METHOD FOR TAMPER-PROOF STORAGE OF TRANSACTION DATA IN A SYSTEM WITH ELECTRONIC CASH REGISTERS AND SYSTEM

Description

[0001] The invention relates to a method for tamper-proof storage of transaction data in a system with electronic cash registers and to a system. background

[0002] In connection with the operation of electronic cash registers, which include, for example, electronic cash registers at any point of sale and taximeters in taxis, it is necessary to store tamper-proof electronic data that indicates transactions recorded with the respective electronic cash register. Transaction data assigned to each transaction indicates, for example, the amount of money associated with the respective transaction.

[0003] It has been proposed that in systems with electronic cash registers, the transaction data associated with the recorded transactions be stored using the so-called WORM technology, which allows the electronic data to be read multiple times after being saved once, but does not allow the stored data to be changed.

[0004] From document DE 699 13 365 T2, a method for providing an auditable electronic journal system for a cash register device is known, which comprises the following: receiving transaction data relating to transactions; storing the transaction data in a working memory; generating a journal update event; transferring the transaction data stored in the working memory, in response to a journal update event, to a first part of a journal memory separate from the working memory; and transferring the data signature, in response to a journal update event, to a second part of the journal memory. In this way, an auditable electronic journal system for a cash register device is to be provided, which manages an electronic journal file instead of a journal printing station in a cash register printer with two printing stations.The transaction data is stored in non-volatile memory. A data signature is determined for a journal based on the contents of the memory. The data signature is an encrypted version of a message digest that reflects all transaction data submitted to the electronic journal file during a journal period.

[0005] Document US 2009 / 0150290 A1 discloses a method and apparatus for generating security codes for tickets. The purpose of this code is to verify the validity of a lottery receipt.

[0006] Document EP 1 398 741 A2 discloses a receipt printer that receives data to be printed via an interface and then returns a cryptographically secured signature of this data. The signature includes, for example, a serial number or a timestamp, which are formed together with the signature.

[0007] Document US 2014 / 0229305 A1 concerns a paperless real-time system for handling transaction receipts generated at points of sale.

[0008] Document WO 02 / 11091 A1 discloses the provision of a digital receipt for a transaction. Summary

[0009] The object of the invention is to provide a method for the tamper-proof storage of transaction data in a system with electronic cash registers and a system with which the data associated with transactions recorded in the electronic cash registers can be stored efficiently and securely so that they can be evaluated later.

[0010] To solve this problem, a method for tamper-proof storage of transaction data in a system of electronic cash registers according to independent claim 1 and a system according to independent claim 8 are provided.

[0011] Embodiments are the subject of dependent claims.

[0012] The transaction data provides information about the respective transaction, such as the invoice price of the transaction. Alternatively or additionally, the transaction data can display electronic information regarding a good or service for which a transaction was recorded using the electronic cash register.

[0013] The proposed technology can be used to ensure in a simple and efficient way that electronic information for the transactions recorded in the electronic cash registers is stored in a tamper-proof manner, so that the electronic information about the transaction is later available for evaluation, for example by financial or tax authorities, for example to check whether unauthorized data manipulation has occurred.

[0014] The method can provide the following: providing the first electronic cash register with a first removable storage medium and storing the first transaction-related data on the removable storage medium. In this embodiment, the first transaction-related data are stored on the removable storage medium, which can be detached from the electronic cash register after storage and then read out, thereby providing protection against manipulation of the transaction-related data. Alternatively or additionally, the first transaction-related data can also be stored in a memory of the first electronic cash register itself, at least temporarily, for example until an optionally provided transmission to the central server device, which can be carried out with a time delay from the generation and digital signing.The transaction-related data in the first electronic cash register can then be deleted.

[0015] The method can further include the following: providing the removable storage medium with a first chip card having a chip card memory, providing the first electronic cash register with a first chip card reader, and storing the first transaction-related data in the chip card memory of the first chip card inserted into the first chip card reader. After storing the transaction-related data, the chip card can be removed from the chip card reader and read elsewhere. The removable storage medium, in particular the chip card, can be personalized such that the storage medium is assigned to a person or a company, for example by storing identification data in the chip card memory.In this way, the transaction-related data is assigned to the person or company, enabling a personal or company-related review of possible manipulation of the stored transaction data.

[0016] The electronic cash registers can each be connected at least temporarily to a central server device for exchanging electronic data. The following can then be provided: transmitting first transaction-related data, which includes the first hash value with the first additional information data and the first signature data, to the central server device; and storing the first transaction-related data in a memory device of the central server device.

[0017] Calculating the first hash value can include at least one determination from the following group: determining the hash value as a checksum and determining the hash value using a cryptological hash function. The checksum can be calculated, for example, using CRC ("Cyclic Redundancy Check"). Hash values ​​determined as a checksum are not calculated using a cryptological hash function.

[0018] The second transaction-related data is stored in the storage device, with the first and second hash values ​​being stored in a hash tree or hash chain in the storage device. This can be a server-side hash tree if the storage occurs in the storage device assigned to the central server device. Similar to the first transaction-related data, the second transaction-related data can be stored additionally or alternatively on the removable storage medium.

[0019] Various technologies are known for creating a hash tree (a tree of hash values) or a hash chain (a chain of hash values). In one embodiment, blockchain technology can be used to store the first and second hash values. A hash tree is a data structure in cryptography and computer science. A hash tree is a tree of hash values ​​of data blocks, for example, from a file. Hash trees are an extension of hash lists and are also used to ensure data integrity.

[0020] It may be provided that the second transaction-related data, which comprise the second hash value with the second additional information data and the second signature data, are transmitted to the central server device and stored in the storage device assigned to the central server device.

[0021] Similar to the recording of transactions in the first electronic cash register, this can be carried out in conjunction with a second of the electronic cash registers. When stored in the server device, the hash values ​​from the first and second electronic cash registers can be stored in a common server-side hash tree. Alternatively, separate hash trees for the hash values ​​from the first and second electronic cash registers can be stored in the server device, for example, the storage device assigned to the central server device.

[0022] The first and second hash values ​​can be stored in a cash register-side hash tree in a storage device of the first electronic cash register. The cash register-side hash tree can be calculated and stored in the electronic cash register itself. Alternatively or additionally, the cash register-side hash tree can be stored on the removable storage medium. In one embodiment, electronic tree data indicating the cash register-side hash tree is transmitted to the central server device. The cash register-side hash tree can then be stored as a server-side hash tree in the central server device. Alternatively, in this or other embodiments, the server-side hash tree can be calculated on the server side.

[0023] The first additional information may include first location data indicating a first installation location for the first electronic cash register. The first location data may, for example, indicate a position in a global positioning system (e.g., "Global Positioning System"). A location of the electronic cash register may also be indicated in another way, for example, as an address or by reference to the name of a point of sale for which the address information is known. In the case of a taximeter of a taxi, the location data may indicate a taxi number.

[0024] The method can provide the following: providing a first set of electronic keys consisting of a first number of electronic keys in the first electronic cash register, and digitally signing the first hash value with the associated timestamp using a first electronic key from the first set of electronic keys. In this case, it can be provided that the first electronic key is only and exclusively provided for digital signing in connection with exactly one transaction, while further possible attempts to use this electronic key for digital signing are blocked in the first electronic cash register by means of process termination. In this way, each electronic key from the set of electronic keys is only used exactly once.There is a one-to-one relationship between the electronic keys of the first set and the transactions recorded in the first electronic cash register. The set of electronic keys can be provided, for example, via a chip card that can be read by a chip card reader connected to the electronic cash register. Alternatively or additionally, the set of electronic keys can be transmitted to the electronic cash register via an interface for wireless data transmission.

[0025] When checking the first and / or second transaction-related data for possible data manipulation, a number of used electronic keys from the first set of electronic keys that were used in the first electronic cash register for electronic signing can be compared with a number of electronically signed transactions for which respective associated transaction-related data were stored in the storage device, for example the storage device associated with the central server device, and data manipulation can be detected if the number of used electronic keys and the number of electronically signed transactions do not match.The number of consumed or used electronic keys is directly related to the number of recorded transactions, so the comparison between the number of used electronic keys on the one hand and recorded transactions on the other can be used as an additional verification criterion. For example, if transaction-related data for a recent transaction for which the transaction-related data was previously generated was deleted, the comparison would reveal that more electronic keys are counted than recorded transactions, which would be considered an indication of data manipulation.

[0026] In connection with the system, the configurations explained above for the method can be provided accordingly. Description of implementation examples

[0027] In the following, further embodiments are explained in more detail with reference to a figure.

[0028] The single figure shows a schematic representation of a system with electronic cash registers 1.1, ..., 1.n (n > 1), which are temporarily or permanently connected to a central server device 3 via a respective data communication line 2.1, ..., 2.n for the purpose of exchanging electronic data. The data communication lines 2.1, ..., 2.n can be configured with wireless or wired lines.

[0029] Some or all of the electronic cash registers 1.1, ..., 1.n can be equipped with an associated chip card reader 4. The chip card reader 4 can be used to write electronic data to a chip card 5. The chip card reader 4 can also be used to read electronic data from the chip card 5, if necessary.

[0030] The following explains a method for tamper-proof storage of transaction data using the system shown in the figure as an example. Tamper-proof storage of transaction data serves to securely store electronic information about transactions recorded using the electronic cash registers 1.1, ..., 1.n, so that they can be evaluated later, for example, by financial or tax authorities. The electronic cash registers 1.1, ..., 1.n can be, for example, electronic cash registers in any sales outlet and / or taximeters in taxis.

[0031] If a first transaction is recorded in a first electronic cash register 1.1, first transaction data is generated in the first electronic cash register 1.1, which, for example, indicates a monetary amount associated with the transaction, for example, with the sale of a product or the provision of a service. A first hash value is generated for the first transaction data in the first electronic cash register 1.1. The first hash value can be generated, for example, as a checksum for the first transaction data. Alternatively, provision can be made to generate a hash value for the first transaction data using a cryptographic hash function.

[0032] The first hash value is assigned additional information in the first electronic cash register 1.1. Initial access information data can, for example, indicate a first timestamp and / or a first installation location for the first electronic cash register 1.1. The first timestamp can be a qualified timestamp. For example, the German Signature Act regulates the requirements for issuing qualified timestamps as a particularly high-quality form of such certification, which ensures that the valid legal time has been recorded and forges and falsifications are excluded. With the procedures used, the issuer of a qualified timestamp, as an uninvolved third party, signs the hash value of the certified document along with the current time (date and time) with a qualified electronic signature.The Time-Stamp Protocol (RFC 3161) regulates the transmission of information from a time-stamping service on the Internet.

[0033] The first hash value with the associated first additional information data is electronically signed in the first electronic cash register 1.1, for example, using a first electronic key provided in the first electronic cash register 1.1. Using the electronic key results in a digital signature.

[0034] First transaction-related data can then be transmitted to the central server device 3 via the data communication line 2.1 and stored there, wherein the first transaction-related data comprise the first hash value with the associated first time stamp as well as the first digital signature generated during digital signing.

[0035] When additional transaction-related data is received and stored for subsequent transactions, the respective hash values ​​are stored in the central storage device 3 in a server-side hash tree structure, as is known for hash trees in various embodiments. For example, blockchain technology can be used here.

[0036] Alternatively or additionally, storage on a removable storage medium can be provided, which can be connected to the cash register for data exchange.

[0037] Based on the transaction-related data stored on the selected storage medium, it can later be verified whether the electronic information concerning the transactions recorded in the electronic cash registers 1.1, ..., 1.n has been tamper-free. Storing the hash values ​​in the hash tree contributes to this improvement.

[0038] In addition, the following can be provided: A number of electronic keys for digital signing are provided in the first electronic cash register 1.1. Each of the electronic keys can only be used for digital signing in connection with exactly one transaction. The number of used electronic keys then indicates how many transactions were recorded and stored in the first electronic cash register 1.1. When checking the transaction-related data, the number of used electronic keys can then be compared with the number of recorded transactions. If no match is found, this indicates tampering with the transaction-related data.

[0039] The features disclosed in the above description, the claims and the figure may be important for the realization of the various embodiments both individually and in any combination. List of reference symbols:

[0040] 1.1, ..., 1.nelectronic cash registers 2.1, ..., 2.ndata communication lines 3server equipment 4chip card reader 5chip card

Claims

1. A method for tamper-proof storing of transaction data in a system with electronic cash registers (1.1, ..., 1.n), comprising: - providing a system with electronic cash registers (1.1, ..., 1.n); - in a first of the electronic cash registers (1.1, ..., 1.n), - providing a first plurality of electronic keys which consists of a first number of electronic keys; - creating first transaction data, which indicate a first transaction recorded by means of the first electronic cash register and is assigned to the first electronic cash register; - computing a first hash value for the first transaction data; - assigning first additional information data to the first hash value, wherein the first additional information data comprise a first time stamp and the first time stamp indicates at least one of the following time information: time information regarding the recording of the first transaction, time information regarding the creation of the first transaction data, time information regarding the computing of the first hash value and time information regarding the assigning of the first additional information data; - digitally signing of the first hash value with the first additional information data using a first electronic key from the first plurality of electronic keys, wherein first signature data are hereby created; - creating second transaction data, which indicate a second transaction recorded by means of the first electronic cash register and is assigned to the first electronic cash register; - computing a second hash value for the second transaction data; - assigning second additional information data to the second hash value, wherein the second additional information data comprise a second time stamp and the second time stamp indicates at least one of the following points in time: time information regarding the recording of the second transaction, time information regarding the creation of the second transaction data, time information regarding the computing of the second hash value and time information regarding the assigning of the second additional information data; - digitally signing the second hash value with the second additional information data using a further electronic key from the first plurality of electronic keys, which has not yet been used for digital signing in the first electronic cash register, wherein second signature data are hereby created; - storing first transaction-related data, which comprise the first hash value with the first additional information data and the first signature data, in a storage device; and - storing the second transaction-related data which comprise the second hash value with the second additional information data and the second signature data, in the storage device, wherein the first and the second hash value are hereby stored in a hash tree in the storage device; wherein during a checking of the first and second transaction-related data for a possible data manipulation - a number of used electronic keys from the first plurality of electronic keys, which were used in the first electronic cash register for digital signing, is compared with a number of recorded transactions for which respectively assigned transaction-related data were stored in the storage device, and - a data manipulation is detected when the number of used electronic keys and the number of recorded transactions do not match.

2. The method of claim 1, characterized in - providing the first electronic cash register with a first exchangeable storage medium and - storing the first / second transaction-related data on the exchangeable storage medium.

3. The method of claim 2, characterized in - providing the exchangeable storage medium with a first chip card with a chip card memory; - providing the first electronic cash register with a first chip card reader (4) and - storing the first transaction-related data in the chip card memory of the first chip card which is inserted into the first chip card reader.

4. The method of any of the preceding claims, characterized in that the electronic cash registers (1.1, ..., 1.n) are each connectable, at least temporarily, to a central server device (3) for the exchange of electronic data., further comprising: - transferring first transaction-related data to the central server device (3); and - storing the first transaction-related data in a storage device of the central server device (3).

5. The method of any of the preceding claims, characterized in that the computing of the first / second hash value comprises at least one determination from the following group: determining the hash value as a checksum and determining the hash value by means of a cryptological hash function.

6. The method of any of the preceding claims, characterized in that the first and second hash value are stored in a cash-register-side hash tree in a storage device of the first electronic cash register.

7. The method of any of the preceding claims, characterized in, the first additional information comprises first location data which indicate a first installation location for the first electronic cash register.

8. A system, comprising - a central server device (3); - electronic cash registers (1.1, ..., 1.n); and - a transaction security module, which is implemented by means of a security software application in the central server device (3) and the electronic cash registers (1.1, ..., 1.n), and configured to perform the following: - in a first of the electronic cash registers (1.1, ..., 1.n), - providing a first plurality of electronic keys which consists of a first number of electronic keys; - creating first transaction data, which indicate a first transaction recorded by means of the first electronic cash register and is assigned to the first electronic cash register; - computing a first hash value for the first transaction data; - assigning first additional information data to the first hash value, wherein the first additional information data comprise a first time stamp and the first time stamp indicates at least one of the following time information: time information regarding the recording of the first transaction, time information regarding the creation of the first transaction data, time information regarding the computing of the first hash value and time information regarding the assigning of the first additional information data; - digitally signing of the first hash value with the first additional information data using a first electronic key from the first plurality of electronic keys, wherein first signature data are hereby created; - creating second transaction data, which indicate a second transaction recorded by means of the first electronic cash register and is assigned to the first electronic cash register; - computing a second hash value for the second transaction data; - assigning second additional information data to the second hash value, wherein the second additional information data comprise a second time stamp and the second time stamp indicates at least one of the following points in time: time information regarding the recording of the second transaction, time information regarding the creation of the second transaction data, time information regarding the computing of the second hash value and time information regarding the assigning of the second additional information data; - digitally signing the second hash value with the second additional information data using a further electronic key from the first plurality of electronic keys, which has not yet been used for digital signing in the first electronic cash register, wherein second signature data are hereby created; and - storing first transaction-related data, which comprise the first hash value with the first additional information data and first signature data, in a storage device; and - storing the second transaction-related data which comprise the second hash value with the second additional information data and the second signature data, in the storage device, wherein the first and the second hash value are hereby stored in a hash tree in the storage device; wherein the system is configured to check the first and second transaction-related data for possible data manipulation, wherein hereby - a number of used electronic keys from the first plurality of electronic keys, which were used in the first electronic cash register for digital signing, is compared with a number of recorded transactions, for which respectively assigned transaction-related data were stored in the storage device, and - a data manipulation is detected when the number of used electronic keys and the number of recorded transactions do not match.