Automated banking machine system and method

• US 7,415,609 B1
• Filed: 04/19/2002
• Issued: 08/19/2008
• Est. Priority Date: 04/23/2001
• Status: Active Grant

• Current Assignee: Diebold Nixdorf, Incorporated
• Original Assignee: Diebold Incorporated (Diebold Nixdorf, Incorporated)
• Inventors: Zajkowski, Timothy, Smith, Mark D., Doland, Anne
• Primary Examiner(s): Barron, Jr.; Gilberto
• Assistant Examiner(s): Gelagay; Shewaye
• Application Number:
  US10/126,807
• Time in Patent Office: 2,314 Days
• Field of Search: 713/168
• US Class Current: 713/168
• CPC Class Codes: G06Q 20/341 Active cards, i.e. cards including their own processing means, e.g. including an IC or chip
• CPC Class Codes: G06Q 20/3672 initialising or reloading thereof
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: G06Q 20/3829 involving key management
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 20/4012 Verifying personal identification numbers [PIN]
• CPC Class Codes: G06Q 20/40975 using encryption therefor
• CPC Class Codes: G07F 19/20 Automatic teller machines [ATMs]
• CPC Class Codes: G07F 19/206 Software aspects at ATMs
• CPC Class Codes: G07F 7/1008 Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system
• CPC Class Codes: G07F 7/1091 Use of an encrypted form of the PIN
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/0825 using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04L 9/321 involving a third party or a trusted authority
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823

Abstract

An automated banking machine (12, 200, 302) is provided. The machine may be operative to install a terminal master key (TK) therein in response to at least one input from a single operator. The machine may include an EPP (204) that is operative to remotely receive an encrypted terminal master key from a host system (210, 304). The machine may authenticate and decrypt the terminal master key prior to accepting the terminal master key. The machine may further output through a display device (30) of the machine a one-way hash of at least one public key associated with the host system. The machine may continue with the installation of the terminal master key in response to an operator confirming that the one-way hash of the public key corresponds to a value independently known by the operator to correspond to the host system.

Claims

1. A method comprising:

a) loading at least one public key and private key pair in an automated banking machine that includes a cash dispenser, wherein the automated banking machine is operative to use at least one symmetric cryptography key to encrypt data with a symmetric cryptography algorithm, wherein the data is associated with at least one transaction being performed at the automated banking machine;

b) enabling the automated banking machine to use at least one asymmetric cryptography algorithm with the at least one public key and private key pair;

c) receiving with the automated banking machine at least one message that includes data representative of at least one second symmetric cryptography key;

d) using the at least one asymmetric cryptography algorithm to decrypt and verify the at least one second symmetric cryptography key;

e) receiving with the automated banking machine at least one second message that includes data representative of an encrypted at least one first symmetric cryptography key; and

f) using the at least one second symmetric cryptography key to decrypt with the automated banking machine the encrypted at least one first symmetric cryptography key.

2. The method according to claim 1, wherein the symmetric cryptography algorithm includes a DHS algorithm.

3. The method according to claim 2, wherein the asymmetric cryptography algorithm includes an RSA algorithm.

4. The method according to claim 3, wherein in (e) the at least one first symmetric cryptography key includes a communication key, further comprising:

through operation of the automated banking machine, using the communication key to encrypt personal identification numbers inputted through an input device of the automated banking machine.

5. The method according to claim 4, wherein in (c) the at least one second symmetric cryptography key includes a terminal master key, wherein in (f) the automated banking machine decrypts the communication key with the terminal master key.

6. A method comprising:

a) sending from an automated banking machine including a cash dispenser to a remote computer, at least one message that comprises a public key associated with the automated banking machine;

b) receiving with the automated banking machine from the remote computer, at least one message that comprises a key encrypted using the public key;

c) through operation of at last one processor in the automated banking machine, causing the key encrypted in (b) to be decrypted using an asymmetric cryptography algorithm and a private key stored in the automated banking machine;

d) receiving with the automated banking machine from the remote computer, at least one message that comprises at least one further key encrypted using the key received in (b);

e) through operation of the at least one processor in the automated banking machine, causing the at least one further key received in (d) to be decrypted using at least one symmetric cryptography algorithm and the first key;

f) receiving through operation of an input device included in the automated banking machine, at least one first input; and

g) through operation of the at least one processor in the machine, causing the at least one first input to be encrypted using the at least one symmetric cryptography algorithm and the at least one further key received in (d).

7. The method according to claim 6, further comprising:

h) sending from the automated banking machine to the remote computer, at least one message that comprises the encrypted first input;

i) receiving with the automated banking machine from the remote computer, at least one message including data indicating that a banking transaction is authorized to be performed by the automated banking machine; and

j) through operation of the automated banking machine, performing the banking transaction.

8. The method according to claim 7, wherein (j) includes dispensing cash with the cash dispenser.

9. The method according to claim 6, wherein the key received in (b) corresponds to a terminal master key;

further comprising;

h) storing the terminal master key in a data store included in the automated banking machine.

10. The method according to claim 9, wherein the at least one further key received in (d) corresponds to a communication key.

11. The method according to claim 9, wherein in (f) the input device comprises an encrypting pin pad, wherein in (h) the data store is included in the encrypted pin pad, wherein in (c), (e), and (g) the at least one processor is included in the encrypting pin pad.

12. The method according to claim 11, wherein in (f) the input corresponds to a PIN associated with a financial account.

13. At least one article bearing computer executable instructions which are operative to cause at least one processor included in an automated banking machine to cause the automated banking machine to carry out a method comprising:

a) sending from the automated banking machine including a cash dispenser to a remote computer, at least one message that comprises a public key associated with the automated banking machine;

b) receiving with the automated banking machine from the remote computer, at least one message that comprises a key encrypted using the public key;

c) through operation of the at least one processor in the automated banking machine, causing the key encrypted in (b) to be decrypted using an asymmetric cryptography algorithm and a private key stored in the automated banking machine;

d) receiving with the automated banking machine from the remote computer, at least one message that comprises at least one further key encrypted using the key received in (b);

e) through operation of the at least one processor in the automated banking machine, causing the at least one further key received in (d) to be decrypted using at least one symmetric cryptography algorithm and the key;

f) receiving through operation of an input device included in the automated banking machine, at least one first input; and

g) through operation of the at least one processor in the machine, causing the at least one first input to be encrypted using the at least one symmetric cryptography algorithm and the at least one further key received in (d).