Value document processing device and method for operating value document processing device

Abstract

A value document processing apparatus and a method for operating a value document processing apparatus. According to various embodiments, a value document processing device may include a secure chamber configured to accommodate one or more value documents and protect at least one processing device from unauthorized access; at least one processing device arranged within the secure chamber to process at least an output of the one or more value documents from the secure chamber; a control circuit coupled to the at least one processing device to control operation of the at least one processing device; and a safety circuit disposed within the safety chamber. The safety circuit is configured to receive the cryptographic processing signal, verify the received cryptographic processing signal, and disable or enable operation of the at least one processing device based on the verification result.

Description

Technical Field

[0001] Various embodiments generally relate to a document of value processing device and a method for operating a document of value processing device. Background Art

[0002] Typically, a safe can be used to protect any type of payment means, such as banknotes, coins, gold bullion inbars, and the like, in a private location, such as in a bank or in another building, or in a public location, such as at the outer wall of a bank or another building for public access. An automated teller machine (ATM) or another automatic security arrangement can be equipped with various functions as required, such as for depositing cash, dispensing cash, and / or recycling cash. An ATM typically includes a safe to mechanically protect the cash stored therein. However, since the ATM includes an electronic module for operating the ATM, software or electronic protection may also be necessary. Typically, communication between an ATM and at least one financial institution may be necessary for cash deposits and / or money distribution from the ATM via the ATM. For security reasons for communication between an ATM and a financial institution (referred to as a bank), encrypted communication may be provided. Access to a bank account may be protected by a system including a bank card (e.g., a so-called cash card or ATM card) and a corresponding PIN verification or another suitable verification. The personal verification process may include a request from the bank for personal verification information (eg, PIN) for the respective user of the ATM. Optionally, the bank card may include a cryptographic key also referred to as a personal key (PK) for the personal identification process and / or for the authentication process. Summary of the invention

[0003] According to various embodiments, the value document processing device may include: a secured chamber configured to accommodate one or more value documents and protect at least one processing device from unauthorized access; at least one processing device disposed in the secured chamber to at least process output of the one or more value documents from the secured chamber; a control circuit coupled to the at least one processing device to control the operation of the at least one processing device; and a security circuit disposed in the secured chamber. The security circuit is configured to receive a cryptographic processing signal, verify the received cryptographic processing signal, and disable or enable the operation of the at least one processing device based on the verification result. BRIEF DESCRIPTION OF THE DRAWINGS

[0004] In the drawings, like reference characters generally refer to the same parts throughout the different views. The drawings are not necessarily to scale, instead emphasis is generally placed on illustrating the principles of the invention. In the following description, various embodiments of the invention are described with reference to the following drawings, in which:

[0005] Figure 1 shows a processing device in a schematic view according to various embodiments;

[0006] Figure 2 shows a processing device in a schematic view according to various embodiments;

[0007] Figure 3 shows a processing device in a schematic view according to various embodiments;

[0008] Figure 4 A schematic flow chart of a method for operating a processing device according to various embodiments is shown;

[0009] Figure 5 A schematic flow chart showing a method for operating a processing device according to various embodiments; and

[0010] Figure 6 A processing device in a schematic view according to various embodiments is shown. DETAILED DESCRIPTION

[0011] The following specific embodiments refer to the accompanying drawings, which illustrate the specific details and embodiments in which the present invention can be implemented by way of illustration. These embodiments are described in sufficient detail to enable those skilled in the art to implement the present invention. Other embodiments may be utilized, and structural, logical, and electrical changes may be made without departing from the scope of the present invention. Various embodiments are not necessarily mutually exclusive, as some embodiments may be combined with one or more other embodiments to form new embodiments. Various embodiments are described in conjunction with methods, and various embodiments are described in conjunction with devices. However, it is understood that the embodiments described in conjunction with methods may be similarly applied to devices, and vice versa.

[0012] The terms "at least one" and "one or more" may be understood to include any integer greater than or equal to one, i.e., one, two, three, four, […], etc. The term "plurality" may be understood to include any integer greater than or equal to two, i.e., two, three, four, five, […], etc.

[0013] The phrase "at least one of" with respect to a group of elements (e.g., at least one of A and B, or, in the same manner, at least one of A or B) may be used herein to mean at least one element from the group of elements, i.e., a logical and / or. For example, the phrase "at least one of" with respect to a group of elements may be used herein to mean a selection of: one of the listed elements, one of a plurality of the listed elements, a plurality of individually listed elements, or a plurality of several listed elements.

[0014] The term "coupled" is used herein to mean, for example, communicatively coupled, which may include any type of direct or indirect connection. The connection may include any suitable wired and / or wireless connection.

[0015] As used in this article, "circuit" is understood to be any kind of logical implementation entity, which may include dedicated hardware or processors that execute software. The circuit can therefore be an analog circuit, a digital circuit, a mixed signal circuit, a logic circuit, a processor, a microprocessor, a central processing unit (CPU), a graphics processing unit (GPU), a digital processor (DSP), a field programmable gate array (FPGA), an integrated circuit, an application-specific integrated circuit (ASIC), etc. or any combination thereof. Any other kind of implementation of the corresponding function, which will be described in further detail below, may also be understood as a "circuit". It is to be understood that any two (or more) of the circuits detailed in this article may be implemented as a single circuit with substantially equivalent functions, and conversely, any single circuit detailed in this article may be implemented as two (or more) separate circuits with substantially equivalent functions. In addition, references to "circuit" may refer to two or more circuits that form a single circuit together. The term "circuit arrangement" may refer to a single circuit, a collection of circuits, and / or an electronic device consisting of one or more circuits.

[0016] As used herein, "processing circuitry" (or equivalently "processing circuitry" or "processor") is understood to refer to any circuit that performs (one or more) operations on (one or more) signals, such as, for example, any circuit that performs processing on an electrical or optical signal. A processing circuit may therefore refer to any analog or digital circuitry that alters the characteristics or properties of an electrical or optical signal, which may include analog and / or digital data. A processing circuit may therefore refer to an analog circuit (explicitly referred to as an "analog processing circuitry"), a digital circuit (explicitly referred to as a "digital processing circuitry"), a logic circuit, a processor, a microprocessor, a central processing unit (CPU), a graphics processing unit (GPU), a digital signal processor (DSP), a field programmable gate array (FPGA), an integrated circuit, an application specific integrated circuit (ASIC), etc. or any combination thereof. A processing circuit may therefore refer to a circuit that performs processing on an electrical or optical signal, either as hardware or as software, such as software executed on hardware (e.g., a processor or microprocessor). As used herein, "digital processing circuitry (circuitry)" may refer to circuitry implemented using digital logic that performs processing on signals, such as electrical or optical signals, which may include (one or more) logic circuits, (one or more) processors, (one or more) scalar processors, (one or more) vector processors, (one or more) microprocessors, (one or more) controllers, (one or more) microcontrollers, (one or more) central processing units (CPUs), (one or more) graphics processing units (GPUs), (one or more) digital signal processors (DSPs), (one or more) field programmable gate arrays (FPGAs), (one or more) integrated circuits, (one or more) application specific integrated circuits (ASICs), or any combination thereof. In addition, it is understood that a single processing circuit may be equivalently divided into two separate processing circuits, and conversely, two separate processing circuits may be combined into a single equivalent processing circuit.

[0017] In recent years, many ATM vendors have hardened their ATMs to prevent offline attacks aimed at obtaining banknotes from the ATM. These hardening aspects may include encryption of the communication line between the ATM's dispenser / recycler and the ATM processing system, such as to the ATM microcomputer. However, in some cases, it may be difficult to harden the firmware of the ATM's dispenser / recycler.

[0018] Similar to an ATM, other devices may be used to process any desired object and protect any desired object from access by unauthorized persons. In this case, the one or more objects to be protected may be stored in a safe room (also referred to herein as a safe), wherein at least one processing device may be used to transport the one or more objects to be protected from the safe room without opening the safe room, for example, without opening the door of the safe room. At least one processing device may be used to provide access to the one or more objects to be protected (e.g., for one or more authorized users of the device) without providing physical access to the interior of the safe room. According to various embodiments, at least one processing device may be protected against unauthorized operations to prevent unauthorized transportation of the one or more objects to be protected from the safe room.

[0019] Figure 1 A processing device 100 (also referred to as a value document processing device) in a schematic view according to various embodiments is illustrated. The processing device 100 may be or may include an automated teller machine (ATM), or in other words, a cash dispensing machine, a cash recycling machine, or any other processing device 100 for processing objects and protecting objects from unauthorized access. The processing device 100 may include a safe room 102, which is configured to accommodate one or more value documents (104m) and protect at least one processing device 104 from unauthorized access. At least one processing device 104 is arranged in the safe room 102. The safe room 102 may include any suitable housing for protecting the interior 102i of the safe room 102 from unauthorized physical access. Authorized physical access to the interior 102i of the safe room 102 may be possible by providing a door in the housing, wherein the door mechanism for opening and closing the door may include one or more locking mechanisms (also referred to herein as locks). The safe room 102 including the lock of the door may be configured to prevent unauthorized access to the interior 102i of the safe room 102.

[0020] According to various embodiments, at least one processing device 104 may be configured to process (e.g., input and / or output, see reference numeral 105) one or more value documents 104m or any other value documents 104m. One or more value documents 104m may include any suitable object such as, for example, banknotes, bars, coins, and the like. The safe room 102 may also be referred to as a safe 102 and the at least one processing device 104 may also be referred to as a safe unit. According to various embodiments, the processing device 104 may be configured as a cash dispenser and / or a cash recycling machine. At least one processing device 104 may be used to store one or more value documents 104m in the safe room 102 and also to distribute one or more value documents 104m stored in the safe room 102. According to various embodiments, at least one processing device 104 may be or may include any suitable device for transporting objects stored in the safe room 102 from the safe room 102. In addition, at least one processing device 104 may be or may include any suitable device for transporting objects to be stored in the safe room 102 to the safe room 102.

[0021] According to various embodiments, the processing device 100 may further include a control circuit 106 (also referred to as a controller) to control the operation of the at least one processing device 104. The control circuit 106 may be arranged outside 102o of the secure room 102. The control circuit 106 may be coupled to the at least one processing device 104 to control the operation of the at least one processing device 104. The control circuit 106 may control, for example, the dispensing and depositing of one or more value documents 104m, such as transporting banknotes or other objects from the secure room 102, and, for example, transporting banknotes or other objects into the secure room 102. The control circuit 106 and the at least one processing device 104 may also be configured to recycle one or more value documents 104m, such as checking the status of banknotes and withdrawing banknotes from circulation if necessary.

[0022] According to various embodiments, the control circuit 106 may be configured to operate based on firmware adapted for the at least one processing device 104 to be controlled. The firmware may, for example, not allow establishing encrypted communications between the control circuit 106 and the at least one processing device 104.

[0023] According to various embodiments, the processing device 100 may further include a security circuit 108, which is arranged in the security room 102. The security circuit 108 may be configured to receive the cryptographic processing signal 110e, verify the received cryptographic processing signal, and configure 108r the operation of at least one processing device 104 based on the verification. The term "configure" used herein with respect to "configuring" an operation, communication, or signal may be understood, for example, as "modifying", such as disabling or enabling an operation, such as disabling or enabling a communication, such as suppressing a signal or forwarding a signal; such as outputting a signal or not outputting a signal. Illustratively, the security circuit 108 may be configured to disable the operation of at least one processing device 104 to prevent unauthorized operation of at least one processing device 104m, and enable the operation of at least one processing device 104 to allow authorized operation of at least one processing device 104m.

[0024] In various embodiments, "cryptographic processing" may include any type of cryptographic security mechanism or security service. By way of example, "cryptographic processing" may include encryption / decryption (symmetric and / or asymmetric), digital signatures, digital watermarks, digital hashing, and the like.

[0025] Verification of the cryptographically processed signal 110e may be performed by any suitable verification process, such as using encryption and decryption of data and / or using messages that include signatures, and the like.

[0026] In the case where the secure room 102 can be disconnected from the environment in the processing device 100, the presence of the security circuit 108 and its operation can prevent easy electronic access to the at least one processing device 104 to distribute one or more value documents 104m stored in the secure room 102. For example, in the case where the security circuit 108 does not receive the cryptographic processing signal 110e or only receives a corrupted cryptographic processing signal 110e (which can be detected by decrypting the cryptographic processing signal 110e and checking the decrypted signal or by checking the signature), the operation of the at least one processing device 104 can be disabled to prevent any output via the at least one processing device 104. In other words, the at least one processing device 104 can only operate if the security circuit 108 correctly receives and correctly verifies the cryptographic processing signal 110e provided to the security circuit 108.

[0027] According to various embodiments, the security circuit 108 may be configured to determine the state of the cryptographic processing signal and disable or enable the operation of at least one processing device based on the determined state. The state of the cryptographic processing signal indicates, for example, whether the cryptographic processing signal is correctly decrypted by the security circuit 108. In order to correctly decrypt the cryptographic processing signal 110e, both the decryption itself and the decrypted data (or in other words, the decrypted information) can be checked. Correct decryption may require the use of a correct key corresponding to the key used for the encryption of the cryptographic processing signal 110e. According to various embodiments, in order to check the decrypted data, the decrypted data can be compared with reference data. Illustratively, the expected result of the decryption can be known and stored in the security circuit 108 and can be compared with the actual result of the decryption. According to various embodiments, the security circuit 108 can be configured to enable the operation of at least one processing device 104 when the cryptographic processing signal 110e is correctly decrypted (or in other words, verified), and disable the operation of at least one processing device 104 in other cases, that is, when the cryptographic processing signal 110e is not correctly decrypted (or in other words, not verified).

[0028] According to various embodiments, the cryptographic processing signal 110e may be received by the security circuit 108 and the authenticity of the cryptographic processing signal 110e may be checked via the security circuit 108. However, it may be the case that the cryptographic processing signal 110e is not received by the security circuit 108, for example due to manipulation of the processing device 100 or communication between the security circuit 108 and the rest of the processing device 100. Therefore, according to various embodiments, the security circuit 108 may be further configured to determine the state of the cryptographic processing signal 110e and disable or enable the operation of at least one processing device 104 based on the determined state. The security circuit 108 may be configured to disable the operation of at least one processing device 104 if the cryptographic processing signal 110e is not received by the security circuit 108. However, in other cases, if the cryptographic processing signal 110e is received by the security circuit 108, it may be decrypted and / or verified as described above.

[0029] In the following, we can focus on the above Figure 1 The processing device 100 is described to describe various modifications and / or additional features.

[0030] Figure 2A processing device 100 in a schematic view according to various embodiments is illustrated. The processing device 100 may be configured in a similar manner as described above. According to various embodiments, at least one processing device 104 may include an automatic processing arrangement 204t to process a desired object, and a power supply 204p to supply the automatic processing arrangement 204t. According to various embodiments, an external power supply 230 may be connected to the power supply 204p to provide electric power to the power supply 204p.

[0031] According to various embodiments, the automatic handling arrangement 204t may be configured, for example, to transport banknotes (or any other desired objects) into and / or out of the secure chamber 102 controlled by the control circuit 106. Thus, an attack on the control circuit 106 and / or on the electronic components of the automatic handling arrangement 204t may be used to obtain banknotes from the secure chamber 102 without mechanically opening the secure chamber 102. Thus, according to various embodiments, the security circuit 108 may be configured to modify 208a (e.g., enable or disable) the operation of the power supply 204p based on the verification. In other words, the security circuit 108 may protect at least one processing device 104 from unauthorized operation by disabling the power supply 204p of the at least one processing device 104 if necessary, for example, in the event of a detected attack. In this case, an attack on the control circuit 106 and / or on the electronic components of the automatic handling arrangement 204t may disable any operation of the automatic handling arrangement 204t, which enhances the security nature of the secure chamber 102.

[0032] Alternatively or additionally, the security circuit 108 may be configured to modify 208b (e.g., enable or disable) the communication 106c between the control circuit 106 and the at least one processing device 204 (or the automatic processing arrangement 204t) based on the verification. In other words, the security circuit 108 may protect the at least one processing device 104 (or the automatic processing arrangement 204t) from unauthorized operation by disabling the communication between the control circuit 106 and the at least one processing device 104 (or the automatic processing arrangement 204t). In this case, an attack on the electronic components of the control circuit 106 and / or the automatic processing arrangement 204t disables any operation of the automatic processing arrangement 204t, which enhances the security nature of the secure room 102.

[0033] According to various embodiments, the safety circuit 108 may be configured to include additional safety functions, as described in more detail below. The safety circuit 108 may be configured to disable at least one processing device 104 (e.g., disable communication 106c between the control circuit 106 and the at least one processing device 104 and / or disable the power supply of the at least one processing device 104), for example, in the event of a power loss. According to various embodiments, the safety circuit 108 may be configured to operate at an operating voltage (e.g., within a predefined operating voltage range) and check the state of the operating voltage. In addition, the safety circuit 108 may be configured to disable at least one processing device (e.g., disable communication 106c between the control circuit 106 and the at least one processing device 104 and / or disable the power supply of the at least one processing device 104) if the operating voltage meets a predefined operating voltage threshold, for example, drops below a minimum operating voltage threshold and / or rises above a maximum operating voltage threshold. In other words, the safety circuit 108 may be configured to disable at least one processing device 104 if the actual operating voltage of the safety circuit 108 is not within the predefined operating voltage range of the safety circuit 108.

[0034] Furthermore, the cryptographic processing signal 110e may be a substantially continuous signal. Alternatively, the cryptographic processing signal 110e may be provided only at predefined time intervals, such as every minute, every ten minutes, and the like.

[0035] According to various embodiments, the security circuit 108 may be configured to enable operation of the at least one processing device 104 for a predefined time period according to the receipt of the cryptographic processing signal 110e and based on verification. Illustratively, the verified cryptographic processing signal 110e may enable the at least one processing device 104 for a predefined time period, such as one minute, ten minutes, and the like. As a standard operating mode, e.g., in the absence of any attack on the processing device 100, the predefined time period may be selected according to a predefined time interval, at which the cryptographic processing signal 110e is generated and transmitted to the security circuit 108 to allow continuous operation of the at least one processing device 104 and, therefore, the processing device 100. After the predefined time period, the security circuit 108 may disable operation of the at least one processing device 104 as long as no further cryptographic processing signal 110e is received and verified, as described above.

[0036] Figure 3A processing device 100 in a schematic view according to various embodiments is illustrated. The processing device 100 may be configured in a similar manner as described above. According to various embodiments, the processing device 100 may include a peripheral circuit 110 configured to generate a cryptographic processing signal 110e and transmit the cryptographic processing signal 110e to the security circuit 108. Illustratively, the peripheral circuit 110 may communicate with the security circuit 108 in an encrypted manner. As described above, the peripheral circuit 110 may be configured to generate the cryptographic processing signal 110e in predefined time intervals or alternatively continuously.

[0037] According to various embodiments, the peripheral circuit 110 may be configured to generate the cryptographic processing signal 110 e based on a sequence of datagrams, wherein the datagrams of the sequence of datagrams are different from each other. Illustratively, the cryptographic content of the cryptographic processing signal 110 e may vary (e.g., based on a timestamp, a consecutive number, etc.) to avoid a simple signal repetition attack, wherein an attacker may provide a copy of the cryptographic processing signal 110 e to the security circuit 108 to enable operation of the at least one processing device 104 without authorization.

[0038] According to various embodiments, verifying the cryptographically processed signal 110e may include decrypting one or more encrypted datagrams. The security circuit 108 may be configured to compare the one or more decrypted datagrams with corresponding one or more reference datagrams and configure the operation of the at least one processing device 104 based on the result of the comparison. Illustratively, the one or more datagrams may be used to check whether the encryption, transmission, and decryption of the signal are correctly completed to allow the operation of the at least one processing device 104 only in this case.

[0039] According to various embodiments, the security circuit 108 may be configured to permanently store a key for decrypting a cryptographic signal. In other words, the security circuit 108 may include a memory circuit for permanently storing the key. Permanent storage may be understood in such a way that a power loss or any other deactivation of the security circuit 108 may not result in the loss of the key.

[0040] According to various embodiments, the security circuit 108 may be configured to perform an initialization process for exchanging a public key with the peripheral circuit 110 for encrypted communication. Illustratively, the encrypted communication between the peripheral circuit 110 and the security circuit 108 may be initialized at an initial stage. The security circuit 108 and the peripheral circuit 110 may be configured to perform the initialization process based on asynchronous encrypted communication (e.g., using Rivest, ShamirundAdleman (RSA) encryption) or based on any other suitable initialization process.

[0041] As in Figure 3As illustrated in FIG. 1 , according to various embodiments, the processing device 100 may include a hardware protection switch 308 configured to allow the start of the initialization process only if the hardware protection switch 308 is activated. The hardware protection switch 308 may be disposed within the secure room 102. Alternatively, the hardware protection switch 308 may be integrated into a door lock of the secure room 102. Illustratively, the hardware protection switch 308 may only be manually activated if the secure room 102 is opened. Thus, a software or electronic attack on the processing device 100 may first require a mechanical attack; wherein after a possible unauthorized opening of the secure room 102, further software or electronic attacks would be moot.

[0042] Figure 4 A method 400 for operating a processing device 100 (e.g., a method for operating an automated teller machine (ATM)) is illustrated in a schematic flow chart according to various embodiments. The method 400 may be configured in a similar manner as described above with reference to the processing device 100. Vice versa, the processing device 100 may be configured in a similar manner as described below with reference to the method 400.

[0043] According to various embodiments, the method 400 may include: in 410, controlling at least one processing device 104 for processing one or more value documents, wherein the at least one processing device 104 is arranged in a security room 102 to protect the at least one processing device 104 from unauthorized access; in 420, transmitting a cryptographic processing signal 110e generated by a peripheral circuit 110 arranged outside the security room 102 to a security circuit 108 arranged in the security room 102; and, when the cryptographic processing signal 110e is received by the security circuit 108, in 430, verifying the received cryptographic processing signal 110e; and, in 440, configuring the operation of the at least one processing device 104 based on the verification result.

[0044] According to various embodiments, method 400 may alternatively include: in 410, controlling (e.g., via a control circuit) at least one processing device for processing an object to be protected, wherein the at least one processing device is arranged in a safe to protect the at least one processing device from unauthorized access; in 420, transmitting a cryptographic processing signal generated by a peripheral circuit arranged outside the safe to a security circuit arranged in the safe; in 430, verifying the cryptographic processing signal via the security circuit; and in 440, configuring (e.g., enabling or disabling) the operation of the at least one processing device based on the verification.

[0045] Figure 5A method 400 for operating a processing device 100 (e.g., a method for operating an automated teller machine (ATM)) is illustrated in a schematic flow chart according to various embodiments. The method 400 may be configured in a similar manner as described above. According to various embodiments, the method 400 may include: in 410, 420, controlling at least one processing device 104 for processing one or more value documents, wherein the at least one processing device 104 is arranged in a security room 102 to protect the at least one processing device 104 from unauthorized access; in 420, transmitting a cryptographic processing signal 110e generated by a peripheral circuit 110 arranged outside the security room 102 to a security circuit 108 arranged in the security room 102; in 510, operating the security circuit 108 based on the state of the cryptographic processing signal 110e, for example, in 530, In the case where the cryptographic processing signal 110e is not received by the security circuit 108 (without loss of generality: state 1), the operation of at least one processing device 104 is disabled; in 430, when the cryptographic processing signal 110e is received by the security circuit 108, the cryptographic processing signal 110e is verified via the security circuit 108; and, in 550, when the cryptographic processing signal 110e is not verified (without loss of generality: state 2), the operation of at least one processing device 104 is disabled, or in 560, when the cryptographic processing signal 110e is verified (without loss of generality: state 3), the operation of at least one processing device 104 is enabled.

[0046] As described above, the operation of the at least one processing device 104 may be disabled or enabled based on the state of the cryptographic processing signal 110e. Determining the state of the cryptographic processing signal 110e may include, for example, checking whether the cryptographic processing signal 110e is verified in 540. In 560, the operation of the at least one processing device 104 may be enabled in case the cryptographic processing signal is verified, and in 550, the operation of the at least one processing device 104 may be disabled in case the cryptographic processing signal 110e is not verified. This may be the case, for example, when a manipulated signal (e.g., a signal encrypted with an incorrect key, or a signal having manipulated content) is used instead of the correct cryptographic processing signal 110e provided by the peripheral circuit 110.

[0047] As described above, the operation of the at least one processing device 104 may be further disabled based on the state of the cryptographic processing signal 110e. Determining the state of the cryptographic processing signal 110e may include, for example, in 520, checking whether the cryptographic processing signal 110e is correctly received by the security circuit 108. In 530, the operation of the at least one processing device 104 may be disabled in the event that the cryptographic processing signal 110e is not correctly received, such as may be the case, for example, when the communication between the peripheral circuit 110 and the security circuit 108 is disturbed or, for example, when the security circuit 108 and / or the peripheral circuit 110 is attacked.

[0048] Figure 6 A cash dispenser / recycler 600 (or in other words an ATM having dispenser and / or recycler functionality) in a schematic view according to various embodiments is illustrated. The cash dispenser / recycler 600 may be configured in a similar manner as described above with reference to the processing device 100 and the method 400, and vice versa.

[0049] According to various embodiments, the cash dispenser / recycler 600 may include a secure chamber 102 referred to as a safe 102, a control circuit 106, a security circuit 108, a peripheral circuit 110 (also referred to as a system PC) in a similar manner as described above.

[0050] According to various embodiments, the cash dispenser / recycler 600 may include a dispenser / recycler arrangement 604 for recycling banknotes. According to various embodiments, the dispenser / recycler arrangement 604 may include an upper unit 604u arranged outside the safe 102. The upper unit 604u may be coupled to a banknote reader 640. The dispenser / recycler arrangement 604 may further include a security unit 604s arranged within the safe 102. The operation of the security unit 604s may be similar to the operation of at least one processing device 104 or the automatic processing arrangement 204t, as described above. The security unit 604s may be coupled to a power supply 604p. The security circuit 108 may be configured to configure (e.g., enable or disable) the operation of the security unit 604s similarly to the configuration of the operation of at least one processing device 104 or the automatic processing arrangement 204t, as described above.

[0051] According to various embodiments, the cash dispenser / recycler 600 may include a power distributor 630 (also referred to as a power distributor circuit) arranged outside the safe 102. The power distributor 630 may be coupled 630a (e.g., electrically connected) to a power supply 604p of the dispenser / recycler arrangement 604. The power distributor 630 may be further coupled 630b to the peripheral circuit 110 and the control circuit 106. The peripheral circuit 110 and the control circuit 106 may be provided as a microcomputer 616 (also referred to as a system PC) or any other suitable circuit arrangement. The upper unit 604u of the dispenser / recycler arrangement 604 may be supplied with power via a power connection 630c to the security unit 604s. Therefore, as described herein, disabling the power of the security unit 604s via the security circuit 108 may also include disabling the power supply of the upper unit 604u. Illustratively, at least one processing device 104 described herein may be configured as a dispenser / recycler arrangement 604 including a first processing unit 604u outside of the safe 102 and a second processing unit within the safe 102 .

[0052] According to various embodiments, the cash dispenser / recycler 600 may include a communication interface 610 (also referred to as a communication interface circuit) disposed outside the safe 102 and configured to receive a cryptographic processing signal 110e from the peripheral circuit 110 and forward the cryptographic processing signal 110e to the security circuit 108. The communication interface 610 may be further configured to receive a control signal 106c from the control circuit 106 and forward the control signal 106c to the dispenser / recycler arrangement 604. The communication interface 610 may be further configured to receive a first additional control signal 606c (e.g., for controlling a banknote reader 640) from the control circuit 106 and forward the first additional control signal 606c to the banknote reader 640. The communication interface 610 may be further configured to receive a second additional control signal 616c (e.g., for controlling an additional circuit 620) from the control circuit 106 and forward the second additional control signal 606c to the additional circuit 620. The additional circuit 620 may be configured to switch off the power distributor 630 or switch off the power supply 630a to the dispenser / recycler arrangement 604 if necessary, for example, as controlled by the control circuit 106 .

[0053] According to various embodiments, the communication 106c, 606c, 616c between the control circuit 106 and the banknote reader 640, between the control circuit 106 and the dispenser / recycler arrangement 604, and between the control circuit 106 and the additional circuit 620 may be configured as wired (e.g., unencrypted) communication, e.g., via a USB (Universal Serial Bus). The communication interface 610 may include or may be a USB hub.

[0054] According to various embodiments, the communication 610 e between the peripheral circuit 110 and the security circuit 108 may be configured as a wired encrypted communication, for example via a USB (Universal Serial Bus).

[0055] According to various embodiments, communication 620c between the additional circuit 620 and the power distributor 630 may be configured as any type of suitable communication (eg, wired communication).

[0056] According to various embodiments, the communication 640c between the banknote reader 640 and the upper unit 604u of the dispenser / recycler arrangement 604 and the communication 640d between the upper unit 604u of the dispenser / recycler arrangement 604 and the security unit 604s of the dispenser / recycler arrangement 604 can be configured as any type of suitable communication (e.g., wired communication).

[0057] According to various embodiments, the safety circuit 108 may be configured to disable power support to the power supply 604p (e.g., disconnect the power connection 630a between the power distributor 630 and the power supply 604p) to disable operation of the dispenser / recycler arrangement 604. According to various embodiments, the safety circuit 108 may be configured to disable communication 640d between the safety unit 604s and the upper unit 604u of the dispenser / recycler arrangement 604 (e.g., disconnect the communication line 640d) to disable operation of the dispenser / recycler arrangement 604.

[0058] As explained above, the cash dispenser / recycler 600 may include additional electronics located in the safe 102, namely the security circuit 108, which is communicating with the system PC 616, namely the peripheral circuit 110 in a secure manner (e.g., using a standard encryption algorithm). This security circuit 108 may be part of an encryption box 608 that may be placed in the safe 102 of the cash dispenser / recycler 600, for example also as an upgrade kit for an already working cash dispenser / recycler 600. The security circuit 108 is configured to have the ability to cut off power to the security unit 604s of the cash dispenser / recycler 600 and thus prevent any movement of banknotes in the event of a detected attack.

[0059] The encryption box 608 and thus the security circuit 108 are placed in the safe 102 so that they cannot be manipulated by an attacker who does not have physical access to the interior 102i of the safe 102. A power switch 608s can be used, which is controlled by the encryption box 608 (i.e., the security circuit 108). The power switch 608s can be configured to allow the power line 630a to be cut, for example, in the event that the encryption box 608 is not supplied with power. Instead of cutting the power line 630a to the security unit 604s or in addition to cutting the power line 630a to the security unit 604s, the encryption box 608 can also be configured to allow the communication line 640d to the security unit 604s to be cut, so that the security unit 604s does not receive any command from the control circuit to transport banknotes from the safe 102.

[0060] In the initialization phase (i.e., during the initialization process described herein), the system PC 616 and the encryption box 608 are exchanging keys by means of asymmetric encryption such as, for example, via RSA. The keys exchanged may be referred to as base keys or public keys. According to various embodiments, the base key may be a 256-bit AES key. All other security-related communications between the system PC 616 and the encryption box 608 may be protected via the base key.

[0061] The basic key can be permanently stored in the encryption box 608 so that it survives when the power is removed. The system PC 616 and the encryption box 608 can exchange the basic key with another basic key based on timing or other measurements. The basic key of generation x can be simply encrypted and transmitted with the basic key of generation x-1. According to various embodiments, instead of only a single basic key, a key hierarchy can be used. This allows, for example, to use session keys more easily. The initial exchange of the basic key can require additional hardware authentication (for example, provided by the hardware protection switch 308, as described above) that guarantees that it is allowed. According to various embodiments, hardware authentication can be based on opening the safe door. The safe door can be opened by using door contact or by switching the contact on the encryption box 608. The hardware authentication process can be triggered by system PC commands / actions such as TSOP functions or any other desired service programs or by switching the contact on the encryption box 608 or by opening / closing the safe door (assuming there is wired contact).

[0062] According to various embodiments, the algorithm of the encryption box 608 (or in other words, the algorithm of the security circuit 108) may include listening for lease packets from the system PC 616 (or in other words, from the peripheral circuit 110). The lease packet may be a datagram encrypted with the base key. Alternatively, the datagram packet may be signed with the base key alone. If the encryption box 608 receives the data packet and confirms its authenticity (e.g., by being able to decrypt it), it activates power to the security unit 604s for a specific period of time T. a Time period T a The minimum time that may be taken to access the communication line 640d of the security unit 604s and to be able to transport the banknote from the safe 102 may be less than the minimum time that may be taken to access the communication line 640d of the security unit 604s and to be able to transport the banknote from the safe 102. a It may be, for example, one minute or less or more than one minute. If the next lease packet is not received and correctly decrypted within that time, the power to the security unit 604s is cut off. According to various embodiments, it may be the responsibility of the system PC 616 to feed the encryption box 608 with correct datagrams continuously or at least at predefined intervals. The datagrams may include means to prevent simple message replays such as counters or random numbers, as described above.

[0063] According to various embodiments, during standard operation of the system PC 616 (or in other words, the peripheral circuit 110), software can be used to continuously monitor the attached encryption box 608 and generate lease packets within a defined time frame. The software can also continuously check whether an initialization process is requested.

[0064] According to various embodiments, in the event that the presence of a cryptographic box 608 (or, in other words, the security circuit 108) is mandatory according to the system configuration but the cryptographic box 608 cannot be detected (for example, it is not enumerated on any USB bus) or the cryptographic box 608 is operating in an unexpected manner, at least one of the following actions may be taken: an alarm event may be generated and recorded and / or normal operation of the security unit 604s (for example, dispensing banknotes) may be suspended.

[0065] According to various embodiments, in the event that the system PC 616 detects that the security unit 604s is disconnected or is operating in an abnormal manner that may be part of an attack, the system PC 616 can shut down the security unit 604s by using additional circuits 620 and power distributor 630 and / or by issuing a special command to the encryption box 608.

[0066] According to various embodiments, the encryption box 608 (or, in other words, the security circuit 108) can include a real-time clock and permanent storage for logging information. The encryption box 608 can log relevant events such as expired leases or key initializations or changes. These events contain real-time clock timestamps. The log can be read in a secure manner via the communication interface 610 and or directly tapped from the encryption box 608.

[0067] Hereinafter, various examples are provided with reference to the drawings and embodiments described above.

[0068] Example 1 is a processing device 100 (also referred to as a value document processing device), comprising: a secure room 102, which is configured to accommodate one or more value documents 104m and protect at least one processing device 104 from unauthorized access; at least one processing device 104, which is arranged in the secure room 102 to at least process the output of one or more value documents 104m from the secure room 102; a control circuit 106, which is coupled to the at least one processing device 104 to control the operation of the at least one processing device 104; and a security circuit 108, which is arranged in the secure room 102, wherein the security circuit 108 is configured to receive a cryptographic processing signal 110e, verify the received cryptographic processing signal 110e, and disable or enable the operation of at least one processing device 104 based on the verification result.

[0069] According to various embodiments, the value document mentioned herein may be any desired object to be protected, such as a means of payment (such as, for example, banknotes), bars, coins, bank cards, smart cards, and the like. According to various embodiments, disabling the operation of at least one processing device 104 as mentioned herein may be understood as preventing unauthorized operation of at least one processing device 104 to prevent unauthorized output from the secure room 102 by one or more value documents 104m of at least one processing device 104, for example, in the case of an attack on the processing device 100. According to various embodiments, enabling the operation of at least one processing device 104 as mentioned herein may be understood as allowing authorized operation of at least one processing device 104 to provide, for example, authorized output from the secure room 102 by one or more value documents 104m of at least one processing device 104 in the case of standard operation of the processing device 100 based on a request of an authorized user. According to various embodiments, the secure room 102 as mentioned herein may include a housing configured to prevent unauthorized access to the interior of the housing and allow authorized access to the interior of the housing, for example, via a door in the housing that may be locked via a door lock. According to various embodiments, the secure room 102 may be or may include a safe. At least one processing device 104 may be or may include a so-called security unit. According to various embodiments, the control circuit 106 may be a controller or may be part of a controller. According to various embodiments, the security circuit 108 may be a security controller or may be part of a security controller. According to various embodiments, the cryptographically processed signal 110e may include any type of encryption and / or cryptographic signature (and the like) suitable for verifying the authenticity of the signal transmitted to the security circuit 108.

[0070] In Example 2, the processing device 100 of Example 1 may optionally include a security circuit 108 configured to enable the operation of at least one processing device 104 when the cryptographic processing signal 110e is verified. In addition, the security circuit 108 is configured to disable the operation of at least one processing device 104 when the cryptographic processing signal 110e is not verified. In other words, the security circuit 108 is configured to enable the operation of at least one processing device 104 only when the cryptographic processing signal 110e is verified.

[0071] In Example 3, the processing device 100 of Example 1 or 2 may optionally include that the security circuit 108 is further configured to disable operation of the at least one processing device 104 when the cryptographic processing signal 110 e is not received at the security circuit 108 .

[0072] In Example 4, the processing device 100 of any one of Examples 1 to 3 may optionally include that the at least one processing device 104 is further configured to process input of the one or more value documents 104m into the secure room 102. According to various embodiments, the at least one processing device 104 may also be configured to store the one or more value documents 104m in the secure room 102.

[0073] In Example 5, the processing device 100 of any one of Examples 1 to 4 may optionally include at least one processing device 104 including an automated processing arrangement 204t to process one or more value documents 104m, and a power source 204p to power the automated processing arrangement.

[0074] In Example 6, the processing device 100 of Example 5 may optionally include the security circuit 108 being configured to enable or disable operation of the power source 204 p based on the verification result.

[0075] In Example 7, the processing device 100 of any one of Examples 1 to 6 may optionally include the security circuit 108 configured to enable operation of at least one processing device 104 for a predefined period of time according to receipt of the cryptographic processing signal 110 e and based on the verification result.

[0076] In Example 8, the processing device 100 of any one of Examples 1 to 7 may optionally include that the safety circuit 108 is configured to operate at an operating voltage and disable at least one processing device 104 when the operating voltage satisfies a predefined operating voltage threshold.

[0077] In Example 9, the processing device 100 of any one of Examples 1 to 8 may optionally include that the security circuit 108 is configured to enable or disable communication between the control circuit 106 and the at least one processing device 104 based on the verification result.

[0078] In Example 10, the processing device 100 of any one of Examples 1 to 9 may optionally include the security circuit 108 configured to perform an initialization process for exchanging a public key with the peripheral circuit 110 for cryptographically processing the signal and for verifying the cryptographically processed signal 110 e.

[0079] In Example 11, the processing device 100 of Example 10 may optionally include that the security circuit 108 is configured to permanently store the public key.

[0080] In Example 12, the processing device 100 of Example 10 or 11 may optionally include that the security circuit 108 is configured to perform an initialization process based on asynchronous encrypted communication with the peripheral circuit 110 .

[0081] In Example 13, the processing device 100 of any one of Examples 10 to 12 may optionally further include a hardware protection switch 308 configured to allow the start of the initialization process only when the hardware protection switch 308 is activated.

[0082] In Example 14, the processing device 100 of Example 13 may optionally include that the hardware protection switch 308 is disposed within the secure room 102 or the hardware protection switch 308 is integrated into a door lock of the secure room 102 .

[0083] In Example 15, the processing device 100 of any one of Examples 1 to 14 may optionally further include: a peripheral circuit 110 , wherein the peripheral circuit 110 is configured to generate a cryptographic processing signal 110 e and transmit the cryptographic processing signal 110 e to the security circuit 108 .

[0084] In Example 16, the processing device 100 of Example 15 may optionally include that the peripheral circuit 110 is configured to generate a cryptographic processing signal 110 e at predefined time intervals.

[0085] In Example 17, the processing device 100 of Example 15 or 16 may optionally include the peripheral circuit 110 being configured to generate the cryptographic processing signal 110e based on the sequence of datagrams. In addition, the datagrams of the sequence of datagrams may be different from each other. The datagrams may include a real-time stamp or a continuous sequence of numbers.

[0086] In Example 18, the processing device 100 of any one of Examples 1 to 17 may optionally include that the security circuit 108 is further configured to decrypt data of the cryptographic processing signal 110 e and compare the decrypted data with reference data to verify the cryptographic processing signal 110 e .

[0087] Example 19 is a method for operating a value document processing device 100 (e.g., an automated teller machine (ATM)), the method comprising: controlling at least one processing device 104 for processing one or more value documents, wherein the at least one processing device 104 is arranged in a security room 102 to protect the at least one processing device 104 from unauthorized access; transmitting a cryptographic processing signal 110e generated by a peripheral circuit 110 arranged outside the security room 102 to a security circuit 108 arranged in the security room 102; and, when the cryptographic processing signal 110e is received by the security circuit 108, verifying the received cryptographic processing signal 110e; and enabling or disabling the operation of at least one processing device 104 based on the verification result.

[0088] In Example 20, the method of Example 19 may optionally include enabling or disabling the operation of at least one processing device 104 includes enabling the operation of at least one processing device 104 when the password processing signal 110e is verified. In addition, enabling or disabling the operation of at least one processing device 104 includes disabling the operation of at least one processing device 104 when the password processing signal 110e is not verified.

[0089] In Example 21, the method of Example 19 or 20 may optionally further include disabling operation of the at least one processing device 104 when the cryptographic processing signal 110 e is not received at the security circuit 108 .

[0090] In Example 22, the method of any one of Examples 19 to 21 may optionally include controlling at least one processing device 104 to include at least one of: controlling input of one or more value documents into the secure room 102, or controlling output of one or more value documents from the secure room 102.

[0091] In Example 23, the method of any one of Examples 19 to 22 may optionally include that the operation of enabling or disabling the at least one processing device 104 includes enabling or disabling power of the at least one processing device 104 based on the verification result.

[0092] In Example 24, the method of any one of Examples 19 to 23 may optionally include enabling operation of the at least one processing device 104 for a predefined period of time based on receipt of the cryptographic processing signal 110 e at the security circuit 108 and based on the verification result.

[0093] In Example 25, the method of any one of Examples 19 to 24 may optionally include enabling or disabling operation of the at least one processing device 104 includes enabling or disabling communication between the control circuit 106 and the at least one processing device 104 based on the verification result.

[0094] In Example 26, the method of any one of Examples 19 to 25 may optionally further include disabling the at least one processing device 104 when the operating voltage of the safety circuit 108 satisfies a predefined operating voltage threshold.

[0095] In Example 27, the method of any one of Examples 19 to 26 may optionally further include exchanging a public key between the security circuit 108 and the peripheral circuit 110 for cryptographically processing the signal and for verifying the cryptographically processed signal.

[0096] In Example 28, the method of Example 27 may optionally further include permanently storing the public key in the secure circuit 108 .

[0097] In Example 29, the method of Example 27 or 28 may optionally include exchanging the public key including asynchronous encrypted communication between the security circuit 108 and the peripheral circuit 110.

[0098] In Example 30, the method of any one of Examples 27 to 29 may optionally further include activating the hardware protection switch 308 to enable exchange of the public key.

[0099] In Example 31, the method of Example 30 may optionally include activating the hardware protection switch including manually activating the hardware protection switch, wherein the hardware protection switch is disposed within the secure room 102 or wherein the hardware protection switch is integrated into a door lock of the secure room 102.

[0100] In Example 32, the method of any one of Examples 19 to 31 may optionally further include generating a cryptographic processing signal 110e at predefined time intervals, and enabling or disabling the operation of at least one processing device 104 includes enabling the operation of at least one processing device 104 according to the predefined time intervals.

[0101] In Example 33, the method of any one of Examples 19 to 32 may optionally include the cryptographic processing signal 110e including a sequence of datagrams. In addition, the datagrams of the sequence of datagrams may be different from each other. In addition, the sequence of datagrams may be used to verify the cryptographic processing signal 110e.

[0102] In Example 34, a security circuit 108 disposed within a safe of an ATM is used to enable or disable operation of a processing device 104 disposed within the safe as a means of processing payments based on encrypted communications between the security circuit 108 and a peripheral communication circuit outside the safe.

[0103] Example 35 is an automated teller machine ATM, comprising: a safe for protecting at least one security unit from unauthorized access; a security circuit 108 arranged in the safe, wherein the security circuit 108 is configured to receive a password processing signal 110e from a peripheral circuit 110 outside the safe, verify the received password processing signal 110e, and release the operation of at least one security unit based on the verification result. According to various embodiments, the release operation mentioned in this document can be understood as enabling the operation as long as the operation is authorized and disabling the operation otherwise.

[0104] Example 36 is a safe arrangement 100, 600 (e.g., an automated teller machine (ATM)), comprising: a safe room 102, which is used to protect at least one processing device 104 from unauthorized access; at least one processing device 104, which is arranged in the safe to process one or more value documents 104m (e.g., process banknotes, gold, coins, etc.); a control circuit 106, which is (e.g., arranged outside the safe and) coupled to the at least one processing device 104 to control the operation of the at least one processing device 104; and a security circuit 108, which is arranged in the safe room 102, wherein the security circuit 108 is configured to receive a cryptographic processing signal 110e, verify the received cryptographic processing signal 110e, and configure (e.g., disable or enable) the operation of the at least one processing device 104 based on the verification.

[0105] In Example 37, the security arrangement 100, 600 of Example 36 may optionally include at least one processing device 104 configured to allow at least one of the following: inputting a means of payment into the secure room 102, storing a means of payment in the secure room 102, or outputting a means of payment from the secure room 102.

[0106] In Example 38, the safe arrangement of Example 36 or 37 may optionally further include a power distributor circuit 630 disposed outside the safe and coupled to the power supply 204p of the at least one processing device 104 .

[0107] In Example 39, the security arrangement of any one of Examples 36 to 38 may optionally further include a communication interface circuit 610 that is arranged outside the security room 102 and is configured to receive the cryptographic processing signal 110e from the peripheral circuit 110 and forward the cryptographic processing signal 110e to the security circuit 108.

[0108] In Example 40, the security arrangement of Example 38 may optionally include the communication interface circuit being further configured to receive the first additional control signal 106 c from the control circuit 106 and forward the first additional control signal to the at least one processing device 104 to control the at least one processing device 104 .

[0109] In Example 41, the security arrangement of Example 38 or 39 may optionally include the communication interface circuit being further configured to receive a second additional control signal 106c from the control circuit 106 and forward the second additional control signal to the additional control circuit 620 to configure the power distributor circuit 630 (e.g., enable or disable power for at least one processing device 104).

[0110] Example 42 is a method for operating a security arrangement (e.g., an automated teller machine (ATM)), the method comprising: controlling (e.g., via a control circuit) at least one processing device 104 for processing a means of payment (e.g., banknotes, gold, coins, etc.), wherein the at least one processing device 104 is arranged in a security room 102 to protect the at least one processing device 104 from unauthorized access; transmitting a cryptographic processing signal 110e generated by a peripheral circuit 110 arranged outside the security room 102 to a security circuit 108 arranged in the security room 102; and, when the cryptographic processing signal 110e is received at the security circuit 108, verifying the cryptographic processing signal via the security circuit; and configuring the operation of the at least one processing device based on the verification. Configuring the operation of the at least one processing device 104 includes disabling or enabling the operation of the at least one processing device 104. The operation of the at least one processing device may be enabled or disabled, for example, by disabling or enabling power to the at least one processing device 104 and / or by disabling or enabling communication between the at least one processing device 104 and a control circuit for controlling the at least one processing device 104. According to various embodiments, the safety circuit 108 may be equipped with a safety box arranged in the safety room 102 .

[0111] According to various embodiments, controlling the at least one processing device 104 may include at least one of controlling input into the safe room 102 via the at least one processing device 104 and controlling output from the safe room 102 via the at least one processing device 104 .

[0112] Example 43 is an automatic teller machine (ATM), comprising: a safe for protecting at least one security unit 604s from unauthorized access; a security circuit 108, which is arranged in a security room 102, wherein the security circuit 108 is configured to receive a password processing signal 110e, verify the received password processing signal 110e, and release the operation of at least one security unit 604s based on the verification.

[0113] Example 44 is a security arrangement (e.g., an automated teller machine (ATM)) comprising: a security room 102 for protecting at least one processing device 104 from unauthorized access; at least one processing device 104 (e.g., at least one security unit 604s) disposed within the security room 102 as a means of processing payments; and a security circuit 108 disposed within the security room 102, wherein the security circuit 108 is configured to receive a cryptographic processing signal 110e, verify the received cryptographic processing signal 110e, and configure (e.g., disable or enable) the operation of at least one processing device 104 based on the verification.

[0114] Although the present invention has been particularly shown and described with reference to specific embodiments, it will be understood by those skilled in the art that various changes in form and details may be made therein without departing from the spirit and scope of the present invention as defined by the appended claims. The scope of the present invention is therefore indicated by the appended claims and is therefore intended to include all changes that fall within the meaning and range of equivalents of the claims.

Claims

1. A valuable document processing device, comprising: a secure room configured to house one or more documents of value and to protect at least one processing device from unauthorized access; at least one processing device disposed within the secure room to at least process output of one or more value documents from the secure room; a control circuit coupled to the at least one processing device to control operation of the at least one processing device and configured to operate based on firmware that does not allow encrypted communications to be established between the control circuit and the at least one processing device; as well as A security circuit is arranged in a security room, wherein the security circuit is configured to receive a cryptographic processing signal, verify the received cryptographic processing signal, disable or enable operation of at least one processing device based on the verification result, and disable at least one processing device in the event of power loss or when an operating voltage of the security circuit meets a predefined operating voltage threshold.

2. The value document processing device according to claim 1, Wherein the security circuit is configured to enable operation of the at least one processing device when the cryptographic processing signal is verified and to disable operation of the at least one processing device when the cryptographic processing signal is not verified.

3. The value document processing device according to claim 1, Wherein the security circuit is further configured to disable operation of the at least one processing device when the cryptographic processing signal is not received.

4. The value document processing device according to claim 1, The at least one processing device is further configured to process input of one or more value documents into the secure room.

5. The value document processing device according to claim 1, wherein at least one of the processing devices comprises an automated processing arrangement to process one or more value documents, and a power source to supply the automated processing arrangement, and Wherein the safety circuit is configured to enable or disable operation of the power supply based on the verification result.

6. The value document processing device according to claim 1, Wherein the security circuit is configured to enable or disable communication between the control circuit and the at least one processing device based on the verification result.

7. The value document processing device according to claim 1, Wherein the security circuit is configured to perform an initialization process for exchanging a public key with the peripheral circuit, for cryptographically processing a signal and for verifying the cryptographically processed signal.

8. The value document processing device according to claim 7, The security circuit is configured to perform an initialization process based on asynchronous encrypted communication with the peripheral circuit.

9. The value document processing device of claim 7, further comprising: A hardware protection switch configured to allow the initialization process to start only when the hardware protection switch is activated.

10. The value document processing device of claim 1, further comprising: The peripheral circuit is configured to generate a cryptographic processing signal and transmit the cryptographic processing signal to the security circuit.

11. The value document processing device according to claim 10, The peripheral circuit is configured to generate a cryptographically processed signal based on a sequence of datagrams, wherein the datagrams of the sequence of datagrams are different from each other.

12. A method for operating a value document processing device, the method comprising: controlling at least one processing device for processing one or more value documents, wherein the at least one processing device is arranged in a secure room to protect the at least one processing device from unauthorized access and not to allow encrypted communications to be established between control circuitry for controlling the at least one processing device and the at least one processing device; transmitting a cryptographic processing signal generated by a peripheral circuit disposed outside the security room to a security circuit disposed within the security room; and, when the cryptographic processing signal is received by the security circuit, verifying the received cryptographic processing signal; as well as The operation of the at least one processing device is configured based on the verification result and the at least one processing device is disabled in the event of a power loss or in the event that the operating voltage of the safety circuit meets a predefined operating voltage threshold.

13. The method according to claim 12, The operation of configuring at least one processing device includes: enabling operation of at least one processing device when the cryptographic processing signal is verified; as well as Operation of at least one processing device is disabled when the cryptographic processing signal is not verified.

14. The method according to claim 12, Wherein controlling at least one processing device comprises controlling an input of one or more value documents into the secure room, and / or controlling an output of one or more value documents from the secure room.

15. Purpose of a security circuit, which is arranged in a safe of an automated teller machine to configure the operation of a processing device arranged in the safe for processing payments based on encrypted communication between the security circuit and a peripheral communication circuit outside the safe and to disable the processing device in the event of power loss or when the operating voltage of the security circuit meets a predefined operating voltage threshold, wherein the processing device is not allowed to establish encrypted communication between a control circuit for controlling the processing device and the processing device.

Images