Keyboard for secure data entry

Abstract

The present invention is entitled "Keyboard for secure data input". The present invention provides a keyboard for secure data input. The keyboard includes at least one or more of the data input buttons that can be pressed by the user. For each of the data input buttons, a button actuator is provided, which can move after the user presses the corresponding data input button, and a main capacitance sensor is provided, which is arranged to determine the movement of the button actuator of the corresponding data input button by capacitance sampling. The button actuator is at least partially made of conductive material. The button actuator is coupled to a defined potential at least during the capacitance sampling to shield the main capacitance sensor from being eavesdropped.

Description

Technical Field

[0001] The invention relates to the field of keyboards for secure data entry. Background Art

[0002] This background section is provided to generally describe the context of the present disclosure. To the extent that the work described in this background section, the work of the designated inventors of the present invention, and all aspects of the specification that were not otherwise identified as prior art at the time of filing, are neither explicitly nor implicitly admitted to be prior art according to the present disclosure.

[0003] In the field of computer technology, a number of applications require the possibility of safe and reliable data input, such as in particular for authentication purposes in order to gain access to electronic or physical resources.

[0004] For example, in a point of sale (POS) or building access system, a user is usually required to enter a password or PIN. On the one hand, the password input needs to be reliable to allow the user to easily obtain access rights, and on the other hand, the security of the input needs to be maintained. In the above two examples, the corresponding password input can be performed in a public place. Because of this, the corresponding password input system may be tampered with by a malicious third party to obtain the password and obtain access rights to the corresponding resource.

[0005] For example, a third party may attempt to scan a PIN entry using a so-called "side-channel attack." This traditional key array scanning method allows scanning signal changes, such as high / low level changes on the column and row circuits of the keyboard. Using widely available side-channel attacks, it is relatively easy to monitor such changes.

[0006] To address the problem of side-channel scanning, a known solution is to prevent keyboard input from being monitored by using a flexible mask with printed silver paste conductors, which is placed on top of the typical button dome array of the keyboard. The silver paste mask is connected to the internal anti-tamper pins to form an active shielding mask. However, this solution frequently suffers from bending of the silver paste mask during the assembly process and during use, which can cause reliability issues. In addition, the cost of such an arrangement is quite high. Summary of the invention

[0007] The following summary of the invention is provided to facilitate understanding of some innovative features unique to the invention and is not intended to be a complete description. A comprehensive understanding of the various aspects of the invention can be obtained by taking the entire specification, claims, drawings and abstract as a whole.

[0008] In light of the foregoing discussion, a need exists to provide an improved keyboard that allows for reliable, secure data entry and is protected from eavesdropping by malicious third parties.

[0009] As defined in the independent claims, the present invention provides an improved keyboard for secure data entry, a point of sale device and a method of secure data entry. Embodiments of the invention are discussed in the dependent claims and in the following description.

[0010] According to one aspect of the present invention, a keyboard for secure data entry is provided. The keyboard includes at least one or more of the data input buttons that can be pressed by the user, and a button actuator for each of the data input buttons that can be moved after the user presses the corresponding data input button, and a main capacitance sensor, which is arranged to determine the movement of the button actuator of the corresponding data input button by capacitance sampling. According to this aspect, the button actuator is at least partially made of conductive material, and the button actuator is coupled to a defined potential at least during the capacitance sampling to shield the main capacitance sensor from being eavesdropped.

[0011] According to another aspect of the present invention, a point of sale (POS) device is provided, which includes at least one POS transaction processor, one or more of the data input buttons that can be depressed by the user, and a button actuator for each of the data input buttons that can move after the user presses the corresponding data input button, and a primary capacitance sensor, the primary capacitance sensor being arranged to determine the movement of the button actuator of the corresponding data input button by capacitance sampling. The button actuator is at least partially made of conductive material, and the button actuator is coupled to a defined potential at least during the capacitance sampling to shield the primary capacitance sensor from being eavesdropped.

[0012] According to yet another aspect of the present invention, a method of secure data entry using a keyboard having one or more of the data entry buttons depressible by a user is provided. In this aspect, for each of the data entry buttons, a button actuator and a primary capacitive sensor are provided. The method comprises: a) sampling the primary capacitive sensor to determine movement of the button actuator, and b) at least during the sampling, coupling the button actuator to a defined potential to shield the primary capacitive sensor from eavesdropping.

[0013] The basic idea of ​​the aforementioned aspects of the invention is to provide a keyboard for secure data input with a capacitive sensor to determine whether a data input button of the keyboard is depressed by a user, the keyboard using the button actuator of each data input button to at least temporarily provide shielding against malicious third party eavesdropping. Thus, secure data input can be achieved with a highly reliable and cost-effective arrangement.

[0014] These and other aspects of the invention will be apparent from and elucidated with reference to the embodiments described hereinafter. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] In the accompanying drawings,

[0016] Figure 1 A first embodiment of a point of sale (POS) device is shown;

[0017] Figure 2 Show according to Figure 1 A schematic block diagram of a POS device according to an embodiment of the present invention;

[0018] Figure 3 A partially exploded view showing an embodiment of a keyboard;

[0019] Figure 4 Show Figure 3 A schematic top view of the middle PCB layer of the keyboard of the embodiment;

[0020] Figure 5 Show Figure 3 A schematic top view of the top PCB layer of the keyboard of the embodiment of the present invention;

[0021] Figure 6 Show Figure 3 A schematic top view of the bottom PCB layer of the keyboard of the embodiment;

[0022] Figure 7 A flow chart showing the operation when tampering is detected; and

[0023] Figure 8 Show Figure 3 Embodiment of a button actuator for a keyboard. DETAILED DESCRIPTION

[0024] The technical features described in this patent application can be used to construct various embodiments of keyboards for secure data entry, point of sale devices, and methods of secure data entry.Some embodiments of the invention are discussed to enable those skilled in the art to make and use the invention.

[0025] In a first exemplary aspect, a keyboard for secure data entry is provided. The keyboard includes at least one or more data input buttons that can be depressed by a user. For each of the data input buttons, a button actuator is provided, which can move after the user presses the corresponding data input button. In addition, for each of the data input buttons, a main capacitance sensor is provided, which is arranged to determine the movement of the button actuator of the corresponding data input button by capacitance sampling. According to this aspect, the button actuator is at least partially made of conductive material, and the button actuator is coupled to a defined potential at least during capacitance sampling to shield the main capacitance sensor from eavesdropping.

[0026] The keyboard according to the present aspect can be of any suitable type. In some embodiments, the keyboard is a computer keyboard, such as a QUERTY type keyboard. In some embodiments, the keyboard is configured as a numeric keypad, also referred to as a numeric keypad or a numeric keypad. In some embodiments, the data input buttons are arranged in a matrix, such as a 3×3 matrix.

[0027] As discussed in the foregoing, a keyboard according to the present aspect includes one or more data input buttons that can be pressed by a user, i.e., can be operated by the user. The data input buttons can be of any suitable type and material, depending on the application, such as square or round plastic or metal. For each data input button, the keyboard also includes an associated button actuator that can move after the user operates / presses the corresponding data input button. The button actuator is at least partially made of conductive material, but can also be of any suitable type. In some embodiments, the button actuator is made of metal, plastic, or a combination thereof. In some embodiments, the button actuator is dome-shaped, which allows deformation of the button actuator when the user presses the corresponding button.

[0028] The keyboard according to the present aspect further comprises a primary capacitance sensor for each data input button. The primary capacitance sensor is used to determine the movement of the button actuator of the corresponding data input button by capacitance sampling, i.e. by determining the change in capacitance of the primary capacitance sensor. It should be noted that in this context, the term "movement" relative to the button actuator is to be understood broadly and includes a change in position of the button actuator, but also includes a deformation of the button actuator.

[0029] The primary capacitive sensor may be of any suitable type, various types of which are known in the art. In some embodiments, the primary capacitive sensor is a mutual capacitive sensor, such as described, for example, in US 9543948 or US 9430107, the entire contents of which are incorporated herein by reference. In some embodiments, the primary capacitive sensor is a self-capacitive sensor.

[0030] According to the present aspect, the button actuator is coupled to a defined potential at least during the capacitance sampling of the primary capacitance sensor. In this way, the button actuator, or more precisely the conductive portion of the button actuator, acts as an active shield for the primary capacitance sensor, making it more difficult to eavesdrop or monitor electrical changes in the primary capacitance sensor in a typical side-channel attack.

[0031] For example, and in some embodiments, the button actuator is coupled or connected to ground potential at least during the capacitance sampling period. In other embodiments, the button actuator is coupled to a potential different from the ground potential at least during the capacitance sampling period. In some embodiments, the button actuator is coupled to a defined potential not only during the capacitance sampling period but also for a longer period of time. In some embodiments, the button actuator is permanently coupled to a defined potential when the keyboard is operational, i.e., powered on.

[0032] In some embodiments, the button actuator of the corresponding button is coupled to a defined potential at least during the capacitance sampling period. In some embodiments, the button actuators of all data input buttons are coupled to a defined potential at least during the capacitance sampling period. The latter embodiments provide further improved shielding functions.

[0033] In some embodiments, the keyboard may include additional components, such as one or more of a housing, a processor, a suitable power supply, a display, a memory, a credit card reader, a printer, and an interface to a communications network. It should be noted that in some embodiments, in addition to one or more data entry buttons, the keyboard may include one or more additional buttons that do not include a button actuator and / or a primary capacitive sensor as discussed above. For example, in a typical point of sale (POS) credit card terminal application, the keyboard may include a 3×3 matrix of (secure) data entry buttons as discussed, but also include a power on / off button and a "print" button, which may be of a typical, non-secure type.

[0034] In some embodiments, the keyboard includes a keyboard controller configured to at least control the capacitance sampling of the primary capacitance sensor and couple the button actuator to a defined potential at least during the capacitance sampling period. The keyboard controller may be of any suitable type, including without limitation a microcontroller or a microprocessor.

[0035] In some embodiments, each data input button includes a button cap that can be touched and depressed by a user, and the button cap is arranged on a first side of the correspondingly associated button actuator. In some embodiments, the primary capacitive sensor is arranged on a second side of the button actuator opposite to the first side of the button actuator.

[0036] In some embodiments, the keyboard also includes a shield removal detection circuit to determine tampering with one or more of the button actuators. The determination of tampering in this context may include, without limitation, the removal of one or more of the button actuators and / or buttons. In some embodiments where the keyboard includes button caps, the determination of tampering may also include detecting a person or a conductive probe directly contacting one of the button actuators, as this would indicate the removal of the corresponding plastic button cap of the button. The foregoing embodiments further increase the security of the keyboard.

[0037] In some embodiments, the shield removal detection circuit is configured to erase data and / or suspend operation of the keyboard when tampering is detected. In some embodiments, a tamper indicator such as a corresponding LED is activated. In some embodiments, a tamper indicator message is provided to a remote server in the event that tampering is detected. In some embodiments, a keyboard controller is connected to the shield removal detection circuit and is configured to control the operation of the shield removal detection circuit.

[0038] The shield removal detection circuit may be of any suitable type. In some embodiments, the shield removal detection circuit includes a sub-capacitive sensor for each of the data input buttons. The sub-capacitive sensor may be of any suitable type, such as a mutual capacitance sensor or a self-capacitive sensor. It should be noted that in some embodiments, the sub-capacitive sensor may not be configured to determine whether the button is pressed by a user, but only to determine tampering with one of the button actuators.

[0039] In some embodiments, the secondary capacitive sensor is arranged between the button actuator and the primary capacitive sensor.This embodiment enables a very compact arrangement.

[0040] In some embodiments, the keyboard includes at least one printed circuit board including one or more of a primary capacitive sensor and a secondary capacitive sensor. Specifically and in some embodiments, the primary capacitive sensor is arranged in an intermediate layer of the printed circuit board. The latter arrangement further increases the reliability of the keyboard, as dust or other environmental influences do not interfere with the detection of a button press by a user.

[0041] According to another aspect, a point of sale (POS) device is provided, the point of sale device including at least one POS transaction processor and one or more of the data input buttons that can be depressed by the user. The POS device also includes a button actuator for each of the data input buttons that is movable after the user depresses the corresponding button; and a primary capacitance sensor arranged to determine the movement of the button actuator of the corresponding data input button by capacitance sampling. According to this aspect, the button actuator is at least partially made of a conductive material; and the button actuator is coupled to a defined potential at least during the capacitance sampling to shield the primary capacitance sensor from being eavesdropped.

[0042] The POS device according to this aspect and further embodiments may be configured according to one or more of the embodiments discussed in the foregoing with reference to the foregoing aspects. Reference is made to the discussion of the foregoing aspects with respect to the terms used to describe this aspect and their definitions.

[0043] In some embodiments, the POS transaction processor is configured to process credit card transactions for a connected credit card reader.

[0044] According to another aspect, a method for secure data entry using a keyboard is provided. The keyboard includes one or more of data input buttons that can be depressed by a user; and a button actuator for each of the data input buttons that is movable after the user depresses the corresponding data input button and is at least partially made of a conductive material; and a primary capacitive sensor. The method of this aspect includes sampling the primary capacitive sensor to determine movement of the button actuator; and at least during the sampling, coupling or connecting the button actuator to a defined potential to shield the primary capacitive sensor from eavesdropping.

[0045] The method according to this aspect and in further embodiments may be configured according to one or more of the embodiments discussed in the foregoing with reference to the foregoing aspects. Reference is made to the discussion of the foregoing aspects with respect to the terms used to describe this aspect and their definitions. In some embodiments, the foregoing method steps of sampling the primary capacitance sensor to determine movement of the button actuator; and coupling the button actuator to a defined potential to shield the primary capacitance sensor from eavesdropping at least during the sampling, are repeated during operation of the keyboard.

[0046] Reference will now be made to the drawings, wherein numerical references to the various elements of the embodiments will be given, and wherein further embodiments will be discussed.

[0047] Specific references to components, sections, portions, process steps, and other elements are not intended to be limiting. In addition, it should be understood that when referring to alternative drawings, similar parts have the same reference numerals. It should also be noted that the drawings are schematic and are intended to provide guidance to readers in the art and are not necessarily drawn to scale. Rather, the various drawing scales, aspect ratios, and numbers of components shown in the drawings may be intentionally distorted to make certain features or relationships easier to understand.

[0048] Those skilled in the art will readily recognize that in the field of access control, such as for electronic payments or access to electronic resources (e.g., computer access) or physical (e.g., building) resources and specifically when entering passwords, it is very important that the passwords remain secure and are known only to those for whom they are authorized. In recent years, malicious third parties have attempted to obtain personal identification numbers (PINs) from point-of-sale (POS) credit card terminals by placing a "scanner" near the terminal that tracks the low / high signal changes of the column and row circuits of the keypad. In the following, an exemplary POS device 1 will be described in more detail, which includes a keyboard for secure data entry and reduces the likelihood of a successful scanning attack by a malicious third party.

[0049] Figure 1A first embodiment of a Point of Sale (POS) device / system 1, ie a POS credit / debit card processing terminal, is shown. The POS device 1 comprises a display 2, a magnetic card reader 3a, a chip reader 3b and a keyboard 4, in particular for secure data entry. Figure 2 A schematic block diagram of a POS device 1 is shown, showing additional components, namely a communication interface 5, a POS processor 6 and a power supply 7. The POS processor 6 controls the operation of the POS device 1 and includes a microprocessor and a memory, the latter including firmware, i.e., software, to provide the transaction processing functionality of the POS device 1. The communication interface 5 is a wired / wireless LAN Ethernet interface for connecting to a private or public network and server corresponding to a typical POS device 1 to transmit transaction data to a remote transaction processing server and obtain authorization for the corresponding transaction from the remote transaction processing server. The POS device 1 also includes a power supply 7 for providing operating power to all other components of the device 1. In order not to obscure the drawings, the power supply 7 is used to provide operating power to all other components of the device 1. Figure 2 The connections from and to the power supply 7 are omitted.

[0050] In the following, the configuration of the keyboard 4 will be discussed in detail. Figure 3 , a partial exploded view of the keyboard 4 is shown. As shown in the accompanying drawings, the keyboard 4 includes a plurality of data input buttons 30, each of which includes a plastic button cap 31 and a button actuator 32. The button actuator 32 in the present embodiment is dome-shaped and made of metal. The button actuator 32 is deformable when a user applies force thereto (i.e., after pressing the corresponding data input button 30), and is used to indicate that the corresponding button has been pressed. The button actuator 32 also acts as a spring so that the data input button 30 returns to its initial position after the user's force is removed.

[0051] The keyboard 4 further comprises a multilayer printed circuit board (PCB) 33. The middle layer 35 of the PCB comprises a plurality of primary capacitance sensors 40, i.e. one sensor 40 for each button 30. The primary capacitance sensors 40 are used to detect whether the user has pressed the corresponding data input button 30 by capacitance sampling. The primary capacitance sensors 40 are mutual capacitance sensors.

[0052] Figure 4 Schematic top view of the middle PCT layer 35 is shown. Each primary capacitive sensor 40 includes a transmit (TX) node 41 and a receive (RX) node 42, which are connected to a keyboard controller 43 in a row / column arrangement. It should be noted that the keyboard controller 43 is placed on the lowermost PCB layer 37, which will be referred to below. Figure 6 Discuss in detail.

[0053] During capacitance sampling, the keyboard controller 43 generates a pulsed electric field between the transmit node 41 and the receive node 42 of each primary capacitance sensor 40, and determines over a plurality of pulses whether the electric field has changed. In this embodiment, the electric field between the TX node 41 and the RX node 42 is affected by the metal button actuator 32. If the actuator 32 is deformed by the user pressing the corresponding data input button 30, the electric field in the associated primary capacitance sensor 40 will change, indicating to the keyboard controller that the button 30 is pressed by the user, which in turn provides corresponding information to the POS processor 6.

[0054] Compared to prior art keyboards using electrical contacts, the signal change of the mutual capacitance sensor 40 after the user presses the button 30 is relatively small. Therefore, the possibility of monitoring the signal change by a malicious third party is reduced. In addition, the present arrangement provides key depression detection that does not rely on electrical contacts to close and open, which provides a highly reliable arrangement regardless of environmental conditions, such as the presence of dust, moisture, etc., which may be a problem in keyboards using electrical contacts.

[0055] To further reduce the possibility of eavesdropping on the internal signals of the keyboard 4, the keyboard controller 34 couples the metal button actuator 32 to ground potential during capacitance sampling of the primary capacitance sensor 40. The metal button actuator 32 thus forms an active shield for the primary capacitance sensor 40.

[0056] Additional active shielding functionality is provided by the top PCB layer 34, which is Figure 5 . The PCT layer 34 comprises a secondary capacitive sensor 50, which in this embodiment is formed as a self-capacitive sensor 50. The purpose of the secondary capacitive sensor 50 is twofold. On the one hand, the secondary capacitive sensor 50 provides additional shielding for the primary capacitive sensor 40. On the other hand, the secondary capacitive sensor 50 together with the button actuator 32 forms part of a shield removal detection circuit 51 to allow determination of whether the device 1 has been tampered with, for example whether the metal button actuator 32 shielding the primary capacitive sensor 40 has been touched or removed.

[0057] The secondary capacitance sensors 50 are arranged on top of the primary capacitance sensors 40 and connected to the keyboard controller 43 in five rows for cost saving reasons. This is possible because, as discussed in the foregoing, the secondary capacitance sensors 50 are not designed to determine which button 30 is pressed by a user, but rather to monitor whether any button 30 has been tampered with, such as by removing the button actuator 32 or the top PCB layer 34 by a malicious person. The secondary capacitance sensors 50 also determine whether the button actuator 32 has been touched directly by a person or by a conductive probe, both of which indicate that the button cap 31 has been removed.

[0058] The secondary capacitance sensor 50 and the primary capacitance sensor 40 are then sampled by the keyboard controller 43. During the capacitance sampling of the primary capacitance sensor 40, the button actuator 30 is controlled to the ground potential via the secondary capacitance sensor 50. During the capacitance sampling of the secondary capacitance sensor 50, i.e., in normal operation, it is determined whether the button actuator 32 is removed. It should be noted that the secondary capacitance sensor 50 is not used to determine whether the user presses on the button cap 31. Instead, the signal change is determined when the button actuator 32 is removed or, as described, when the button actuator 32 is directly touched. In these cases, the keyboard controller 43 will stop the capacitance sampling and issue a warning to the POS processor 6 to remove the security data in the POS processor 6 and notify the remote transaction processing server of the obvious tampering, as can be seen in FIG. Figure 7 as seen in the flowchart.

[0059] like Figure 5 As shown, the top PCB layer 34, i.e., the outer area of ​​the secondary capacitive sensor 50, is connected to ground 52. The PCB layer 34 may include a continuous metallization layer or, for example, a "hash-type" metallization layer to further improve the shielding of the primary capacitive sensor 50. A corresponding metallization layer is present on the bottom middle PCB layer 36 for additional shielding.

[0060] Figure 6 There is shown a schematic top view of the bottom PCB layer 37. As discussed previously, layer 37 includes the keyboard controller 43 and includes various connections to PCB layers 34 and 35 and to the POS processor 6 using bus connections 60. Figure 6 Not shown are power and other connections.

[0061] Figure 8 An alternative embodiment of the button actuator 32 is shown, marked with reference numerals 32a and 32b. The arrangement of the button actuator 32b will prevent the flat portion of the actuator from approaching the surface of the PCB 34, resulting in a reduction in field changes when the button actuator is depressed. This arrangement provides further improved eavesdropping protection.

[0062] Benefits of the described embodiments include: a) increased security against eavesdropping through the use of mutual capacitance sensors resulting in relatively small signal changes when a button is pressed by a user, b) an arrangement that is insensitive to environmental conditions, particularly dust, c) improved reliability since no electrical contacts are used to determine whether a button is pressed, d) reduced cost compared to prior art designs using a silver paste mask, and e) the use of a button actuator that acts as a spring to provide tactile feedback to the user.

[0063] Although the present invention has been shown and described in detail in the drawings and the above description, such illustration and description are to be considered illustrative or exemplary rather than restrictive; the present invention is not limited to the disclosed embodiments. For example, it is possible to operate the present invention in one embodiment in which:

[0064] (1) Mutual touch sensors and self-touch sensors are combined to form a secure keypad for POS, resource (electronic or physical) access applications;

[0065] (2) The mutual touch sensor is embedded in the middle PCB layer and arranged under each individual plastic button, and the mutual touch sensor is designed to sample the tiny mutual capacitance changes between the TX line and the RX line;

[0066] (3) When the mutual capacitance sensor is sampled and when the user presses the plastic part of the button, the metal dome button actuator is coupled to GND, which causes deformation of the metal dome, and the deformation of the metal dome will cause the distance between the center part of the metal dome and the PCB surface to change, which in turn causes the mutual capacitance sampled in this embodiment to change;

[0067] (4) The self-touch sensor covers the top of each individual mutual-touch sensor, and the self-touch sensors are divided into several groups;

[0068] (5) The self-touch sensor is not designed to determine which button is pressed by the user, but to monitor whether any keypad is removed or touched by a person;

[0069] (6) The self-touch sensor and the mutual-touch sensor are then sampled, and in normal operation, when the user presses the top of the plastic part of the button, the self-touch sensor will not cause the self-touch signal to change;

[0070] (7) When the self-touch sensor detects a signal change (i.e., a touch or anti-touch signal), the touch controller will stop the mutual touch sampling timing and send a warning to the main controller to remove the security data in the POS; and / or

[0071] (8) The self-touch sensor plate contacts the metal dome to couple to GND during self-sampling and / or during mutual sampling to form a self-touch sensor.

[0072] In practicing the claimed invention, those skilled in the art will be able to understand and effect other variations to the disclosed embodiments by studying the drawings, the present disclosure and the appended claims. In the claims, the word "comprising" does not exclude other elements or steps, and the indefinite article "a" or "an" does not exclude a plurality. A single processor, module or other unit may perform the functions of several items recited in the claims.

[0073] The mere fact that certain measures are cited in mutually different dependent claims does not indicate that a combination of these measures cannot be used to advantage. The computer program may be stored / distributed on a suitable medium, such as an optical storage medium or a solid-state medium provided together with or as part of other hardware, but may also be distributed in other forms, such as via the Internet or other wired or wireless telecommunication systems. Any reference signs in the claims should not be considered as limiting the scope.

Claims

1. A keyboard for secure data entry, comprising at least one or more of the data entry buttons, the one or more of the data entry buttons being depressible by a user; as well as a button actuator for each of the data entry buttons, the button actuator being movable upon depression of the corresponding data entry button by the user; and a primary capacitive sensor arranged to determine movement of the button actuator of the corresponding data input button by capacitance sampling; in The button actuator is at least partially made of a conductive material; and The button actuator is coupled to a defined potential at least during the capacitance sampling period to shield the primary capacitance sensor from eavesdropping.

2. The keyboard of claim 1, wherein the primary capacitance sensor is a mutual capacitance sensor.

3. A keyboard according to any preceding claim, further comprising a shield removal detection circuit to determine tampering with one or more of the button actuators.

4. The keyboard of claim 3, wherein the shield removal detection circuit is configured to erase data and / or suspend operation of the keyboard when tampering with one or more of the button actuators is determined.

5. The keyboard of claim 3, wherein the shield removal detection circuit comprises a sub-capacitive sensor for each of the data entry buttons.

6. The keyboard of claim 5, wherein the secondary capacitance sensor is disposed between the button actuator and the primary capacitance sensor.

7. The keyboard according to one of the claims 5, wherein the sub-capacitive sensor is a self-capacitive sensor.

8. The keyboard of claim 5, further comprising at least one printed circuit board including one or more of the primary capacitive sensor and the secondary capacitive sensor.

9. The keyboard of claim 8, wherein the primary capacitive sensor is disposed in a middle layer of the printed circuit board.

10. The keyboard of any one of claims 1-2, wherein the button actuator is dome-shaped.

11. The keyboard of any one of claims 1-2, wherein the button actuator is made of metal.

12. A keyboard according to any one of claims 1-2, comprising a plurality of data input buttons arranged in a matrix.

13. The keyboard of claim 12, wherein the plurality of data entry buttons are arranged to form a numeric keypad.

14. The keyboard of any one of claims 1-2, further comprising a keyboard controller configured to at least control the capacitance sampling of the primary capacitance sensor and couple the button actuator to the defined potential at least during the capacitance sampling.

15. A keyboard according to any one of claims 1-2, wherein the defined potential is grounded.

16. A point of sale device comprising at least Point of sale transaction processors; one or more of the data entry buttons, the one or more of the data entry buttons being depressible by a user; as well as a button actuator for each of the data entry buttons, the button actuator being movable upon depression of the corresponding data entry button by the user; and a primary capacitive sensor arranged to determine movement of the button actuator of the corresponding data input button by capacitance sampling; in The button actuator is at least partially made of a conductive material; and The button actuator is coupled to a defined potential at least during the capacitance sampling period to shield the primary capacitance sensor from eavesdropping.

17. A method of secure data entry using a keyboard having one or more of data entry buttons, one or more of the data entry buttons being depressible by a user; and a button actuator for each of said data input buttons, said button actuator being movable upon said user depressing a corresponding data input button and being made at least in part of a conductive material; and the primary capacitive sensor; in The method comprises sampling the primary capacitive sensor to determine movement of the button actuator; as well as The button actuator is coupled to a defined potential to shield the primary capacitive sensor from eavesdropping, at least during the sampling period.

18. The method of claim 17, wherein the keyboard is configured according to any one of claims 1 to 15.

Images