Methods and apparatus for secure personal identification number and data encryption

• US 6,715,078 B1
• Filed: 03/28/2000
• Issued: 03/30/2004
• Est. Priority Date: 03/28/2000
• Status: Expired due to Term

• Current Assignee: NCR Voyix Corporation
• Original Assignee: NCR Corporation
• Inventors: Shields, Adrian, Junghans, David, Chasko, Stephen John
• Primary Examiner(s): Peeso, Thomas R.
• Application Number:
  US09/537,851
• Time in Patent Office: 1,463 Days
• Field of Search: 713/193, 713/182, 713/200, 713/201
• US Class Current: 713/193
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/445 by mutual authentication, e.g. between devices or programs
• CPC Class Codes: G06F 21/85 interconnection devices, e.g. bus-connected or in-line devices
• CPC Class Codes: G07F 7/1008 Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system
• CPC Class Codes: G07F 7/1025 Identification of user by a PIN code

Abstract

A system and methods for implementing a low cost and simple PIN encryption device is disclosed. The PIN encryption device may be incorporated into customer transaction terminals, ATMs and PIN pads for use with POS terminals or other transaction devices. The PIN encryption device securely stores PIN encryption keys and PIN encryption algorithms that are used to encrypt user entered PINs on a cryptographic smart card. The system disclosed is a physically secure device that protects the integrity of the encryption keys and algorithms. The system also protects the cryptographic smart card from tampering, and prevents the discovery of PIN data by tapping the external interfaces of the customer transaction terminal.

Claims

1. A secure apparatus for encrypting data comprising:

a touch screen device, the screen layout of said touch screen comprising a protected data entry screen area and an unprotected data entry screen area;

a first processor, said first processor being affixed to a circuit board, said first processor being further operative to communicate with an encryption device and a touch screen device, and the first processor being further operative to determine whether a touch input detected by the touch screen device originated in the protected data entry screen area or the unprotected data entry screen area;

an encryption device operative to encrypt touch inputs that originated in the protected data entry screen area; and

a tamper detection mechanism.

2. The apparatus of claim 1 wherein the protected data entry screen area of the touch screen device is enabled to receive a plurality of touch inputs, the plurality of said touch inputs comprising personal identification number (PIN) data, commands or both.

3. The apparatus of claim 2 wherein the touch screen is comprised of an LCD flat panel display and a touch screen overlay device, the touch screen overlay device being operative to communicate with the first processor utilizing a four wire interface.

4. The apparatus of claim 3 wherein the tamper detection mechanism is a plunger switch, said switch affixed to the circuit board in a manner such that an attempt to gain access to the first processor, the four wire interface or the encryption device results in the detection of tampering.

5. The apparatus of claim 4 wherein the encryption device is a cryptographic smart card, said cryptographic smart card being affixed to the circuit board in such a manner that an attempt to access the cryptographic smart card results in the detection of tampering.

6. The apparatus of claim 5 wherein the cryptographic smart card is a punch-out cryptographic smart card.

7. The apparatus of claim 6 wherein the first processor is a microcontroller enabled to communicate with the touch screen device utilizing the four wire interface, the tamper detection mechanism, the cryptographic smart card and a second processor, and is not operative to communicate with any devices external to the secure apparatus.

8. A secure apparatus for encrypting data comprising:

a touch screen device, the screen layout of said touch screen comprising a protected data entry screen area and an unprotected data entry screen area;

a first processor, said first processor being affixed to a circuit board, said first processor being further operative to communicate with an encryption device and a touch screen device, and the first processor being further operative to determine whether a touch input detected by the touch screen device originated in the protected data entry screen area or the unprotected data entry screen area;

a second processor, said second processor being affixed to the circuit board, said second processor being further operative to communicate with the first processor and the touch screen device;

an encryption device operative to encrypt touch inputs that originated in the protected data entry screen area; and

a tamper detection mechanism.

9. The apparatus of claim 8 wherein the first processor is a microcontroller enabled to communicate with the touch screen device, the tamper detection mechanism, the cryptographic smart card and a second processor, and is not operative to communicate with any devices external to the secure apparatus;

and

wherein the second processor is a microprocessor enabled to communicate with the first processor, the touch screen device, and is operative to communicate with any devices external to the secure apparatus.

10. A system for encrypting data comprising:

a display device comprising an LCD flat panel display and a touch panel device;

a first processor connected to said touch panel overlay device, said first processor being operative to decode touch input signals from said touch panel overlay device;

a second processor, said second processor being operative to execute application software for controlling the images displayed on the LCD flat panel display;

a cryptographic smart card operable to encrypt data; and

a tamper detection device, said tamper detection device being operative to signal said cryptographic smart card if the tamper detection device detects tampering.

11. The system of claim 10 wherein the data is PIN data.

12. The system of claim 11 wherein the cryptographic smart card is operative to permanently erase one or more encryption algorithms stored within a memory of said cryptographic smart card upon said cryptographic smart card receiving a signal from the first processor indicating that the tamper detection device has detected tampering.

13. The system of claim 12 wherein the first processor is further operable to separate touch input signals detected in a protected data entry portion of said touch panel device from touch input signals detected in the nonprotected data entry portion of said touch panel device.

14. The system of claim 13 wherein the first processor is further operable to send the touch signals detected in the protected data entry portion of said touch panel device to the cryptographic smart card only, and to send the touch signals detected in the nonprotected data entry portion of said touch panel device to the second processor only.

15. The system of claim 14 wherein the first processor is further enabled to receive encrypted data from the cryptographic smart card and to send the encrypted data to the second processor.

16. A method of encrypting data, the method comprising the steps of:

detecting touch input signals from a touch screen;

determining whether said touch input signals originated in a protected data entry portion of said touch screen or in a non protected data entry portion of said touch screen;

translating only the touch input signals that originated in the protected data entry portion of the touch screen into data;

sending the data to a cryptographic smart card; and

encrypting the data.

17. The method of claim 16 wherein the data originating in the protected data entry area is PIN data.

18. A method of encrypting PIN data, the PIN data comprising one or more data elements, the method comprising the steps of:

detecting a first touch input signal from a touch screen;

determining whether said first touch input signal originated in a protected PIN data entry portion of said touch screen;

translating the first touch input signal into a first data element if the first detected touch input signal originated in the protected PIN data entry portion of the touch screen;

determining if the first data element is an alphanumeric character or a command; and

storing said first data element that is an alphanumeric character as a first PIN data element or executing said first data element that is a command.

19. The method of claim 18 further comprising the steps of:

determining if a predetermined number of data elements have been stored, the predetermined number of data elements comprising a PIN;

detecting subsequent data elements if said predetermined number of data elements have not been stored; and

sending said predetermined number of data elements comprising the PIN to a cryptographic smart card and encrypting the PIN.

20. A method of generating a master key storage (MSK) key for a device, the method comprising the steps of:

generating a first random seed;

sending the first random seed to a cryptographic smart card;

generating a second random seed;

combining said second random seed with a cryptographic smart card serial number and a device serial number thereby generating an intermediate data key;

encrypting said data key with the first random seed, thereby generating the MSK key; and

storing the MSK key within the cryptographic smart card.

21. The method claim 20 further comprising the step of permanently erasing the residue of the MSK key generation process, the residue comprising the first random seed, the second random seed and the intermediate data key.

22. A method for maintaining the integrity of data keys stored within a cryptographic smart card, the method comprising the steps of:

monitoring a tamper detection signal, the absence of the tamper detection signal indicating that the cryptographic smart card has not been tampered with;

monitoring a power supply input and a battery input, the presence of the power supply input and the battery input indicating that the supply of electrical power to the cryptographic smart card is uninterrupted; and

clearing a data erasure byte upon the detection of the presence of the tamper detection signal, or upon the absence of both the power supply input and the battery input, thereby putting the cryptographic smart card into a data erasure state.

23. The method of claim 22, further comprising the steps of:

issuing a message to any devices communicating with the cryptographic smart card, the message indicating that the cryptographic smart card is entering a data erasure state;

halting the execution of any other processing within the cryptographic smart card; and

executing a process to erase one or more data keys stored within the cryptographic smart card.

24. The method of claim 23, further comprising the step of issuing a message to any devices communicating with the cryptographic smart card, the message indicating that the cryptographic smart card has erased all of the one or more data keys stored within the cryptographic smart card.

25. The method of claim 24, further comprising the steps of:

detecting the interruption and resumption of the supply of electrical power to the cryptographic smart card;

issuing a message to any devices communicating with the cryptographic smart card, the message indicating that the process of erasing all of the one or more data keys stored within the cryptographic smart card; and

completing the process of erasing all of the one or more data keys stored within the cryptographic smart card.