal clearing house; Exchange charging station (= bank) can be falsified: the seller debits a higher amount than specified or several amounts in the exchange; the seller claims an increased amount or a duplicate against the clearing house; the buyer reduces the amount to be debited at the vending machine; the buyer manipulates the amount to be booked when booking. Microprocessor cards can also be used to protect the transferred amounts of money against unauthorized changes using electronic signature processes. Memory cards, the lower manufacturing costs of which often make it possible to install such payment systems, have so far not been able to provide the computing power required for an electronic signature at a reasonable cost. In the installed payment systems, electronic signatures were either generated only with microprocessors, or a signature was not used in local payment systems.

The object of the present invention is to provide a cost-effective and fraud-proof method for generating an electronic signature.

The object is achieved by a method according to claim 1 and a use according to claim 8. Advantageous developments of the invention are specified in the subclaims.

Pseudo-random generators have long been known from the literature. They can be produced using shift registers with comparatively little effort. However, they were not suitable for executing security procedures in payment systems because they could not be protected against cryptological attacks with sufficient security. A pseudo-random generator that can be used for such purposes is, however, described in EP 0 616429 A1. It is used in the manner according to the invention for generating an electronic signature.

According to the present invention, the signature counter prevents a calculated signature from being repeated systematically and / or from being reconstructed using the periodicity of the pseudo-random number sequence that is output. The present invention thus describes a method with which pseudo-random number generators can be used for the manipulation-proof generation of signatures. The Circuit complexity is low, so that implementation is also possible with very inexpensive memory cards.

A method according to the invention is described in more detail as an exemplary embodiment using a memory card with a wallet function and the possibility of signing transactions. As in other memory cards, the monetary values are stored in EEPROM memory cells, which are functionally treated as a counter, which is constructed, for example, according to EP 0321 727 B2. For reasons of security against manipulation, the value counter can advantageously only be changed in one direction via the internal logic, i.e. it can only be reduced or devalued. As usual, debits are made in such a way that the counter reading is reduced in accordance with the value of the purchased goods.

Before debiting begins, the old meter reading is certified according to the invention, ie provided with a signature. Certification is carried out with a calculation run using the pseudo-random generator already mentioned. For the calculation run, at least the current status of the value counter of the wallet, the content of the signature counter according to the invention and a secret code stored in the EEPROM are entered as bank key, with the knowledge of which monetary value operations are confirmed by the issuing bank of the stock exchange card. In addition, information for identifying the relevant stock exchange and the involved sales terminal can also advantageously be entered as input for the calculation in the arithmetic unit. In the simplest way, these can be serial numbers that can be read in plain text. All of the variables mentioned influence the pseudo-random sequence that is generated as a result of the calculation. The randomness does not allow conclusions to be drawn from the signature to the input data such as meter readings or keys. This signature is clearly assigned to the status of the value counter of a specific stock exchange, a specific transaction and a specific terminal. The random sequence of the signature must be long enough so that different meter readings do not lead to the same signature by chance. A signature of 16 bits in length should at least be used. In this case there are over 64,000 possible different signatures. It is unlikely that a fraudster for manipulated meter readings for which the matching signature is missing will subsequently reconstruct a correct signature by chance. On the other hand, the signature must be limited in length because very long bit sequences would make it easier to recalculate the input data. In this signature, the secret chip code represents the bank's approval of the signed meter reading. The secret code is advantageously chip-specific in order not to endanger the system in the event of a key being corrupted and also to ensure a more precise assignment of transactions. The key contained in a stock exchange can be uniquely identified at the bank as part of the clearing via the chip identification data.

Identification data of the chip and the terminal are advantageously also incorporated into the signature as additional input into the pseudo-random generator. After the old meter reading has been certified, the debiting is carried out. H. the meter reading changed. The changed meter reading is also provided with a signature. In the sales terminal, the amounts of money received are collected as differences in meter readings from the transactions that have occurred with various wallets or with the same wallet and submitted to the clearing house for settlement together with the associated signatures and the plain text identification data of the stock exchange chip and the sales terminal.

A security feature of the method is that a signature cannot be repeated systematically and can therefore always be clearly assigned to the meter readings and card data. If there is no suspicion of fraud, the individual amounts for each sales terminal can be added without taking the signatures into account and be settled. However, if a statistical check is to be carried out to determine whether manipulated amounts of money are involved or if there is a specific suspicion of fraud, the history of each wallet can be reconstructed from the demands of the various sellers by lining up the meter readings. Manipulation of amounts of money can be clearly identified and localized where the signatures of meter readings recalculated in the clearing house do not match the signatures supplied by the wallet. If an exchange was acquired anonymously by a bank, there is no subsequent assignment of the amounts of money to the buying habits of a particular person. If the checks show that the checked meter readings overlap or even double, fraud has been proven.

During the recalculation, the inconsistent signatures can be used to reconstruct, for example, whether the seller subsequently changed the amounts of money in the data records that he sent for settlement, without permission. Any double submissions can also be recognized by the matching signature, which should not be repeatable due to the continuously changing status of the signature counter. The monetary claims asserted for settlement as the difference between two levels of the value counter are only authorized if the assigned signatures originate from immediately successive invoices. This can be recognized from the fact that the levels of the signature counter used for the signature calculation may differ only by one unit. The seller cannot therefore construct himself unauthorized additional amounts of money as an illegal combination of differences between meter readings that do not belong together but are correctly signed. It is also of no use to the seller if he fraudulently records all transactions made at his terminal in order to be able to better draw conclusions about the input data from the sum of many data records. A possible connection between signatures is difficult to recognize because the signature process cannot systematically repeat a signature.

If a holder of a stock exchange is suspected, who manipulates the data to be debited on the transmission link, for example at a non-monitored vending machine, the counterfeited amount can no longer be recovered after detection of a faulty signature due to anonymity. However, if the wallet is rechargeable, the suspect card can be recognized and deactivated at the latest when it is booked via a blacklist. The wallet can of course also be personal, which means that it is set to the name of a specific person. In this case, the authorization to use the exchange may depend on the correct entry of a PIN code by the user. In this case, the anonymity of the user is no longer given and a possible shortfall can be corrected subsequently. Normally, however, it can be assumed that the owner of the exchange has less influence on the booked amounts when debiting in a sales terminal than the seller, who could have prepared his terminal at the expense of the exchange owner or at the expense of the bank / clearing house, and the simplest and could have the greatest advantage in influencing the transmitted data.

The holder of the exchange could of course also try to manipulate the book value of his exchange on the transmission link in his favor as part of the reloading of his exchange at a loading machine. The manipulation can, however, already be recognized by the loading machine by having the signature of the changed meter readings output from the card for checking during the booking. For this purpose, it makes sense to invalidate the amount booked if the signature is incorrect.

If a fraudster gets to know the secret of a valid wallet, he could duplicate purses, all one would allow correctly signed debit. It could also generate signed data records without a wallet, the illegality of which the bank would not be able to automatically detect. However, the secret bank code in the wallet is protected by the principle according to the invention, which rules out the systematic repetition of a signature. The protection not only prevents the systematic testing of keys on a stock exchange chip, but also limits the possibilities of spying on a stock exchange chip with physical means with regard to its structure or the secret with measuring tips and dynamic analysis methods. The number of shift register cells of the pseudo-random generator can also be comparatively small, even for well-secured signatures, so that the pseudo-random generator requires only a small chip area, so that it can also be used in inexpensive memory chips. A shift register of 47 cells already enables a period length of the output bit sequences of more than 10 ^Λ 14. This number of different states of the pseudo-random generator also offers a sufficiently large key space with key lengths of 47 bits

Separation of the individual secrets of the individual purses. For very high security against key simulation, the length of the shift register can be increased to 64 levels.

Researching the secret key by trial and error is restricted by the number of attempts being limited by the counting range of the signature counter. According to the invention, the signature counter is only deleted after the value counter has been written or deleted. A signature calculated after deletion is different in every case because the meter reading to be signed has changed. Since either the value counter or the signature counter is always changed to generate a signature, it is ensured that a signature can never be systematically repeated in an abusive manner. The counting range of the signature counter must be such that, even if one is terminated O 9 1

9 Certification where the value counter has not been changed, there is sufficient repeatability without changing the value counter. A count of 16 bits should cover all eventualities.

With the configuration of the signature method specified so far, it cannot yet be completely ruled out that after a wallet has been recharged, the previous states of the value counter and signature counter repeat themselves again and the same signature could therefore be used again later. Each recharge can, however, be linked to the condition that a non-volatile write operation must have taken place in the stock exchange chip beforehand. If, according to the invention, the EEPROM data modified in the process are included in the calculation of a signature as input into the pseudo-random generator, the signature after recharging is different from all previous ones.

The EEPROM area changed when the stock exchange is recharged can itself be configured as a counter that cannot be reset. According to EP 0321 727 B1, this counter can be implemented in several stages using relatively few EEPROM cells and little effort and changes automatically with each recharge. It is in accordance with the invention that the information of this load counter is also entered into the pseudo-random generator when a signature is generated.

Even without writing a load counter, a random number can be written non-volatilely in an EEPROM area that can only be changed by the bank with each recharge from the bank terminal. According to the invention, this loading certificate can be entered into the pseudo-random generator as additional information for calculating a signature and would then, with a high probability, prevent a signature from being repeated again. The signature method according to the invention is not intended for the detection of counterfeit system components and assumes that the partners involved in transactions such as wallet or sales terminal have been authentically authenticated and securely authenticated using the known Challenge & Response methods prior to signature calculation. Rather, as explained several times, it should make a change in transmission data between the partners recognizable. The interests and responsibilities of the bank are determined using the bank key. The bank has an interest in ensuring that this key is neither known to the buyer nor the seller. Bank keys should therefore not be stored in the terminal. It is therefore advantageous if a different key is used for the mutual authentication of the wallet and the sales terminal than for the processes in which monetary values are signed.

Since both checking the debits of a wallet and a top-up during reloading are in the interest of the bank, it is advantageous if the same secret key is used to generate the signatures and for authorization checks to reload the wallet.

In order to ensure that only authenticated partners were actually involved in the generation of a signature of the counter reading of the wallet, it is also in accordance with the invention that for calculating the signature in the card, result data from a previous authentication as proof of the correct procedure with as input in the pseudo -Random generator can be entered for the calculation of the signature and thus influence the signature. This can be a previously calculated response itself or parts of a response or a release signal which, after mutual authentication in the chip, generates the result of a positive comparison with the response calculated in the terminal by the internal logic and intervenes in an internal flag was saved. It is advantageous if a signature in the stock exchange chip can only be calculated using an internal release logic after such a release signal has been generated after mutual authentication of the stock exchange chip and the sales terminal.

With the sources already mentioned, methods are also known today of how the mutual authentication checks of the wallet and terminal can also be carried out with the aid of a pseudo-random generator. It is therefore advantageous if, for reasons of cost, the same pseudo-random generator or components of the pseudo-random generator are used together to carry out authentication calculations and signature calculations.

Claims

claims

1. A method for generating electronic signatures in a data carrier arrangement which has at least one non-volatile memory and a pseudo-random generator, the non-volatile memory in at least one value area acting as a counter, an area for counting signature calculations and an area is divided for a secret signature code, and the contents of these memory areas are used as input data for a signature calculation by means of the pseudo-random generator and the result of this calculation represents the electronic signature of an institution assigned to the secret code for the content of the value range.

2. The method according to claim 1, characterized in that the non-volatile memory has an area acting as a load counter, the content of which is also used as an input date for a signature calculation by means of the pseudo-random generator.

3. The method according to claim 1 or 2, characterized in that the non-volatile memory has a specific data of the data carrier arrangement containing area, the content of which is also used as an input date for a signature calculation by means of the pseudo-random generator.

4. The method according to any one of the preceding claims, characterized in that the non-volatile memory has an area into which new data is written by a charging terminal during each charging process, which data is also used as input data for a signature calculation by means of the pseudo-random generator become.

5. The method according to any one of the preceding claims, characterized in that data to be entered from the outside into the data carrier arrangement of a terminal also as input data. turn is used for a signature calculation using the pseudo-random generator.

6. The method according to any one of the preceding claims, characterized in that the response of an authentication calculation is also used as an input date for a signature calculation by means of the pseudo-random generator.

7. The method according to any one of claims 1 to 5, characterized in that a release signal as a result of successful authentication between the portable data carrier arrangement and a terminal is also used as an input date for a signature calculation by means of the pseudo-random generator .

8. Use of a pseudo-random generator for generating an electronic signature in a data carrier arrangement which, in addition to the pseudo-random generator, has at least one non-volatile memory, the non-volatile memory in at least one value area functioning as a counter, an area for counting executed signature calculations and an area for a secret signature code, and the contents of these memory areas are used as input data for a signature calculation by means of the pseudo-random generator and the result of this calculation is the electronic signature of an institution assigned to the secret code for represents the content of the value range.