Remote display tamper detection using data integrity operations

• US 8,009,032 B2
• Filed: 11/21/2006
• Issued: 08/30/2011
• Est. Priority Date: 11/21/2006
• Status: Active Grant

• Current Assignee: Gilbarco Incorporated (Vontier Corp.)
• Original Assignee: Gilbarco Incorporated (Vontier Corp.)
• Inventors: Long, Joseph D., Carapelli, Giovanni
• Primary Examiner(s): Bugg; George
• Assistant Examiner(s): Labbees; Edny
• Application Number:
  US11/562,150
• Publication Number:
  US 20080120191A1
• Time in Patent Office: 1,743 Days
• Field of Search: 340/500, 340/539.1, 340/539.31, 340/5.1, 340/5.9, 705 16- 18
• US Class Current: 340/500
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 2221/032 Protect output to user by software means
• CPC Class Codes: G06Q 20/20 Point-of-sale [POS] network systems
• CPC Class Codes: G06Q 20/204 comprising interface for record bearing medium or carrier for electronic funds transfer or payment credit
• CPC Class Codes: G07F 13/025 wherein the volume is determined during delivery
• CPC Class Codes: G07F 9/002 Vending machines being part of a centrally controlled network of vending machines

Abstract

Methods and systems for detecting tampering of a remote display. According to one method, a first data integrity result is generated by performing a first data integrity operation on display data to be displayed on the remote display at a secure module. The display data is transmitted from the secure module to the remote display security module. The remote display security module receives the display data. A second data integrity result is generated by performing the first data integrity operation on the display data received at the remote display security module. A determination is made as to whether the remote display has been tampered with at the secure module if the first data integrity result does not match the second data integrity result.

Claims

1. A method for detecting tampering of a remote display having an associated remote display security module, comprising the steps of:

generating at a secure module a first data integrity result by performing a first data integrity operation on display data that instructs the remote display what to display;

transmitting the display data from the secure module to the remote display security module;

receiving at the remote display security module the display data;

generating a second data integrity result at the remote display security module by performing the first data integrity operation on the received display data;

transmitting the second data integrity result to the secure module; and

determining that the remote display has been tampered with at the secure module if the second data integrity result as received at the secure module does not match the first data integrity result.

2. The method of claim 1 further comprising displaying the display data on the remote display.

3. The method of claim 2 wherein the step of displaying the display data is performed at the remote display security module.

4. The method of claim 1 further comprising monitoring a tamper detection switch at the remote display security module.

5. The method of claim 4 comprising determining that the remote display has been tampered with at the remote display security module by sensing a signal from the tamper detection switch indicating that the remote display has been tampered with.

6. The method of claim 5 wherein the remote display security module senses the signal from the tamper detection switch indicating that the remote display has been tampered with in association with a boot sequence for the remote display security module after at least one of a reset and a power-down condition at the remote display security module.

7. The method of claim 4 wherein the tamper detection switch is selected from a group consisting of a plunger switch and a proximity switch.

8. The method of claim 1 wherein the first data integrity operation includes calculating a cyclical redundancy check (CRC) on the display data.

9. The method of claim 7 wherein the CRC is calculated on a fixed portion of the display data.

10. The method of claim 7 wherein the CRC is calculated on a varying portion of the display data.

11. The method of claim 7 wherein the CRC is calculated by delaying at least one bit of the display data.

12. The method of claim 1 wherein the first data integrity operation is selected from a plurality of data integrity operations.

13. The method of claim 1 wherein the first data integrity operation is selected in association with a control signal asserted to the remote display.

14. The method of claim 1 further comprising sending an indication identifying the first data integrity operation within a plurality of data integrity operations to the remote display security module.

15. The method of claim 13 wherein an indication identifying the first data integrity operation is sent to the remote display security module at a time other than when the display data is sent to the remote display security module.

16. The method of claim 1 wherein at least a portion of the display data is used to select the first data integrity operation within a plurality of data integrity operations.

35. The method of claim 1 further comprising identifying the first data integrity operation using the display data.

17. A system for detecting tampering of a display comprising:

a remote display security module associated with the display and in electrical communication with a secure module, wherein;

the secure module is adapted to;

generate a first data integrity result by performing a first data integrity operation on display data to be displayed on the display;

transmit the display data to the remote display security module; and

determine that the display has been tampered with if the first data integrity result does not match a second data integrity result; and

the remote display security module is adapted to;

receive the display data;

generate the second data integrity result by performing the first data integrity operation on the display data received at the remote display security module, wherein the first data integrity operation is identified from an analysis of a data stream associated with the display data; and

transmit the second data integrity result to the secure module.

18. The system of claim 17 wherein the remote display security module is further adapted to display the display data on the display.

19. The system of claim 17 wherein the remote display security module is further adapted to monitor a tamper detection switch.

20. The system of claim 19 wherein the remote display security module is further adapted to determine that the display has been tampered with by sensing a signal from the tamper detection switch indicating that the display has been tampered with.

21. The system of claim 20 wherein the remote display security module is further adapted to sense the signal from the tamper detection switch indicating that the display has been tampered with in association with a boot sequence for the remote display security module after at least one of a reset and a power down condition at the remote display security module.

22. The system of claim 19 wherein the tamper detection switch is selected from a group consisting of a plunger switch and a proximity switch.

23. The system of claim 17 wherein the secure module and the remote display security module are adapted to perform the first data integrity operation by calculating a cyclical redundancy check (CRC) on the display data.

24. The system of claim 23 wherein the secure module and the remote display security module are adapted to calculate the CRC on a fixed portion of the display data.

25. The system of claim 23 wherein the secure module and the remote display security module are adapted to calculate the CRC on a varying portion of the display data.

26. The system of claim 23 wherein the secure module and the remote display security module are adapted to calculate the CRC by delaying at least one bit of the display data.

27. The system of claim 17 wherein the first data integrity operation comprises at least one of a plurality of data integrity operations.

28. The system of claim 17 wherein the secure module is adapted to select the first data integrity operation in association with assertion of a control signal to the display.

29. The system of claim 17 wherein the secure module is adapted to send an indication identifying the first data integrity operation comprising at least one of a plurality of data integrity operations to the remote display security module.

30. The system of claim 29 wherein the secure module is adapted to send the indication identifying the first data integrity operation comprising at least one of a plurality of data integrity operations to the remote display security module at a time other than when the display data is sent to the remote display security module.

31. The system of claim 17 wherein the secure module and the remote display security module are further adapted to use at least a portion of the display data to select the first data integrity operation within a plurality of data integrity operations.

36. The system of claim 17 wherein the data stream includes the display data.

32. A display system in a fuel dispenser, said system comprising:

a display mounted in fixed position relative to a housing of said fuel dispenser so as to be viewable by a user;

processing circuitry located in said fuel dispenser remote from said display, said processing circuitry transmitting display data;

said processing circuitry being adapted to generate a first data integrity result by performing a first data integrity operation on said display data;

a circuitry module located adjacent to said display for receiving said display data from said processing circuitry, said display data being used to produce information shown on said display;

said circuitry module being adapted to generate a second data integrity result by performing the first data integrity operation on the display data, wherein the first data integrity operation is identified based on an analysis of a signal associated with the display data; and

said processing circuitry comparing the first data integrity result to the second data integrity result to determine whether tampering has occurred.

33. The system of claim 32 wherein the processing circuitry includes a receive data integrity module and a transmit data integrity module.

34. The system of claim 32 wherein the processing circuitry includes a CPU located in a secure module.

37. The system of claim 32 wherein the signal is a vertical sync signal.