GB2444285A

GB2444285A - Keypad with random key layout

Info

Publication number: GB2444285A
Application number: GB0623944A
Authority: GB
Inventors: Tim Watson; Vicky Harris; Gavin Harper
Original assignee: Individual
Current assignee: Individual
Priority date: 2006-11-30
Filing date: 2006-11-30
Publication date: 2008-06-04
Also published as: GB0623944D0

Abstract

A keypad allows the physical arrangement of the keys to be rearranged by altering the legends on the keypad. This may be done either at the beginning of data entry or after every data item input. A film may be placed over the keys to restrict the angle at which the legends on the keys may be seen. The keypad may have push buttons with a display embedded in the button. The display may be an LCD. Alternatively, the keypad may be a touch screen. The keypad may also use coloured lights or other displays to provide information. The keypad may incorporate a microcontroller to control the display of the key legends or to decode key presses.

Description

Random Generated PIN Kcypad

Description

Numeric keypads and Personal Identification (PIN) numbers are commonly used in the security industry to authenticate the identity of the user. These find many applications in security devices, and are commonly used in transactions as a "secure" form of verifying a users identity and credentials.

With the explosion of electronic based forms of commerce, PIN numbers are used more extensively than ever.

In a typical transaction, the user is required to provide a non-confidential user identifier or token -for example a credit card, and a confidential PIN to gain access to a system. The system compares the confidential PIN with the record stored for that identifier to authenticate the users identity.

A numeric keypad consists of an array of keys in a fixed order which allows numbers to be entered into a system. A numeric keypad commonly consists of the numbers 0-9 in a static array, and usually there are additional option keys such as "Enter" and "Clear" which are used to aid the data entry process.

Users are familiar with the arrangement of a 12-key numeric keypad. The numbers are arranged in a logical order in rows of three: 2 3 4 5 6 7 8 9 Enter 0 Clear Unfortunately, user familiarity with the layout of this keypad compromises its security if the user is under surveillance whilst entering a PIN number.

Even if a user tries to "shield" their PIN number from being seen, the fixed position of the keys means that an observer can judge the number being entered from positional data -seeing where the users finger is moving. It is therefore possible to deduce a PIN from the users approximate finger position, without being able to see the key legends clearly.

PINs are often 4-digit numbers in the range 0000-9999 resulting in 10,000 possible numbers, so that an attacker would need to guess an average of 5000 times to get the correct PIN. Many PIN verification systems allow three attempts, thereby giving a card thief a 1/3000 chance to guess the correct PIN before the PIN is blocked.

If the user has some prior knowledge of the user's finger movements, then this probability can be compromised significantly.

This invention consists of a dynamic keypad, where the legends of the keys are not static and fixed, but change places. This can occur after each and every key entry, or at the beginning of the data entry sequence.

The keypad can either be physical -implemented using individual buttons, or virtual, using a touch-screen type display input device.

By moving the key legends about using a random algorithm, it is possible to create higher security, as the users finger movements give little clue to the number being entered if some or all of the key's are obscured. At the moment, if a user presses the top left key of a numeric keypad, the probability of it being a I is I/I. However, if the keys are randomised, then the probability of that finger movement indicating a I is only I in 12, 0.083 on each key entry occasion. Clearly security is improved if key legends denoting the position of a number cannot be seen, and even if some of the key legends can be seen, the remaining obscured legends provide some level of security.

Additionally, the legends could be shielded from unwanted overlookers by means of an optical film applied over the device which gives a restricted angle of view.

A specific implementation of this device is as follows: A "Screen Key", is a momentary push-switch, with a programmable LCD display in place of a fixed legend. The display can be programmed to display any number, legend or character on a matrix of pixels. A keypad composed of "Screen Keys" is a keypad whereby an array of "Screen Keys" are linked together, with each having a separate progranmiable LCD legend. Additionally, an option available on a "Screen Key" is to have a backlight provided by means of Tn-Coloured Light Emitting Diode. The proportions of Red, Green and Blue can be adjusted to convey colour information to the user, providing additional information about the key's function.

A random number generator pad could comprise an array of 4x3 screen keys controlled by a microcontroller. The microcontroller receives key-press information from each key. The microcontroller can also write data to the LCD screens atop of the key. The microcontroller interfaces to the application device, for example, an ATM machine. This interface could take the form of a digital bus connection to the microcontroller, or to retrofit existing applications, the microcontroller could connect to the application using the interface of the static keypad it is replacing.

The software function of the microcontroller is as follows.

I. Create a lookup table of 12 key positions.

2. Randomly assign each of the "key legend values" to one of the positions in the

lookup table.

3. Associate each physical key, with a corresponding position in the lookup tables.

4. Write the data corresponding to the "key legend values" to the LCD screen of each key, in accordance with the data in the lookup table.

5. Scan the keypad for user entry.

6. One user entry has been detected, lookup the position indicated by the physical key press in the lookup table and obtain a value for the corresponding "key legend value".

7. Output this key legend value to the application device.

The legends on the key could also be shielded from unwanted onlookers by means of an optical film over each key which gives a restricted angle of view.

Claims

Claims I. The device comprises a keypad, where the physical arrangement

of the key functions is rearranged by altering the legends on each key of the keypad electronically either: I) at the beginning of data entry ii) after every individual data item input
2. The device may also incorporate a film over each key which only allows the dynamically changeable Legend to be viewed from a narrow field of view.
3. The device may achieve this function through the use of pushbuttons with display screens embedded within the device, allowing the key legend to be dynamically altered.
4. The device may also incorporate coloured lighting and or displays to provide additional information to the user.
5. The device may also encompass an interface which allows the "new keypad" to be retrofitted to older systems.
6. The device may contain an embedded microcontroller which provides interface functions to a system.