SE448803B - WAY TO PREVENT UNAUTHORIZED ACCESS OF INFORMATION - Google Patents

Description

10 15 20 25 30 35 448 N33 2 The system also includes a central computer, which receives cards data, a signal (Q) that connects the PIN code to the user the file (X) in the memory and a random number (w). The computer emits an approval signal, which consists of the sum (Z) of the three signals mentioned above. This approval signal compared in the safety device with that of the user entered the PIN code and with the random number (w) and if one certain relationship exists between them is given an output signal to the banknote dispenser.

Not even such a system with both cards and However, the PIN code is safe for fraudsters. An impostor can Spy when an intended victim enters his code to later secure in one way or another say his card.

However, spying on the code can be difficult by means of a device shown in EP 0 147 837 which is to prevent unauthorized access to a user's PIN simply by observing the user's finger movements when he enters the code. The device comprises a keyboard and a display. On the display shows which number each of the keys is on the keyboard corresponds. The meaning of each key can thus changing at regular intervals, which makes one can not determine which code is entered alone by looking at the finger movements.

Furthermore, the fraudster's ability to get out is great sums of money limited by the limits of how much money it is allowed to for a certain period of time withdraw via an ATM and by the victim can block their account.

A greater security risk for the banks is possible the ability of a dishonest person to engage in the in the ATM to which information is transferred and thus gain access to both the PIN code and the magnetic the card information for a large number of cards. By make a number of counterfeit cards and use them eavesdropped on the PINs, the dishonest person could V / 10 15 20 25 30 35 448 805 3 withdraw money from a large number of accounts and thereby come across a very large sum of money.

There are basically three possibilities for a fraudster to access important information in the ATM. The the first possibility is that the fraudster is involved on the wires between the local computer in the ATM and the central computer and intercept them in between transmitted signals. To make it difficult to access important information all critical information is encrypted transmitted between the local and central computer. The the second possibility is that the fraudster goes in and reads out the program code for the local computer and thereby will eat encryption and / or control algorithms.

However, this can be prevented by using a recently developed security chip in the United States, which makes reading of the program code. The third possibility finally, the fraudster is listening to the signals the wires between the keyboard and the local computer and between the magnetic card reader and the local computer.

The only hitherto known way to protect this part of the ATM is to physically protect it. This however, is not satisfactory from a safety point of view.

People who have access to the inside of the ATM can still attach without too much difficulty devices that enable eavesdropping. The physical protection of this part further means that one can not use a keyboard with any type of key, but these must be designed in a special way, which makes the keyboard more clumsy and more expensive. Accordingly, the object of the present invention is to designate a new way of preventing access to information input into ATM devices.

The method must be able to be used with existing ATMs and do not require extensive, expensive installations. The purpose is achieved with an initially described characterized by the treatment unit receiving way, as signals from the lines during separate reception periods, l0 15 20 25 30 35 44-8f 803 4 and that the processing unit between the reception periods on said lines emits signals which simulate key depressions.

The maximum interval between two on each other the following reception periods must, of course, be substantially shorter than the shortest duration of a keystroke, so that there is none risk of missing a keystroke.

An unauthorized person who connects to the wires between the keyboard and the local computer in the ATM can thus not determine when real keystrokes takes place and thus does not determine which PIN code belongs together with the information on the card used in the ATM.

To further increase security, the duration is allowed of the intervals between the reception time periods vary at random as well as the duration of the simulated keystrokes and their frequency.

The advantages of the described method according to the invention is that it can be applied to existing ATMs, it requires neither expensive nor extensive installations and it reduces the demands on the physical protection of it current part of the ATM, which allows use of keyboards other than those used today.

In the following, the present invention will described by means of an exemplary embodiment with reference to the accompanying drawings. Fig. 1 schematically shows the in an ATM the components. Fig. 2 is a time diagram and schematically shows an example of the appearance for the signals between the keyboard and the computer in a ATM and real and simulated keystrokes prints when the method of the present invention _ was used.

The ATM schematically shown in Fig. 1 mainly comprises a keyboard 21, a card reader 22 and a computer 23. The keyboard 21 is of the matrix type keyboard and consists of four in the figure horizontal wires ao-a3 and four vertical wires in the figure V) 10 15 20 25 30 35 4-48 805 5 do-d3, which forms a matrix, where each point of intersection between a horizontal and a vertical line corresponds a tangent. In the embodiment shown, the keyboard has 21 thus sixteen keys l-16. Wires ao-a3, do method includes a central unit, read only memory, -d3 are connected to the computer 23, which on conventional direct memory, data buses, address buses and I / O devices and which for example, may be the circuit manufactured by Intel 8751. The computer 23 has one connected to the card reader 22 input 24, one connected to a central computer (not shown) output 25 and with the address lines ao-a3 and data the lines do-da connected address outputs A0-A3 resp datain - / - outputs DO-D3. At least the latter are atl thus bidirectional, i.e. they can function both as inputs and outputs depending on how they are programmed.

A person who is to withdraw money at an ATM of the type shown inserts in a well-known manner its magnetic card in the card reader 22 and enters its PIN code with using the keys on the keyboard 21. The computer 23 receives the information magnetically coded on the card on the input 24 connected to the card reader 22 and registers the keystrokes by in turn and order lay out a one on the address outputs A0-A3 and for each of these load them onto the data inputs DO-D3 obtained the zeros and ones.

To prevent someone from eavesdropping on wires ao-a3 and do-d3 can access the user's PIN codes, the computer 23 only reads information on the data inputs DO-D3 during certain reception time periods.

These reception time periods must have such a high frequency that there is no risk of the computer missing anyone keystroke. The longest interval between two reception periods must always be substantial shorter than the shortest possible keystroke.

The duration of the intervals between two reception times periods are varied randomly and during these intervals DO-D3 are reprogrammed to outputs. Computer 23 lays 10 15 20 25 30 35 4-4-8 805 6 out signals that simulate keystrokes on the nings do-d3. The simulated keystrokes duration and frequency are randomly varied to further difficult for a listener to determine which depressions that are genuine.

These randomly varied in duration and frequencies are controlled by a program stored in the computer's memory, r which utilizes a random number generation function.

In order for a listener not to be able to sort out the real keystrokes by studying the current direction of the signals on the data lines do-d3 the signals that sense or simulate keystrokes are depressions as short as possible and given the lowest possible energy content. This means that you have to have a lot complicated and expensive equipment to be able to detect the current direction of these signals.

To further clarify how the method according to the function of the invention is shown in Fig. 2 a schematic examples of how the signals on the address and data lines ao-a3 and do-d3 in the device shown in Fig. 1 and against these corresponding real and simulated keystrokes can look like. In the figure, which shows ten cycles 1-10 of the scan of the keyboard, there is a time axis for each of the address lines ao-a3 and the data lines do-d3. Furthermore, there is a time axis below it, on which actual keystrokes are displayed and at the bottom of the figure another time axis, on which simulated keystrokes are displayed. On the time axes of the address lines ao-a3 shows how the computer scans the keyboard by in turn and order a high signal, an "l", on the address wires ao-a3. For each high signal that the computer sends out on an address line, it reads during reception oderna, which in the example shown are the circled ones cycles 1, 2, 7, and 10, the input signals on the data lines, fo, wherein the data inputs / outputs DO-D3 are programmed as inputs. During cycles 1 and 2, a one is thus obtained on the data line d2, when a high signal is emitted at the p 10 15 20 25 30 35 448 803 7 line az, since the key 7 is pressed. During cycles 3-6, the data inputs / outputs DO-D3 are reprogrammed to outputs and in the example shown, the computer simulates a press of key 9 by during cycle 4 and 5 lay out a high signal on the data line do, when the address line al is high. During cycle 7, the data ~ / -out- the passages DO ~ D3 are reprogrammed as inputs. Since no key is pressed during this period is obtained only zeros at inputs DO-D3. During cycle 8 and 9, a press of key 3 is simulated by the computer lays out a one on the data line dz during that time period when the address line a3 is high. Although a real key depression, as shown in the example, begins below cycle 9, this will not be visible on the data lines d0 «d3. During cycle 10, which is a reception period, however, this keystroke appears as a one on one the data line dz when the address line al is high. For one that intercepts the signals on the data and address lines it thus looks as if the key 7 is pressed below cycle 1 and 2, key 9 below cycle 4 and 5 key 3 during cycles 8 and 9 and the key ll during cycle 10.

For a listener, there is no possibility to decide which signals are derived from actual keystrokes nings.

To further complicate the life of one listeners, you can of course also let the address outputs A0-A3 be reprogrammable to inputs and below certain reception periods scan the keyboard through to use the outputs DO-D3 as address outputs.

Of course, the scan does not have to take place through either that the computer lays out a one on the address lines ao-a3 in the order shown in the example. This can be visible and even change from bike to bike.

Furthermore, the person skilled in the art realizes that one is equal can use negative logic, ie that zeros indicate real or simulated keystroke.

The present invention has been described with reference to 448 805 8 display to an ATM, but of course can the method according to the invention is used in all devices where secret information is entered via a keyboard and transferred to some form of treatment unit. Up- Furthermore, the finding is not limited to a 4 x 4 matrix. keyboard but can be applied to keyboards with different size and of different types.

Claims (5)

NF 448 803 PATENT REQUIREMENTS l. Ways to prevent unauthorized access of information entered into an apparatus by keystrokes on a keyboard (21) and transmitted from the keyboard in the form of electrical signals on electrical wires (ao-a3, do-d3) to a processing unit (23), characterized in that the processing unit (23) receives signals from the lines during reception time periods, and that the processing unit (23) between the reception time periods on said lines emits signals which simulate key depressions. 2. A method according to claim 1, characterized in that the maximum interval between two consecutive reception periods is substantially shorter than the shortest duration of a keystroke. 15 3. A method according to claim 1 or 2, characterized in that the duration of the intervals between the reception time periods is varied in a random manner. 4. A method according to claim 1, 2 or 3, characterized in that the duration of the simulated keystrokes 20 is varied in a random manner. 5. A method according to any one of the preceding claims, characterized in that the frequency of the simulated keystrokes is varied in a random manner.