WO2007035970A2

WO2007035970A2 - Cryptographic key management system

Info

Publication number: WO2007035970A2
Application number: PCT/ZA2006/000112
Authority: WO
Inventors: Roderick Mark Dyson; Benjamin Nortjie; Frederick Peter Eek
Original assignee: Individual
Current assignee: Individual
Priority date: 2005-09-21
Filing date: 2006-09-21
Publication date: 2007-03-29
Anticipated expiration: 2008-03-21
Also published as: WO2007035970A3

Abstract

This invention relates to a cryptographic key management system that finds particular application as a key management system in a cash in transit system. The key management system of this invention comprises a controlled device equipped with a key derivation algorithm (KDA) which allows it to derive a new key (a controlled device key derivation algorithm (CDKDA)) from a current key (Kn+i = CDKDA(Kn)). The key derivation algorithm may conveniently allow the controlled device to derive a block of new keys from at least one current key or from a block of current keys. The preferred method for key derivation is triple DES DUKPT (Derived Unique Key Per Transaction).

Description

CRYPTOGRAPHIC KEY MANAGEMENT SYSTEM

Background to the invention

This invention relates to a cryptographic key management system.

The invention finds particular application as a key management system in a cash in transit system and it will be described with reference to such an application. It will be appreciated, however, that this is done purely for illustration and it is not intended to limit the scope of the invention to such a particular example.

The typical cash in transit system makes use of a plurality of secure cash containers or boxes that are used to transport cash and other valuable documents, all of which will, for convenience, be referred to in this specification as "cash" where appropriate. When so used, the term "cash" will include a reference to any valuable transaction document, including money and any document other than money normally used in commerce to initiate, conclude or record a transaction. Examples of such other transaction documents include cheques, credit card clips, deposit slips, withdrawal slips and printouts of electronic payment records. Since cash in transit systems must deal with coin money, the term "cash" will, where the context allows, include a reference to coin money as well.

The cash containers used in these systems are constituted by secure boxes or containers with one or more compartments that are accessible via electronically controlled doors or hatches. Cash is deposited into one or more of the compartments in the cash container by means of dedicated cash acceptance terminals and removed by means of dedicated opening jigs located at one or more cash processing centres, both of which will be described below.

The cash container is provided with an onboard processor with sufficient computing power and memory to store a record of the transactions involving the cash container, including data detailing deposits, merchant details and a breakdown of the denominations of notes and documents contained within the cash container. In addition, the cash container processor records and stores the operational history of the container and a record of any mishandling of the container. The cash container is protected by means of a dye mechanism that can be activated to release a document staining dye into the interior of the container, thereby to stain the transaction documents securely contained within the container.

The cash container is adapted to interface and dock with one or more secure cash acceptance terminals. These terminals are essentially docking stations and are located at a cash acceptance point (normally the premises of retailers or other organisations that receive cash and need to have the cash transported to and from their premises).

Cash acceptance terminals can be static or mobile, the latter being mounted on castors so that they can be wheeled around between tills and cash collection points with one or more cash containers docked and securely stored within the cash acceptance terminal. The cash acceptance terminal is provided with a feed chute through which the cash is fed into the cash acceptance terminal and from there into the cash container docked within the cash acceptance terminal. The document travel path within the cash acceptance terminal typically includes a note validator with a note reject facility. In addition, the cash acceptance terminal may have magnetic stripe, card or tag readers, a receipt printer and sufficient onboard processing power to record and store the transactions undertaken with the use of the cash acceptance terminal.

When the cash container is filled to its operational capacity and the cash has to be moved from the cash acceptance point, the container is un-docked from the cash acceptance terminal and transported, with the assistance of a cash in transit service provider, to a cash processing centre where the cash container is interfaced and docked with docking stations located at the cash processing centre. The cash processing centre is typically constituted by a cash handling facility that contains one or more secure container processing jigs, each of which is either networked or provided with onboard or processing power interfaced with the cash centre reconciliation system. The emptying jigs are used to open the cash containers and empty the contents to allow the cash and transaction documents contained in the cash containers to be counted, reconciled and transferred into bulk document sorting and storage systems.

At both ends of the process, that is when the cash container is docked with a cash acceptance terminal or with a processing jig at the cash processing centre, a reciprocal authentication procedure takes place to verify the component identities and the authorisation of the components to engage in the various processes permitted within the system, such as opening the cash container, depositing cash into the cash container and discharging cash from the cash container at the cash processing centre. This is done with the use of digital cryptographic techniques.

Transaction data has long been protected by encryption techniques that use mathematical algorithms and keys to encrypt the data. It is commonly agreed however that cryptographic algorithms alone are insufficient to ensure reasonable levels of security. To achieve the necessary security, sophisticated key-management methods are required to protect the encryption keys used to encrypt and decrypt the data. Hence, secure key management (the methods used to securely inject, change and protect the identity of these keys) is at the heart of reliable data security.

This invention seeks to provide such a key management system in which the keys will be used to control access to functions on an electronically controlled device such as a cash container, a cash acceptance terminal or a processing jig at the cash processing centre.

In addition, this invention seeks to provide a system that can be used to securely control access to functions on multiple such devices for more than one user group, each group having access to a pre-determined set of functions on the device or a set of devices.

A typical system using the key management system of this invention comprises two types of devices. The first type is an electronically controlled device (herein referred to as a "controlled device") with functionalities that need to be accessed by users using the second type of device (herein referred to as an "access device"). A specific device can be used in a functional hierarchy where it acts as an access device in the one functional group and as a controlled device in another functional group. An access device can have access to the full functionality of the controlled device or limited access to a subset of the controlled device's functions.

In addition, the term "user group" will be used in this specification to refer to a system containing controlled and access devices which are adapted to interact with each other. Devices in a user group will normally be owned by the same entity. Multiple user groups can exist, but they will be limited in that devices in one user group will be restricted from interacting with devices in a different user group unless specific key sharing has been implemented. Furthermore, the term "function set" will be used in this specification as referring to a set of controlled device functions that are grouped together according to accessibility. The functions in a function set all have the same accessibility requirements.

In systems of this invention, each controlled device and access device will have a means for bidirectional communication and the access device either contains a secure key storage mechanism or has access to a secure key storage mechanism. In the preferred configuration, the secure key storage mechanism is located within a distinct, physical security module that is installed in the access device.

Summary and description of embodiments of the invention

According to this invention, a key management system is provided comprising a controlled device that is equipped with a key derivation algorithm (KDA) which allows it to derive a new key (a controlled device key derivation algorithm (CDKDA)) from a current key (K_n+i = CDKDA(K_n)).

The key derivation algorithm may conveniently allow the controlled device to derive a block of new keys from at least one current key or from a block of current keys and where appropriate, references to a "key" in this specification, should be interpreted to refer to a block of keys.

The preferred method for key derivation is triple DES DUKPT, but persons skilled in the art can use any similar key derivation algorithm. The DUKPT (Derived Unique Key Per Transaction) system is in use around the world to encrypt Personal Identification Number (PIN) information and to authenticate messages. To date, the DUKPT system has not been used to manage and control access to function sets on electronically controlled devices in a system.

The controlled device is preferably provided with data storage means for storing an encryption key for every user function set that can be accessed separately by the access device, the controlled device being programmed, when in use the access device requires access to a specific function set of the controlled device, to require the transmission, to the controlled device, of data demonstrating knowledge of the controlled device encryption key for that function set.

In this form of the invention, the controlled device is programmed for all or some of the encryption keys of the controlled device to be single use keys, the controlled device being programmed to allow access to the functions of the controlled device related to that key only once, to calculate the next key using the key derivation algorithm and to destroy the used key. The controlled device is therefore conveniently programmed to step through a specific series of keys needed to access a specific function set on that device, the controlled device being programmed with an initial key (U_KF_NKo) for the user group UK and the function set F_N on the controlled device, in which K₀ indicates the initial key (serial number 0) and to use the controlled device key derivation algorithm (CDKDA) to calculate the key (UKFNCDXK_Π+I = CDKDA(UκF_NCDχK_n).

In key management system with a multiplicity of controlled devices, the initial key is seeded with a key series (CDx) specific to that device which is therefore programmed with an initial key (UKFNCDXKO) - user group UK; function set FN; controlled device specific key series (CDx); and initial key (serial number 0) K₀, the controlled device being programmed to use the controlled device key derivation algorithm (CDKDA) to calculate the key UκF_NCD_xK_n+i = CDKDA(U_κF_NCDχK_n).

For the function set F_N in a user group UK, different series of keys can be allocated to each device, by deriving the initial key UKFNCDXK_O using an initial key derivation algorithm (IKDA), which calculates the initial key from CDx and a base derivation key (BDKKNX) used by that user group for that function set, such that UKF_NCD_XK₀ = IKDA(CD_x,BDK_KNχ).

The controlled device is equipped with a controlled device key derivation algorithm (CDKDA) which allows it to derive a new key from a current key (K_n+I = CDKDA(K_n)). The preferred method for key derivation is triple DES DUKPT, but persons skilled in the art can use any similar key derivation algorithm.

The access device is equipped with an access device key derivation algorithm (ADKDA) with which it can calculate any key in a series of keys given the initial key and the key serial number (K_n = ADKDA(K₀, n)). The preferred method for key derivation is triple DES DUKPT, but persons skilled in the art can use any similar key derivation algorithm. Using the algorithm, the access device can therefore calculate UκF_NCDχK_n = ADKDA(U_κF_NCDχK₀, n).

An access device that is allowed to use a specific function set on controlled devices in a user group with key series CD_x, therefore needs to either securely store the initial key for those devices, or alternatively securely store the BDKKIMX and be equipped with the initial key derivation algorithm (IKDA) to allow it to calculate the initial key. The access device can therefore calculate a specific active key UκF_NCDχK_n for a function set UKF_N, for any controlled device with key series CDx as long as it has the key serial number n, and the base derivation key BDKκ_Nχ. Any agreed authentication method using the key can be used to gain access to the specific function set from an access device to a controlled device. The specific mechanism to use is dependent on the functionality and implementation of the controlled device and two examples are given below.

Mechanism 1 provides access to a function set for predetermined conditions without the ability to detect rogue controlled devices using one-way authentication of the access device.

Mechanism 2 provides access to a function set for predetermined conditions with the ability to detect rogue controlled devices using two-way authentication.

The predetermined conditions on which access is granted or refused and the extent to which such is granted are implementation dependent and do not form part of this patent application. These conditions could be time based, usage based or condition based. For example, once access is granted, the controlled device may allow use of only one function in the function set before the access device needs to apply an access mechanism again, or the controlled device may allow access to the function set for a limited time, or the controlled device may allow access to the functions until a specific condition (i.e. power loss or communications broken) is detected.

In the first example, when this mechanism is used, the access sequence consists of four steps:

the access device initiates the sequence by sending a message to the controlled device indicating the function set it wants to access; the controlled device generates a random challenge and sends the challenge together with the key identification for its active key for the function set to the access device - key identification includes, as a minimum, the key series identification (CD_x) and the key serial number (n) - the challenge may also include additional information identifying the base derivation key (BDKKNX) to which the key and key series belong - the access device then derives the controlled device's active key using U_κF_NCDχK_n = ADKDA(IKDA(CDX₁BDKKNX), n) - the access device then employs a hash function H(m) using the random challenge received from the controlled device and such other information which the system might be programmed to require, such as additional random data, using the calculated key. The hash code is then encrypted using the calculated key to allow the controlled device to authenticate the access device. Any information not available to the controlled device yet and used in the cryptographic hash function is sent to the controlled device together with the result of the hash function;

the controlled device employs the same hash function and uses its current key to encrypt the code and compares it to received result. If these are the same and all other system specified requirements are met, access to the function set is granted by the controlled device. Alternatively the controlled device could decrypt the received hash code and compare it to the clear hash code it calculated itself.

econd mechanism, the access sequence consists of five steps:

the access device initiates the sequence by generating a challenge consisting of a random number and identification of the function set it wants to use. This challenge is sent to the controlled device; the controlled device employs a hash function H(m) using the random challenge received from the access device and any other information which the system might want to use (including additional random data) to generate a hash code - the hash code is encrypted using the controlled device's active key for the indicated function set - the encrypted hash code is sent to the access device together with the key identification for its active key for the function set to the access device. Key identification includes at a minimum the key series identification (CD_x) and the key serial number (K_n). The challenge may also include additional information identifying the BDKF_N to which the key and key series belong. The controlled device calculates a new active key for the function set U_κF_NCDχK_n+i = CDKDA(U_κF_NCDχKn), and destroys its current active key UKFNCDXK,-,, deleting it from memory;

the access device derives the controlled device's active key using UκF_NCD_xK_n = ADKDA(IKDA(CD_X,BDKKNX), n). The access device then employs the same hash function and uses its calculated key to encrypt the hash code and compares it to received result. If these are the same and all other system specified requirements are met, the controlled device belongs to the system. Alternatively the access device could decrypt the received hash code and compare it to the clear hash code it calculated itself;

the access device derives the controlled device's next active key using U_κF_NCDχK_n+i = ADKDA(IKDA(CDχ,BDK_KNχ), n+1 ). It encrypts the hash code with new derived key and sends the encrypted hash code to the controlled device;

the controlled device employs the same hash function and uses its new current key to encrypt the hash code and compares it to received result. If these are the same and all other system specified requirements are met, access to the function set is granted by the controlled device. Alternatively the controlled device could decrypt the received hash code and compare it to the clear hash code it calculated itself. Once access has been granted, the controlled device once again calculates its next key and destroys its current key.

Applying the invention summarised above to a cash in transit system, the controlled device would be constituted by a cash container while an access device would be constituted by a cash acceptance terminal or a cash processing centre.

The key management system of this invention provides the ability for multiples of the same devices (cash containers belonging to different banks for instance) to be operated with the access devices (cash acceptance terminals and cash processing centres for instance) of various owners (banks for instance) without any owner having access to the functions on the devices owned by another party, unless specifically authorised by the other party.

It also provides a mechanism whereby rogue devices, such as fraudulent cash containers or cash containers that have been compromised in some way (by theft or damage for instance) and that do not form part of the user system, can be detected.

Claims

1. A key management system comprising a controlled device that is equipped with a key derivation algorithm (KDA) which allows the controlled device to derive at least one new key (a controlled device key derivation algorithm (CDKDA)) from at least one current key (K_n+i = CDKDA(K_n)).

2. A key management system according to claim 1 in which the key derivation algorithm (KDA) allows the controlled device to derive a block of new keys from at least one current key.

3. A key management system according to claim 2 in which the key derivation algorithm (KDA) allows the controlled device to derive a block of new keys from a block of current keys.

4. A key management system according to any one of the preceding claims in which the controlled device is equipped with a controlled device key derivation algorithm (CDKDA) which allows it to derive a new key from a current key (K_n+1 = CDKDA(K_n)).

5. A key management system according to any one of the preceding claims in which the access device is equipped with an access device key derivation algorithm (ADKDA) with which it can calculate any key in a series of keys given the initial key and the key serial number (K_n = ADKDA(K₀, n)).

6. A key management system according to any one of the preceding claims in which the method for key derivation is triple DES DUKPT (Derived Unique Key Per Transaction).

7. A key management system according to any one of the preceding claims in which the controlled device is provided with data storage means for storing an encryption key for every user function set that can be accessed separately by the access device, the controlled device being programmed, when in use the access device requires access to a specific function set of the controlled device, to require the transmission, to the controlled device, of data demonstrating knowledge of the controlled device encryption key for that function set.

8. A key management system according to claim 7 in which the controlled device is programmed for all or some of the encryption keys of the controlled device to be single use keys, the controlled device being programmed to allow access to the functions of the controlled device related to that key only once, to calculate the next key using the key derivation algorithm and to destroy the used key.

9. A key management system according to claim 8 in which the controlled device is programmed to step through a specific series of keys needed to access a specific function set on that device, the controlled device being programmed with an initial key (UKFNKO) for the user group UK and the function set FN on the controlled device, in which Ko indicates the initial key (serial number 0) and to use the controlled device key derivation algorithm (CDKDA) to calculate the key (UKFNCDXK_Π+I = CDKDA(U_κF_NCDχK_n).

10. A key management system according to claim 9 for a key management system with a multiplicity of controlled devices, the initial key being seeded with a key series (CDx) specific to a device and each device being programmed with: an initial key (UKFNCDXKO) - user group UK;

function set F_N;

controlled device specific key series (CDx); and

initial key (serial number 0) K₀

the controlled device being programmed to use the controlled device key derivation algorithm (CDKDA) to calculate the key UKFNCDXK₁₁₊I = CDKDA(U_KF_NCD_xK_n).

11. A key management system according to claim 10 in which, for the function set FN in a user group UK, different series of keys can be allocated to each device, by deriving the initial key UKFNCDXK_O using an initial key derivation algorithm (IKDA)₁ which calculates the initial key from CDx and a base derivation key (BDKKNX) used by that user group for that function set, such that UκF_NCDχK₀ = IKDA(CD_x,BDK_KNχ).