WO2010050807A1

WO2010050807A1 - Data entry device for entering a personal identification number and method for configuring of such a device

Info

Publication number: WO2010050807A1
Application number: PCT/NL2009/050649
Authority: WO
Inventors: Willem Theodoor De Jong
Original assignee: Willem Theodoor De Jong
Priority date: 2008-10-28
Filing date: 2009-10-27
Publication date: 2010-05-06

Abstract

The invention relates to a method for configuring a data entry device for entering a Personal Identification Number (PIN),and a data entry device for secure entry of a PIN, said method comprising: i) a keypad button designation in which two buttons are designated as first and second input buttons to be associated with first and second sets respectively, each set comprising two or more differentnumbers, ii) a step of disablingall other buttons of the for entering a number, iii) a step of increasing the first and second counters by one each time the first or second input button respectively is pressed, and -selecting one number of the first set and/or second set as the entered number in dependence of the value of the first counter.

Description

Data entry device for entering a Personal Identification Number and method for configuring of such a device

BACKGROUND

The invention relates to a method for entering a Personal Identification Number (PIN) on a data entry device having at least ten buttons. When entering a PIN number using conventional methods a user of an automated teller machine or electronic transaction is at risk of unintentionally disclosing his PIN code to unauthorized persons . The invention further relates to a device and a method for entry of a Personal Identification Number (PIN) . Such devices and methods are commonly used as a means of identification, to enter a personal identification code, usually via a keypad. Such devices are well known, in particular those that use a PIN in association with a card or other means of personal identification.

The UK Patent Application 2 402 649 discloses a data entry device, e.g. a keypad, for entering a PIN, which incorporates features to aid the prevention of disclosure of the PIN, to unauthorized persons, as the PIN is being entered. The keypad comprises ten buttons for entering the PIN, wherein each of those keys is associated with one of the symbols from 0 to 9. The used buttons incorporated a light emitting display within their construction for displaying different numbers/symbols by every button of the keypad. When the entry of a PIN is required, two options are selectable by the user. In a first option the control system will position the various numbers on the keypad according to the traditional arrangement of numbers; i.e. 1, 2 and 3 are on the top line (read left to right), 4, 5 and 6 are on the next line down (read left to right) , 7, 8 and 9 are on the next line down (read left to right) and 0 is on the bottom line. In a second, secured option, the control system will randomly position the various numbers on the keypad.

A disadvantage of this securing feature is, that a user cannot know, which button is associated with which number. The keypad must be viewed by the user during or prior to entering one or more integers of the Personal Identification Number. At that moment, unauthorized persons may spy on the user, for example by looking over the shoulder of the user or spying remotely with the use of visual aids. It is an object of the present invention to provide a method and device which is user friendly and minimizes the risk of a PIN being disclosed to, or being obtained by unauthorized persons.

It is a further object of the present invention to provide a method for configuring a data entry device for entering a Personal Identification Number (PIN) to make it more difficult for unauthorized persons to obtain the PIN code .

SUMMARY OF THE INVENTION

To this end, according to a first aspect the present invention provides a method for configuring a data entry device for entering a Personal Identification Number, said data entry device comprising a keypad with a set of at least ten buttons, said method comprising: i) a keypad button designation step comprising a step of designating a button of the set of keypad buttons as a first input button to be associated with a first set comprising two or more different numbers, ii) a keypad button disabling step in which all buttons of the keypad other than buttons designated in step i) are disabled, iii) a number selection step comprising the steps of: - increasing a first counter by one each time the first input button is pressed, and

- selecting one number of the first set as the entered number in dependence of the value of the first counter. Because the button used no longer corresponds directly to the entered number, deducing the entered number from the position of the fingers of a user becomes more difficult. Additionally as only one button is used for entering a number it is no longer necessary for a user to view movements of his fingers relative to the keypad. As a result covering means may be used to guard against unauthorized viewing of the keypad.

Instead of disabling keypad buttons it is of course also possible to ignore input from keypad buttons that have not been designated in step i) . In an embodiment step i) of the method further comprises a step of designating a further undesignated button of the set of keypad buttons as a second input button to be associated with a second set comprising two or more different numbers. In this embodiment step iii) further comprises a step of increasing a second counter by one each time the second input button is pressed and selecting one number of the second set as the entered number in dependence on the value of the second counter. Preferably the first and second input buttons are arranged in neighboring positions on the keypad. Using two input buttons instead of one may speed up the input of a number by a user. As each input button is associated with a set of more two or more numbers, knowing which buttons were pressed it is still not possible to easily determine the entered PIN by tracking the placement of fingers on the keypad. In an embodiment the method comprises prior to step iii) the steps of providing a series of different first and second sets, and selecting a first and a second set from said series as the first and second set for the entry of a PIN number. As different first and second sets for entering a PIN may be selected on different occasions the chance of a PIN number being correctly copied by simply mimicking the key presses of a user is reduced.

In an embodiment step i) of the method further comprises a step of designating a further undesignated button of the set of keypad buttons as a confirmation button for confirming the entry of a number, and the step of selecting is performed after the confirmation button has been operated. In this embodiment only two buttons are used for entering a PIN code, while indicating the end of a number entry is simplified.

In an embodiment the method further comprises in step i) a step of designating a further undesignated button of the set of keypad buttons as a correction or decline button for correcting the input of a Personal Identification Number, and in step iii) a step of setting the counter to zero each time the correction or decline button is pressed. In this embodiment corrections may be made during input of a PIN number.

In an embodiment the method further comprises in step iii) a step of setting the first and/or second counter to zero each time the step of selecting is performed. Thus after input of a single digit or number the counters are reset .

In an embodiment the method further comprises in step ii) a step of generating a warning signal for the user each time one of the disabled buttons is pressed. The user may thus be notified of pressing a wrong button instead of an intended button. Additionally, for the visually impaired this method may aid in finding the buttons that are designated in step i) .

In an embodiment of the method step iii) is repeated more than once for entering a multi-digit PIN code .

In an embodiment the entire PIN number entered so far is erased when the correction button has been pressed.

According to a second aspect the invention provides a computer program comprising computer program code means adapted to perform the steps of the method of the invention when said program is run on a processor or computer for controlling a data entry device. As data entry devices for entering a PIN code are typically controlled by a processor, a change in program code of such a processor would allow the method of the invention to be used on virtually all data entry devices without making significant alteration, if any at all, to the hardware. Such computer program code thus provides a cost effective way to offer the present input method to users of a data entry device.

In an embodiment said computer program is embodied on a computer readable medium.

According to a third aspect the present invention provides an automated teller machine or electronic transaction device comprising a data entry device with a keypad having at least ten buttons, wherein the automated teller machine or electronic transaction device further comprises a processor arranged for performing the steps of the method as described above. In an embodiment the data entry device further comprises memory means comprising the computer program as mentioned above. Said memory means may also be used for storing said series of different first and second sets.

In an embodiment the automated teller machine or electronic transaction device further comprises data entry mode selection means adapted to switch the data entry device between a first mode in which the PIN may be entered according to the method of the present invention, or a second mode in which all buttons of the keyboard are enabled, each button associated with only one number, and the PIN may entered using those buttons. In an embodiment the automated teller machine or electronic transaction device further comprises movable covering means, which may be placed in a first position in which the keypad is substantially covered, and a second position in which the keypad is substantially uncovered, wherein the covering means do not obstruct access to the buttons in either position, and wherein the data entry mode selection means switch the data entry device between the first and second modes dependent on the position of the covering means. For example, when the covering means are in the first position covering the keypad, the data entry mode selection means may be operated to switch to the first mode in which a PIN may be entered according to the method as described above. When the covering means are in the second position, in which the keypad is substantially not covered thereby, the data entry mode selection means may be operated to switch to the second mode of entering a PIN number, i.e. in the conventional manner.

According to a fourth aspect the present invention provides a data entry assembly comprising a data entry device with a keypad having at least ten buttons, and a processor arranged for performing the steps according to the method as described above. The processor may be located remote from the data entry device or may be integrated in a single device. Besides being used for configuring a keypad of an automated teller machines or electronic transfer device, the processor of such a data entry assembly may also be adapted to operate an electronic lock. In the latter case the present invention may be used in access control systems for instance for controlling access to buildings, storage rooms, safety deposit boxes and the like.

In an embodiment the data entry assembly is an automated teller machine or an electronic transaction device .

In an embodiment the data entry assembly further comprises data entry mode selection means adapted to switch the data entry device between a first mode in which the keypad is configured according to the method as described above, and a second mode in which all buttons of the keypad are enabled, each button associated with only one number, and in which the PIN may entered using those buttons. In an embodiment the data entry assembly further comprises movable covering means which may be placed in a first position in which the keypad is substantially covered, and a second position in which the keypad is substantially uncovered, wherein the covering means do not obstruct access to the buttons in either position, and wherein the data entry mode selection means are adapted to switch the data entry device between the first and second modes dependent on the position of the covering means.

In an embodiment the data entry assembly further comprises reading means adapted for reading a code related to the PIN code from the card, and wherein the processing means are adapted for comparing the code read by the reading means with a PIN code entered by a user. The reading means may be suitable for reading information stored on for instance a magnetic strip, a contact chip, a RFID circuit or other well-known information carriers.

In an embodiment the code stored on the card may comprise a card identification code, a representation of which may be sent to a remote validation facility for verification together with the PIN code that was entered by the user. Alternatively the PIN code may be directly derived from the code stored on the card, for instance when the PIN code itself or functions descriptive thereof such as hash-codes or encrypted versions of the PIN code are stored on the card. In this case, further communication with a remote validation facility is no longer required to decide whether the user has entered the correct PIN code. In an embodiment the reading means are adapted for reading a code related to a preferred data entry mode from the card, and the data entry mode selection means are adapted to switch the data entry device between the first and second modes dependent on that code. The data entry mode may thus be selected based on the preferences of individual users .

According to a fifth aspect, the invention provides a data entry device for entry of a Personal Identification Number (PIN) comprising: a first input button which is associated with a first set comprising two or more different numbers and/or symbols, a second input button which is associated with a second set comprising two or more different number and/or symbols, and selection means for selecting one pair of a series of different first and second sets for the entry of a PIN, a control system comprising a counter for counting the number of times the first input button is pressed, and a counter for counting the number of times the second input button is pressed, wherein the control system is arranged for selecting one number or symbol of the first set in dependence of the number of times the first input button is pressed as the entered number or symbol, and is further arranged for selecting one number or symbol of the second set in dependence of the number of times the second input button is pressed as the entered number or symbol. Thus, on the one hand, a user may select a convenient pair of series with which the user is familiar for comfortable entering a PIN. On the other hand, the choice of one pair out of a series of different first and second sets can provide an extra level of security, in particular when an unauthorized person cannot detect which pair of series a user has chosen for entering his PIN.

In this embodiment, the first input button may be used for entering an integer of the first set, and the second input button is used for entering an integer of the second set. By providing two buttons for entering a PIN, the numbers 1, 2, ..., 9 and 0 can be divided in two series for reducing the maximum number of times the first or second input button must be pressed for entering an integer.

Alternatively the first input button may be used for entering an integer of the first set when the second input button is not activated. When the second input button is activated or pushed-in, the first input button can be used for entering an integer of the second set. Thus, for instance, when the second button has been pressed an even number of times, the first input button may be used to select a number from the first set, and when the second button has been pressed an odd number of times the first input button may be used to select a number from the second set .

Usually a PIN comprises a series of integers, which integers can subsequently be entered via the data entry device of the invention by a for each integer unique number of times of pressing-in the first input button. Thus the entry of an integer of a PIN is associated with a number of finger movements of the user, which can be entered to the touch of the finger, without the need of viewing the keypad when entering the PIN. In use, the entry device according to the invention can be screened from the view of the user and any unauthorized person. Furthermore, when the entry device is screened from view, it is even possible to direct surveillance cameras to the location of the entry device, for keeping watch over the entry device, the users and/or the further equipment associated with the entry device.

In an embodiment, the control system is arranged for selecting one number or symbol of the first and/or second set in dependence of the number of times the first input button is pressed as the entered number or symbol, after a short break following a series of activations of the first input button is detected.

In an embodiment the data entry device further comprises memory means for storing said series of different first and second sets, the control system being adapted for reading the selected pair of first and second sets from the memory means .

In an embodiment, the device comprises a confirmation button for confirming the number of times the first input and/or second button is pressed. The confirmation button can be pressed after the user has performed a series of activations of the first and/or second input button, which series correspond with the integer to be entered. By activating the confirmation button, the user can indicate the end of the series of activations. Subsequently the control system can establish the entered number or symbol.

In an embodiment, the device comprises a correction or decline button, for correcting or declining a faulty entered number or symbol.

In an embodiment, the first set comprises only odd numbers and wherein the second set comprises only even numbers. For example in order to enter the number 1, the first input button is pressed in once, to enter the number 2, the second input button is pressed once, to enter the number 3, the first input button is pressed twice, to enter the number 4, the second input button is pressed twice, ... , to enter the number 9, the first input button is pressed five times, and to enter the number 0, the second input button is pressed five times.

In an embodiment, the first set comprises the numbers 1, 2, 3, 4 and 5, and wherein the second set comprises the numbers 6, 7, 8, 9 and 0. For example in order to enter the number 1, the first input button is pressed in once, to enter the number 2, the first input button is pressed twice,..., to enter the number 5, the first input button is pressed five times, to enter the number 6, the second input button is pressed once, to enter the number 7, the second input button is pressed twice, ... , and to enter the number 0, the second input button is pressed five times. In an embodiment, the selection means comprises a selection button operable by a user for selecting one pair of first and second sets for the entry of a PIN. A user may thus choose between different pairs of first and second sets for each entry of a PIN. In an embodiment, the selection means are arranged to select a first and second set wherein the first set comprises only odd numbers and wherein the second set comprises only even numbers, or a first and second set wherein the first set comprises the numbers 1, 2, 3, 4 and 5, and wherein the second set comprises the numbers 6, 7, 8, 9 and 0.

In an embodiment, the device comprises a keypad for the two or more buttons, wherein said keypad comprises only two buttons associated with a counter for entering the numbers and/or symbols of the PIN. By limiting the buttons for entering the numbers and/or symbols of the PIN, the fingers of the user can stay on top of the first input button, or on top of the first and second input buttons during the entering of the PIN and the user does not have to feel his or her way to other buttons.

In an embodiment, the device comprises a keypad for the two or more buttons, wherein said keypad is provided with cover means for covering a hand of a user when entering a PIN. Since the PIN can be entered to the touch of the users fingers, the PIN can be entered blindfold, thus without viewing the keypad. The cover means can obscure the movement of the user' s fingers during entering the PIN. In an embodiment, the cover means comprises a cover which is hingeably connected to the keypad or a housing containing said keypad. The cover can move around the hinge connection from a first position for covering the hand of a user, to a second position where the keypad and/or the inside of the housing can be visually inspected by the user, and vice versa. By visually inspecting the keypad and/or the inside of the housing, prior to entering a PIN, for spying means or devices placed inside the housing by unauthorized persons to attempt to obtain a PIN.

In an embodiment, the keypad and/or the housing comprises means for automatic opening and/or closing of the cover. For example, when not in use for entering a PIN, the cover is in the open position allowing a visual inspection of the keypad and/or the inside of the housing. In use, the cover closes for obscuring the entering of a PIN from the view of unauthorized persons, camera's or other detection equipment.

In an embodiment, the device comprises sensing means for sensing the removal of the hand of a user and/or the opening of the cover means. In an embodiment, the sensing means are connected to the control system, and the control system is arranged to reset the system and/or the delete data of a previous transaction upon receipt of a signal from the sensing means which corresponds to the removal of the hand of a user and/or the opening of the cover means . In an embodiment, the cover means are provided with shielding means for substantially confining PIN- related information to within the cover means. In an embodiment, the cover means comprises a Faraday cage. In addition to obscuring the movement of the users fingers during entering the PIN, the shielded cover, in particular with a Faraday cage, can substantially prevent the detection or skimming of electrical signals, in particular electrical signals originating from the entering of the PIN, on the outside of the shielded cover. In an embodiment, the data entry device further comprises a reader for obtaining PIN-related information from a card or other means of personal identification. In an embodiment, the reader is arranged beneath the cover means. In an embodiment the reader is arranged beneath a shielded cover. The shielded cover can substantially prevent the detection or skimming of electrical signals, in particular electrical signals originating from the reading of the card or other means of personal identification, in particular signals related to the PIN, at the outside of the shielded cover.

In an embodiment, the reader is arranged for holding the card or other means of personal identification at least when entering the PIN. In an embodiment, the reader is arranged for holding the card or other means of personal identification beneath the cover, and thus on a secure place at least during the entering of the PIN. In an embodiment, the data entry device further comprises a fingerprint-sensor. In an embodiment, the fingerprint sensor is arranged in or at the first and/or the second input button. In an embodiment, the fingerprint sensor is arranged to read a fingerprint before or during the activation of the first and/or second input button. Combining the PIN with fingerprint information of the user can provide an additional security feature.

According to a sixth aspect, the invention relates to a method for entering a Personal Identification Number (PIN) in a data entry device according to any one of the embodiments described above, wherein the method comprises the steps of: counting the number of times the first and/or second input button is pressed, and selecting one number or symbol of the first set in dependence of the number of times the first input button is pressed as the entered number or symbol and/or selecting one number or symbol of the second set in dependence of the number of times the second input button is pressed as the entered number of symbol.

In an embodiment, the step of selecting is performed after the confirmation button has been operated. The various aspects and features described and shown in the specification can be applied, individually, wherever possible. These individual aspects, in particular the aspects and features described in the attached dependent claims, can be made subject of divisional patent applications .

BRIEF DESCRIPTION OF THE DRAWINGS

The invention will be elucidated on the basis of an exemplary embodiment shown in the attached drawings, in which:

Figure 1 shows a top view of a keypad of a data entry device for use with the method according to the invention, figure 2 shows a flowchart comprising steps of an embodiment according to the invention, figure 3 shows a flowchart comprising steps of an alternative embodiment of the invention, figure 4 shows a perspective view of an alternative data entry device in which covering means are in a first position, figure 5 shows the data entry device of figure 4 in which the covering means are in a second position, figures 6A and 6B show data entry device with alternative covering means in a first and second position respectively, figure 7 shows a flowchart according to another embodiment of the invention, figure 8 shows an embodiment of the present invention as part of an access control system.

Figure 9 shows a schematic view of a data entry device according to the invention; Figure 10 shows a schematic top-view of a keypad according to a first exemplary embodiment;

Figure 11 shows a schematic top-view of a keypad according to a second exemplary embodiment;

Figure 12 shows a schematic top-view of a keypad according to a third exemplary embodiment;

Figure 13 shows a schematic top-view of a keypad according to a fourth exemplary embodiment;

Figure 14 shows a schematic view of a data entry device comprising a cover with a wrist closure;

Figure 15 shows a schematic view of a data entry device comprising a wrist support; Figure 16 shows a schematic view of a data entry device comprising a cover with side walls for enclosing the hand of a user;

Figure 17 shows a schematic view of a data entry device comprising a reader for a card comprising a magnetic strip, which reader is placed underneath a cover; and

Figure 18 shows a schematic view of a data entry device comprising a reader for a card comprising a chip, which reader is placed underneath a cover.

DETAILED DESCRIPTION OF THE INVENTION

Figure 1 shows a keypad 20 of a prior art data entry device for entering a PIN code. Such a data entry device is typically part of an automated teller machine or an electronic transaction device and comprises at least 10 buttons 1, 2, 3, ..., 10, and may also comprise a confirmation button 11 and a correction button 12. The data entry device typically comprises a display 30 as well, either remote from the keypad or arranged close to or on it, for showing progress in entering the PIN code. The keypad is shielded from unauthorized viewing on three sides by shielding means 21. It is however still possible for an unauthorized person to find out which buttons are pressed by viewing or filming movement of the fingers. Additionally an unauthorized person may find out which buttons have been pressed simply by cleaning the buttons beforehand and, after the PIN code has been entered, checking which buttons are no longer completely clean. For example, if a PIN code consists of four different digits in the range 0...9, then an unauthorized person knowing which digits were used has a chance of 1 in 8 of putting them in the correct order during the first three tries.

A flowchart showing an embodiment of the method according to the invention is shown in figure 2. The method comprises a keypad button designation step 210 in which a button of the set of keypad buttons is designated as a first input button associated with a first set of numbers in step 211. In a preferred embodiment this set of numbers comprises all number 0 through 9. For example, on the keypad of figure 1, buttons 1 might be designated as the first input button. Following the keypad button designation step 210 is a keypad button disabling step 220, in which all other buttons are disabled for entering a number. This prevents a person from accidentally entering the wrong number and also reduces the number of buttons that are used for entering the PIN code to one. During number selection step 230 a first counter is increased each time the first input button is pressed as shown in step 231. After for example a predetermined period of time, e.g. 5 seconds, the number that is entered is selected in dependence of the value of the counter as shown in step 232. The method finishes at step 260. For example, if the first input button has been pressed 5 times in 5 seconds, then the number 5 is selected as the entered number. Alternatively the last input using the first input button may be indicated by the user holding the first input button down for a predetermined period of time which is significantly longer that the time needed to press and release a button. In this manner a PIN number may be entered using only one button of the keypad. Knowing which buttons have been pressed during input of the PIN code no longer helps in determining the code itself.

An embodiment of the method is shown in figure 3. The embodiment comprises, after the start of the method 300, determining in step 301 whether or not the PIN code should be entered using the conventional method in which any button of the keypad may be used for entering a PIN code. This may be decided for instance based on a code on a users PIN card, or the option may be manually selected by the user using the keypad or some other kind of switch. If the conventional method of input is decided on, the present method continues with step 302 which essentially comprises steps for input of a PIN code as known from the prior art.

If the conventional method of input is not selected, keypad button designation step 310 follows. This step comprises substep 311, in which a first input button is designated and associated with a first set of two or more different numbers. The keypad designation step also comprises substep 312, in which a second input button is designated which is associated with a second set of two or more different numbers, and substep 313, in which a confirmation button is designated. The confirmation button may be operated to indicate the end of a number entry instead of using timers as in the previous embodiment. For example of the keypad shown in figure 1, button 1 may be designated as the first input button associated with a first set of numbers comprising the numbers 1,2,3,4 and 5. Button 2 may then be designated as the second input button associated with a second set comprising the numbers 6,7,8,9 and 0, and button 3 may be designated as the confirmation button. When step 310 has been completed all other buttons are disabled for entering a number in step 320. Preferably, though the other buttons may no longer be used for entering the PIN code, each time one of the disabled buttons is pressed a warning signal is generated to alert the user a disabled button is pressed. Next, in number selection step 330, the number of times each input button is pressed is counted in substeps 331 and 332. In step 340, after the user has operated the confirmation button, a number of the first or second set is selected as the entered number in dependence of the values of the first and/or second counters. In step 350 a check is made whether the entire PIN code has been entered. If so, the method is completed and ends in step 360. If further input is required to complete the PIN code, the first and/or second counters are set to zero in step 351, and steps from 330 onwards may be repeated. For example, when a user having a PIN code 2048 wants to use his PIN card to pay a bill or withdraw cash from a cash dispenser, he might first insert his card in the card reader. Based on information stored on the card the data entry device is configured for executing steps 310 and further. To enter the PIN code 2048 the user would press button 1 two times, followed by pressing button 3 for confirmation, then press button 2 five times, followed by pressing button 3 for confirmation, then press button 1 four times, confirm, and the press button 2 three times followed by pressing the confirmation button one last time. Many variations are conceivable, for instance the first and second input buttons might be associated with different sets of numbers, such as {1,3,5,7,9} for the first input button and {2,4,6,8,0} for the second input button. Additionally, each time button 1 is pressed the counter for button 2 might be set to zero and vice versa. Alternatively both counters might function completely separate and selection of the entered number might be dependent on which of the input buttons was the last one pressed.

A preferred embodiment of a data entry device for use with the method is shown in figure 4. The shielding means 421 effectively shields the keypad 420 from viewing on three sides. A movable cover 422 is pivotably connected to the shielding means 421 and is shown in a first position in which the inner side 423 of the cover 422 is clearly visible and in which the inner side 423 may easily be checked for the presence of hidden devices such as miniature cameras. Preferably the movable cover 422 is associated with data entry mode selection means (not shown) capable of detecting whether the cover means are in a closed position or not. The decision whether to use the conventional input method or the present input method may be based on whether the position of the cover detected by the selection means is open or closed. Alternatively the data entry mode selection means may switch between the two input methods based on a feature on the PIN card, or on a user input.

In figure 5 the data entry device is shown with its cover closed, i.e. the cover 522 is in its second position in which the method according to the invention may be particularly advantageous; as fewer buttons are used in this method, covering the keypad will not significantly hinder the user as it is no longer necessary for him to view the keypad when entering his PIN code. Furthermore, only those buttons that are used for entering a number need to be covered. To prevent unauthorized persons from counting or timing each entered number, the display is preferably configured not to show progress in entering the PIN code using the present method. This may also be accomplished by making the covering means cover the display as well. Though the cover as shown in figures 4 and 5 has the advantage of being easily applied to existing data entry devices, other embodiments of the cover are conceivable as well. For instance the cover means may be slidably attached to the shielding means instead of pivotably, and/or may be attached on another side of the shielding to prevent obscuring the display when the covering means are in the open, first position. Alternatively, as shown in figures 6A and 6B, the covering means may simply comprise a hood 622 obstructing the view of both the keypad 620 and display means 630. Such a hood may conveniently be placed over most existing keypads without requiring significant modifications.

Figure 7 shows a flowchart of an embodiment of the method in which an additional button of the keypad has been designated for use as a correct/decline button. Steps 700,701,702,710,711,712,713,720,730,731,732,740,750,751 and 760 correspond to steps 300, 301,302,310,311,312,313,320,330,331,332,340,350,351 and 360 respectively of the flowchart shown in figure 3. Additionally in step 710 a substep 714 is present in which another button is designated as a correct/decline button. The keypad button disabling step 720 remains the same, however the selection step 730 now comprises the additional step 733 of resetting both counters when the correct/decline button is pressed. Preferably, though not shown, when the correct/decline button is pressed two times consecutively the entire PIN code entered so far is reset as well and a warning signal is given to alert the user thereof.

Figure 8 shows an embodiment of the present invention as part of an access control system. A data entry assembly comprising a keypad 820 and moveable covering means 822 are arranged at a conveniently reachable height, in this case on a column 870. The data entry device may be used to provide access to a room through a door 880, said door provided with a door knob 881 and an electronic lock 882. The door may be supported by doorframe 890. The assembly further comprises reading means 823 for reading information stored on a card. When someone wants to open the door 880, he may position his card to be read by the reading means and enter his PIN code using the method of the invention. On entry of the correct PIN code the electronic lock 882 is operated to unlock the door which may then be opened by pulling or pushing the door knob 881. Many variations of PIN code verification are conceivable. For instance the PIN code might be stored on the card and be compared with the entered PIN code, or verification of the PIN code may be remote from the data entry assembly. Alternatively no card is used at all and passage through the doorframe is allowed based solely on the PIN code entered. The method of the invention can thus be used in combination with access control systems as known to a person skilled in the art. Figure 9 shows an example of a data entry device 901 according to the invention. The data entry device 901 comprises a housing with a bottom wall 902, two longitudinal side walls 903, 904 and a back wall 905. The front of the housing is open for providing access for the hand of a user. The housing further comprises a cover lid 906 which is connected to the housing by hinge connections 909 near the back of the housing. In a closed position, the cover lid 906 rests on the side walls 903, 904 for closing off the upper side of the housing. From this closed position the lid 906 can swivel to an open position along path indicated by the arrow A. In the open position the interior of the housing is visible, at least for a user.

The data entry device 901 may be provided with a reading device 907 for reading data from a card or other means of personal identification. The reading device can be attached to an outside face of the side wall 904 of the housing. Alternatively the reading device can be provided at an outside face of the back wall 905. Furthermore the data entry device 901 is provided with a keypad inside the housing, which keypad comprises a series of keys 908 for entering a PIN, which keys 908 are provided at or near the bottom wall 902.

Figure 10 shows a first example of a keypad 922 of the invention. The keypad 922 comprises a first key or button 923 for entering a PIN. The key 923 comprises a counter or is connected to a counter for counting the number of times the key 923 is activated in by the user. When the number of activations by the user corresponds with an associated integer of the PIN, the user activates the confirm or "OK" key 925 for establishing this integer of the PIN. Subsequently the key 923 may be activated by the user for entering the subsequent integer of the PIN.

If an error occurs during the entering of a PIN, the counter can be reset by activating the correction key 926, and the user may subsequently activate the key 923 for a new attempt for entering the required PIN. In addition, when holding the correction key 926 for a certain period of time, for example 5 seconds, all entered integers of a PIN are reset and the user can start with entering the PIN from the start. Alternatively, if an error occurs during the entering of a PIN, the counter can be reset by activating the OK key two times with a short time period. Furthermore, the correction key 926 can be arranged in order to always cancel all entered integers of a PIN when activated. In addition, the keypad 922 is provided with a display 927 for providing feedback to the entering of a PIN. For example the display 927 may provide information about how many integers of a PIN have already been entered and/or may indicate whether the entered PIN is correct or not.

In addition, the keypad 922 may be provided with acoustic signaling means for providing different acoustic signals to confirm an inputted integer, a reset of the counter and/or the reset of all entered integers. Figure 11 shows a second example of a keypad 932 of the invention. The keypad 932 comprises two keys, a right key 933 and a left key 934, for entering a PIN. Each of these keys 933, 934 is provided with a counter for counting the number of times the corresponding key 933, 934 is activated in by the user. In this example the left key 934 is associated with a first set of integers comprising the odd numbers 1, 3, 5, 7 and 9, and the right key 933 is associated with a second set of integers comprising the even numbers 2, 4, 6, 8 and 0. The first and second set are printed 938 on the keypad 932, below the corresponding keys 933, 934, together with the number of times the corresponding key has to be activated in order to select the associated integer.

Again, when the number of activations of one of the keys 933, 934 by the user corresponds with the required associated integer of the PIN, the user activates the "OK" key 935 for entering this integer of the PIN. Subsequently the right 933 or left 934 key may be activated by the user for entering the subsequent integer of the PIN.

Furthermore a correction key 936 and a display 937 are provided, which have similar functions as in the first example describe above.

Figure 12 shows a third example of a keypad 942 of the invention. The keypad 942 comprises two keys, a right key 943 and a left key 944, for entering a PIN, and a confirmation key 945. The keys 943, 944, 945 are separated by ridges 948, which extend in vertical direction above the plane of the keys 943, 944, 945 for guiding the fingers of a user to the appropriate position for activating or pressing-in said keys 943, 944, 945.

The left 944 and right 943 key are provided with a counter for counting the number of times the corresponding key 943, 944 is activated in by the user. In this example the left key 944 is associated with a first set of integers and the right key 943 is associated with a second set of integers. In this example the user can choose which pair of first and second set he wants to use for entering his PIN, by activating the selection keys 941. When the selection key "1" is activated, the first set comprises the odd numbers 1, 3, 5, 7 and 9, and the second set comprises the even numbers 2, 4, 6, 8 and 0. When the selection key "2" is activated, the first set comprises the numbers 1, 2, 3, 4 and 5, and the second set comprises the numbers 6, 7, 8, 9 and 0.

Furthermore, a confirm key 945 is provided. To confirm a series of activations of key 943 or key 944, the confirm key 945 is activated once. To reset the counters of the keys 943 and 944, the confirm key as activated twice within a short time period, say within 3 to 5 seconds.

In addition, a further OK key 9451 and a correction or cancel key 946 are provided. These keys are located at a different level as the input keys 943, 944, 945. In particular these keys are provided at a position spaced apart from the keys 943, 944, 945 used for entering the PIN. Thus the user can easily distinguish between the keys 943, 944, 945 for entering the PIN and other function keys by the touch of the fingers of the user. The additional keys may even be provided outside the housing. The OK key 9451 may be activated in order to confirm an amount to be paid. The correction key 946 may be activated in order to reset all entered integers, and the user may start all over again to enter his PIN.

Figure 13 shows a fourth example of a keypad 952 of the invention. In this embodiment, the keypad 952 is provided with a tumbler switch 951 near the input keys 953, 954, 955 in order to choose between two available first and second sets for entering a PIN. When the tumbler switch 951 is placed in position "1", the first set comprises the odd numbers 1, 3, 5, 7 and 9, and the second set comprises the even numbers 2, 4, 6, 8 and 0. When the tumbler switch 951 is placed in position "2", the first set comprises the numbers 1, 2, 3, 4 and 5, and the second set comprises the numbers 6, 7, 8, 9 and 0. Figure 14 shows a second example of a data entry device 961 according to the invention, comprising a housing with a bottom wall 962, two longitudinal side walls 963, 964 and a back wall 965. The front of the housing is open for providing access for the hand of a user. The housing further comprises a cover lid 966 which is connected to the housing by hinge connections 969 near the back of the housing. In a closed position, the cover lid 966 rests on the side walls 963, 964 for closing off the upper side of the housing. The lid 966 is further provided with a front wall

9661. Said front wall 9661 is arranged for at least partially closing off the front side of the housing when the lid 966 is in the closed position. The front wall 9661 is provided with an opening 9662 for providing access for the hand of a user to the interior of the housing. The opening 9662 is arranged to enclose the wrist of the user, in order to limit a view into the housing via the front opening .

Figure 15 shows a third example of a data entry device 971 according to the invention. The data entry device 971 comprises a housing with a bottom wall 972, two longitudinal side walls 973, 974 and a back wall 975. The front of the housing is open for providing access for the hand of a user. The housing further comprises a cover lid 976 which is connected to the housing by hinge connections 979 near the back of the housing. In a closed position, the cover lid 976 rests on the side walls 973, 974 for closing off the upper side of the housing.

In order to limit a view into the housing via the front opening, the bottom wall 972 comprises a wrist support 9721 which limits the area of the front opening. Furthermore, the bottom wall 972 slopes down towards the back wall 975. The keys 978 for entering the PIN are situated in a lowered part 9722 of the bottom wall 972, and are hidden from view behind the wrist support 9721.

Figure 16 shows a fourth example of a data entry device 981 according to the invention. The data entry device 981 comprises a cover 986 with two longitudinal side walls 983, 984 and a back wall (not shown) . The front of the cover 986 is open for providing access for the hand of a user. The cover 986 is hingeably connected to a keypad 982 by hinge connections 989 near a back-side of keypad

982. In a closed position, the cover 986 and its side walls

983, 984 enclose the keypad 982 in order to hide the keypad 982 from view.

The keypad 982 of this embodiment comprises a wrist support 9821. The surface of the keypad 982 slopes down towards the back-side of the keypad 982. The input keys 988 are arranged in this down ward slope 9882, which allows the placing of the hand of a user in a natural curved position wherein wrist rests of the support 9821 and the fingers rest on the input keys 988. Preferably the direction of pushing in the input keys 988 is substantially orthogonal to the slope angle at the position of said keys 988, in order to facilitate activation of said keys 988. The keys 988 for entering the PIN are situated substantially below the level of the wrist support 9821, and are hidden from view behind said wrist support 9821. In addition, the cover 986 can be provided with a reading device 987 for reading data from a card or other means of personal identification. The reading device 987 can be attached to an outside face of the side wall 984 of the cover 986. In addition, the cover 986 can be provided with a display 990 for displaying useful information of a transaction, such as the amount that has to be paid, and/or for providing feedback to the entering of a PIN, for example the display 990 may provide information about how many integers of a PIN have already been entered and/or may indicate whether the entered PIN is correct or not.

On the one hand, the wrist support 9821 of the keypad 982 may be provided with first sensing means 991, for sensing the presence of the wrist or the ball of the hand of a user. The first sensing means 991 may comprise a bar which is pushed in by the wrist or the ball of the hand of a user. Alternatively the first sensing means 991 may be an optical sensor, for example an Infra Red sensor, for sensing the presence of the hand of a user. In addition or alternatively, the keypad 982 may be provided with second sensing means 992, for sensing whether or not the cover 986 is in its closed position. In particular the second sensing means 992 in this example detects the presence of the side wall 984, which covers the second sensing means 992, when the cover is in the closed position.

As a further safety feature, the embodiments with first and/or second sensing means can be arranged for resetting the system and/or deleting data from the previous inputted PIN. According to this embodiment, when the user removes his and after the PIN has been accepted and/or the requested transaction has been completed, the data of the PIN of the user is removed out of the system. When the data is removed the PIN can not be obtained by unauthorized persons .

Figures 17 and 18 show further examples of a data entry device 1001, 1011 according to the invention. These data entry devices 1001, 1011 also comprise a cover 1006, 1016 with two longitudinal side walls 1003, 1004, 1013, 1014 and a back wall (not shown) . The front of the cover 1006, 1016 is open for providing access for the hand of a user. The cover 1006, 1016 is hingeably connected to a keypad 1002, 1012 by hinge connections 1009, 1019 near a back-side of keypad 1002, 1012. In a closed position, the cover 1006, 1016 and its side walls 1003, 1004, 1013, 1014 enclose the keypad 1002, 1012 in order to hide the keypad 1002, 1012 from view.

In the embodiments shown in figures 17 and 18, are provided with a reader 1007, 1017 for obtaining PIN- related information from a card or other means of personal identification. The reader, for example a reader 1007 for a magnetic strip is shown in figure 17 or a reader 1017 for a chip as shown in figure 18, is arranged beneath the cover 1006, 1016 for providing a secure place for holding the card for example during entering of the PIN.

In the embodiments shown in figures 17 and 18, the reader 1007, 1017 is arranged in the keypad 1002, 1012, in particular at a location of the keypad 1002, 1012 where in use the palm of the hand of a user may rest.

Preferably the card or other means of personal identification is substantially completely received in the housing or under the cover and can stay there at least during the entering of the PIN. When the transaction or the entering of the PIN is completed, the card or other means of identification can be removed out of the housing of cover. In example the card may be ejected automatically or after activating an eject button (not shown) .

Alternatively when the card or other means of personal identification is read during the insertion in the reader 1007, 1017, the card or other means of personal identification can be removed before the PIN is entered.

Although the cover 1006, 1016 can be made from any opaque material, in an embodiment the cover 1006, 1016 is made form an electrical conducting material or is lined with an electrical conducting material, which is arranged for shielding and/or blocking electromagnetic signals which may contain PIN related information. In an embodiment the cover 1006, 1016 thus comprises a Faraday cage for preventing that signals originating for the card or other means of personal identification can be picked-up outside the cover 1006, 1016.

As a further safety feature, the keypad 1002, 1012 can be provided with a fingerprint-sensor. This enables the use of a fingerprint of the owner of the card or other personal identification means, in combination with a PIN. Personal identification data related to the fingerprint of the owner and PIN related data is then stored on the card or other personal identification means. In an embodiment, the fingerprint sensor is arranged in or at at least one of the buttons 1008, 1018, such that the fingerprint sensor is arranged to read a fingerprint before or during the activation of the button.

It is to be understood that the above description is included to illustrate the operation of the preferred embodiments and is not meant to limit the scope of the invention. From the above discussion, many variations will be apparent to one skilled in the art that would yet be encompassed by the spirit and scope of the present invention.

For example the data entry device of the invention can also be used for inputting a security code for an alarm system, a burglar alarm or an entry combination lock. In summary, the invention provides to a method for configuring a data entry device for entering a Personal Identification Number (PIN), and a data entry device for secure entry of a PIN, said method comprising: i) a keypad button designation in which two buttons are designated as first and second input buttons to be associated with first and second sets respectively, each set comprising two or more different numbers, ii) a step of disabling all other buttons of the for entering a number, iii) a step of increasing the first and second counters by one each time the first or second input button respectively is pressed, and

- selecting one number of the first set and/or second set as the entered number in dependence of the value of the first counter.

Claims

C L A I M S

1. Method for configuring a data entry device for entering a Personal Identification Number (PIN) , said data entry device comprising a keypad with a set of at least ten buttons, said method comprising: i) a keypad button designation step comprising a step of designating a button of the set of keypad buttons as a first input button to be associated with a first set comprising two or more different numbers, ii) a keypad button disabling step in which all buttons of the keypad other than buttons designated in step i) are disabled for entering a number, iii) a number selection step comprising the steps of:

- increasing a first counter by one each time the first input button is pressed, and

- selecting one number of the first set as the entered number in dependence of the value of the first counter.

2. Method according to claim 1, further comprising: in step i) : a step of designating a further undesignated button of the set of keypad buttons as a second input button to be associated with a second set comprising two or more different numbers in step iii) : increasing a second counter by one each time the second input button is pressed, and selecting one number of the second set as the entered number in dependence on the value of the second counter.

3. Method according to claim 2, further comprising prior to step iii) the steps of: providing a series of different first and second sets , and selecting a first and a second set from said series as the first and second set for the entry of a PIN number.

4. Method according to any one of the preceding claims, further comprising in step i) : a step of designating a further undesignated button of the set of keypad buttons as a confirmation button for confirming the entry of a number, wherein the step of selecting is performed after the confirmation button has been operated.

5. Method according to any one of the preceding claims, further comprising in step i) : the step of designating a further undesignated button of the set of keypad buttons as a correction or decline button for correcting the input of a Personal Identification Number, and in step iii) : the step of setting the counter to zero each time the correction or decline button is pressed.

6. Method according to any one of the preceding claims, further comprising in step iii) : the step of setting the first and/or second counter to zero each time the step of selecting is performed.

7. Method according to any one of the preceding claims, further comprising in step ii) : the step of generating a warning signal for the user each time one of the disabled buttons is pressed.

8. Method according to any one of the preceding claims, wherein step iii) is repeated more than once for entering a multi-digit PIN code.

9. Method according to claim 5, wherein after the correction button has been pressed the entire PIN number entered so far is erased.

10. A computer program comprising computer program code means adapted to perform all the steps of any of claims 1 to 9 when said program is run on a processor or computer for controlling a data entry device.

11. A computer program as claimed in claim 10 embodied on a computer readable medium.

12. Automated teller machine or electronic transaction device comprising a data entry device with a keypad having at least ten buttons, wherein the automated teller machine or electronic transaction device further comprises a processor arranged for performing the steps of any one of the methods of claims 1-9.

13. Automated teller machine or electronic transaction device according to claim 12, further comprising data entry mode selection means adapted to switch the data entry device between a first mode in which the PIN may be entered according to the method of any one of the claims 1-9, or a second mode in which all buttons of the keypad are enabled, each button associated with only one number, and in which the PIN may entered using those buttons .

14. Automated teller machine or electronic transaction device according to claim 13, further comprising movable covering means which may be placed in a first position in which the keypad is substantially covered, and a second position in which the keypad is substantially uncovered, wherein the covering means do not obstruct access to the buttons in either position, and wherein the data entry mode selection means switch the data entry device between the first and second modes dependent on the position of the covering means.

15. Data entry assembly comprising a data entry device with a keypad having at least ten buttons, and a processor arranged for performing the steps of any one of the methods of claims 1-9.

16. Data entry assembly according to claim 15, wherein the data entry assembly is an automated teller machine or an electronic transaction device.

17. Data entry assembly according to claim 16, further comprising data entry mode selection means adapted to switch the data entry device between a first mode in which the keypad is configured according to the method of any one of the claims 1-9, or a second mode in which all numerical buttons of the keypad are enabled for entering a PIN code, each button associated with only one number, and in which the PIN may entered using those buttons.

18. Data entry assembly according to claim 17, further comprising movable covering means which may be placed in a first position in which the keypad is substantially covered, and a second position in which the keypad is substantially uncovered, wherein the covering means do not obstruct access to the buttons in either position, and wherein the data entry mode selection means are adapted to switch the data entry device between the first and second modes dependent on the position of the covering means.

19. Data entry assembly according to any one of the claims 15-18, further comprising reading means adapted for reading a code related to the PIN code from the card, and wherein the processing means are adapted for comparing the code read by the reading means with a PIN code entered by a user.

20. Data entry assembly according to claim 19, wherein the reading means are adapted for reading a code related to a preferred data entry mode from the card, and the data entry mode selection means are adapted to switch the data entry device between the first and second modes dependent on the data entry mode selection code read by the reading means.

21. Data entry device for entry of a Personal Identification Number (PIN) comprising: a first input button which is associated with a first set comprising two or more different numbers and/or symbols, a second input button which is associated with a second set comprising two or more different number and/or symbols, and selection means for selecting one pair of a series of different first and second sets for the entry of a PIN, a control system comprising a counter for counting the number of times the first input button is pressed, and a counter for counting the number of times the second input button is pressed, wherein the control system is arranged for selecting one number or symbol of the first set in dependence of the number of times the first input button is pressed as the entered number or symbol, and is further arranged for selecting one number or symbol of the second set in dependence of the number of times the second input button is pressed as the entered number or symbol.

22. Data entry device according to claim 21, further comprising memory means for storing said series of different first and second sets, and wherein the control system is adapted for reading the selected pair of first and second sets from the memory means .

23. Data entry device according to claim 21 or claim 22, wherein the device comprises a confirmation button for confirming the number of times the first and/or second input button is pressed and thus establishing the entered number or symbol.

24. Data entry device according to any one of the claims 21-23, wherein the device comprises a correction or decline button, for correcting or declining a faulty entered number or symbol.

25. Data entry device according to any one of the claims 21-24, wherein the first set comprises only odd numbers and wherein the second set comprises only even numbers .

26. Data entry device according to any one of the claims 21-25, wherein the first set comprises the numbers 1, 2, 3, 4 and 5, and wherein the second set comprises the numbers 6, 7, 8, 9 and 0.

27. Data entry device according to any one of the claims 21-26, wherein the selection means are arranged to select the first and second set according to claim 25, or the first and second set according to claim 26.

28. Data entry device according to any one of the claims 21-27, wherein the selection means comprises a selection button operable by a user for selecting one pair of first and second sets for the entry of a PIN.

29. Data entry device according to any one of the claims 21-28, wherein the device comprises a keypad for the two or more buttons, wherein said keypad comprises only two buttons associated with a counter for entering the numbers and/or symbols of the PIN.

30. Data entry device according to any one of the claims 21-29, wherein the device comprises a keypad for the two or more buttons, wherein said keypad is provided with cover means for covering a hand of a user at least when entering a PIN.

31. Data entry device according to claim 30, wherein the cover means comprises a cover which is hingeably connected to the keypad.

32. Data entry device according to claim 30 or 31, comprising means for automatic opening and/or closing the cover.

33. Data entry device according to claim 30, 31 or 32, wherein the device comprises sensing means for sensing the removal of the hand of a user and/or the opening of the cover means.

34. Data entry device according to claim 33, wherein the sensing means are connected to the control system, and wherein the control system is arranged to reset the system and/or the delete data of a previous transaction upon receipt of a signal from the sensing means which corresponds to the removal of the hand of a user and/or the opening of the cover means.

35. Data entry device according to any one of the claims 30 to 34, wherein the cover means are provided with shielding means for substantially confining PIN-related information to within the cover means.

36. Data entry device according to claim 35, wherein the cover means comprises a Faraday cage.

37. Data entry device according to any one of the claims 21-36, further comprising a reader for obtaining

PIN-related information from a card or other means of personal identification.

38. Data entry device according to claim 37, when depending on any one of the claims 30 to 36, wherein the reader is arranged beneath the cover means.

39. Data entry device according to claim 38, wherein the reader is arranged for holding the card or other means of personal identification at least when entering the PIN.

40. Data entry device according to any one of the claims 21-39, further comprising a fingerprint-sensor.

41. Data entry device according to claim 40, wherein the fingerprint sensor is arranged in or at the first and/or second input button.

42. Data entry device according to claim 40 or 41 wherein the fingerprint sensor is arranged to read a fingerprint before or during the activation of the first and/or second input button.

43. Method for entering a Personal Identification Number (PIN) in a data entry device according to any one of the claims 21-42, wherein the method comprises the steps of: counting the number of times the first and/or second input button is pressed, and selecting one number or symbol of the first set in dependence of the number of times the first input button is pressed as the entered number or symbol and/or selecting one number or symbol of the second set in dependence of the number of times the second input button is pressed as the entered number or symbol

44. Method according to claim 43, wherein the step of selecting is performed after the confirmation button has been operated.