Patent ID: 7974928

Claim:
In a secure transaction processing system including a database, a plurality of first cryptographic devices, and a standby cryptographic device, wherein said database stores a plurality of customer records and each first cryptographic device stores a plurality of total freshness counters used to verify the freshness of one or more of the customer records, a method of managing and recovering from a failure of one of said first cryptographic devices, said method comprising: causing each of said first cryptographic devices to periodically: (i) generate a total freshness counter record including the total freshness counters stored therein, a digital signature based on the total freshness counters included in the total freshness counter record, and a freshness counter indicating a number of times that the total freshness counter record was updated, (ii) send the generated total freshness counter record to said database for storage therein, (iii) generate a digital signature and time stamp record including the freshness counter that was included in the generated total freshness counter record, and (iv) send the generated digital signature and time stamp record to at least one other of said first cryptographic devices for storage; upon failure of one of said first cryptographic devices, sending the total freshness counter record most recently stored in said database from the failed first cryptographic device from said database to said standby cryptographic device and sending the digital signature and time stamp record most recently sent by the failed first cryptographic device to said at least one other of said first cryptographic devices for storage from said at least one other of said first cryptographic devices to said standby cryptographic device; verifying, by said standby cryptographic device, the authenticity of the received total freshness counter record using the digital signature included therein and checking that the received total freshness counter record is most current by comparing the freshness counter included therein to the freshness counter associated with the failed cryptographic device included in the received digital signature and time stamp record; and if said authenticity is verified and if the received total freshness counter record is determined to be most current, causing said standby cryptographic device to assume operation of the failed first cryptographic device in said secure transaction processing system.