System and method for checking the system integrity of a self-service machine using a mobile device

Abstract

Procedure for testing the system integrity of a self-service machine and thus the integrity of the self-service machine using a mobile device, comprising the following steps: - Transmitting digital information, which provides information about the system integrity, from the self-service machine to a central server and evaluating and storing the information together with identity information of the self-service machine on a data carrier; - Obtaining the identity information of the self-service machine through the mobile device; - Transmitting the identity information to the central server via the mobile device and querying the digital information from the self-service machine, which provides information about the system integrity; - Transmission of information allowing a statement about the system integrity from the central server to the mobile device; - Displaying information that allows a statement about system integrity on the mobile device.

Description

[0001] The invention relates to a method and a system for testing the system integrity of a self-service machine using a mobile terminal Field of the invention:

[0002] Modern ATMs or self-service machines are controlled using a standard PC running a standard operating system, such as Microsoft Windows XP. Other operating systems are also conceivable, such as Linux / Unix or other versions of Windows. These standard components are primarily intended for a single workstation and generally do not meet the security requirements of an ATM environment. In particular, known security vulnerabilities can be used to install malware on the control computer to unauthorizedly obtain customer data. Since new security vulnerabilities are constantly being discovered in such operating systems, the integrity of the software on the control computer must be verified.

[0003] According to the state of the art, a specialized hardware-software combination based on the TPM chip of the control computer can be used for this purpose. Other alternatives are also conceivable, such as coprocessors that perform a check, but these will not be discussed further. With the help of specialized hardware, it can be ensured that the software (1) for authenticity verification itself becomes an easy target for attack. However, there are cases in which the authenticity check fails, but an appropriate response such as stopping the ATM is not possible or is actively prevented by the attacker. In these cases, it is important to offer the user the opportunity to check the authenticity of the ATM on site before entering private data such as their PIN. In this case, the user can be a customer who wishes to use the ATM's service. However, it can also be a technician who carries out maintenance work, etc.would like to carry out.

[0004] Authenticity verification can help prevent damage to customers that cannot be prevented with simple server-based authentication. This on-site verification helps improve customer acceptance of vending machines. A further advantage of this solution is that, in addition to software authenticity, additional information, such as skimming detection information, can be securely transmitted to the server. Unauthorized manipulation or unauthorized suppression of this information results in the vending machine being marked as untrustworthy, which is immediately visible to the user.

[0005] This approach can be extended as follows: According to the state of the art, there are already applications for mobile devices that guide customers to the nearest bank branch or to the nearest ATM. This convenience for the customer can be further improved by the application directly evaluating information about the integrity of a machine and not redirecting the customer to an inoperative or untrustworthy ATM.

[0006] DE 10 2007 006 659 A1 discloses an online payment method with a POS in which an attack on a POS is detected based on a comparison with the account data.

[0007] US 2010 / 0187300A1 discloses a method for detecting an attack on a card reader.

[0008] US 2009 / 0026258A1 discloses a method in which an ATM is secured by a security manager application. Overview of the invention:

[0009] The object of the invention is to provide information about the integrity of a self-service machine using a mobile device.

[0010] The problem is solved by a device and a method having the features of the claims.

[0011] The basic idea is based on a client-server architecture. Here, the authenticity of the software on the self-service system is measured using, for example, the Trusted Platform Module (TPM). However, other hardware or software solutions that verify the authenticity of the software are also conceivable. This authenticity information is regularly transmitted to a central server using a secure protocol (VPN, SSL, etc.).

[0012] This server checks the authenticity or stores the information about the authenticity and records the current status in a database.

[0013] To verify the authenticity of the self-service machine on-site, the customer's application on the mobile device performs the following steps: 1) Determine the authentic or unique identifier or identity of the self-service machine. 2) Authentically retrieve the current status of the self-service machine from the server.

[0014] The user can then decide whether or not to use the machine based on the server's feedback.

[0015] A further component of the present invention is a system for checking the system integrity of a self-service machine using a mobile terminal and a central server.

[0016] The self-service machine includes transmission means, such as a network interface, for transmitting digital information about system integrity from the self-service machine to the central server. An evaluation unit, such as a processor, and a storage unit, such as a hard drive or flash memory, capture and store the information along with the self-service machine's identity information.

[0017] Furthermore, means are available for the mobile device to obtain the identity information of the self-service machine. This identity information can be transmitted from the self-service machine via Bluetooth or infrared, for example, and passed to the corresponding application on the mobile device. The application can also be a browser, for example, and a URL with the corresponding ID information is passed on. The URL is then called and leads to the establishment of a connection with the central server. After the transmission unit has transmitted the identity information to the central server, a query unit on the server is contacted, which queries the digital information of the self-service machine, which provides a statement about the system integrity, based on the identity information.After a successful query, the information that allows a statement to be made about the system's integrity is transmitted from the central server to the mobile device via a transmission unit, which can represent a network interface, so that it can be displayed on the mobile device's display. It is also conceivable that special applications are installed on the mobile device that enable communication with the machines and the server. These applications can, for example, also use GPS data to transmit it to the server, which then uses location information to locate or identify the self-service machine.

[0018] To ensure secure communication between the systems, an encryption unit encrypts the communication between the mobile device and the self-service machine, between the mobile device and the central server, and / or between the self-service machine and the central server. This can be done using SSL, VPN, etc. Furthermore, challenge-response procedures and / or counters can be used to ensure that the exchanged data is not outdated or reused. For example, with each data exchange, a synchronized counter can be incremented, which is then verified by the recipient.

[0019] In a preferred embodiment, a crypto processor calculates checksums, which are then compared or verified locally or on the server. In one possible embodiment, the comparison can be performed locally, with the comparison patterns stored in an encrypted memory. The verification can be performed regularly at time intervals, when events occur.

[0020] A standard component for testing system integrity is a Trusted Platform Module (TPM).

[0021] Digital information that provides information about system integrity is transmitted regularly or depending on events from the self-service machine or requested from the central server. This ensures that a notification is sent immediately in the event of an attack, and otherwise only at regular intervals.

[0022] Furthermore, additional information may be transmitted that originates from the self-service machine's security devices. This information can be digital signatures of components or serial numbers of components such as the cash dispenser, keypad, monitor, etc., or information such as the status of an anti-skimming solution (see also DE 10 2008 012 231.9) and / or GPS information from a mobile machine.

[0023] In another embodiment, personalized information originating from the mobile device or the server is displayed in parallel on the self-service machine and the mobile device to ensure that the display unit and the device's identity match. For example, a code or color can be displayed in a browser or applet, which is also displayed on the self-service machine. This allows the user to quickly visually grasp the identity. Figures Description:

[0024] The figures of the procedure are briefly described below: Fig. 1 shows the flow chart for determining the machine identification; Fig. 2 shows the flow chart for determining the machine status. Detailed description of an embodiment

[0025] The functionality for checking authenticity is activated on the control computer in one possible embodiment of the TPM. For this purpose, the corresponding software with the appropriate configuration is installed on the self-service machine. To prevent manipulation of this mechanism, the software checksums are generated in one embodiment. The actual authenticity check takes place on a central server. It is also conceivable to perform this check at the self-service machine; however, this would require the checksums to be stored in a secure / encrypted area for comparison. The server can check the authenticity of the machine and record the result of this check in a status for this machine. Based on this status, statements can be made about the system integrity. In the event of a failed check, measures such as stopping the machine can be initiated.

[0026] However, the execution of these measures cannot be guaranteed in most cases, as the machine may no longer respond to signals from the server.

[0027] In an embodiment essential to the invention, the customer is offered the opportunity to query the authenticity of a machine. Since this requires communication with the server and the machine, as well as some cryptographic calculations, the customer can use a mobile device such as a mobile phone (PDA). The procedure for this process is as follows: The customer is near the machine whose service he wants to use. Fig. 1 shows the steps described below. 1) Obtain the ATM's identification code. Before use, the user runs an application on the mobile device which retrieves data from the ATM (ATM = Automated Teller Machine), e.g. using near-field communication (e.g. Bluetooth, WLAN, infrared, etc.), manually entering an identification code, or localization via GPS (Global Positioning System). This primarily concerns the identity of the machine (request ATM identity). To secure this communication, cryptographic protection mechanisms are necessary when communication with the machine takes place. On the one hand, the authenticity of the obtained data must be ensured, e.g. through digital signatures. On the other hand, the "freshness" of the data must be ensured through challenge-response procedures or strictly monotonically ascending numbers. After the identity has been calculated or signed by the CERT_ATM, this information is transmitted to the mobile device (receive identity).This uses a Cert_Root to check whether the transmitted identity is correct. If the data authenticity check fails, the machine is classified as "inauthentic." Otherwise, the process continues with step 2. 2) Verification of the authenticity of the machine. The verification carried out in the first step ( Fig. 1) The determined identifier / identity of the machine is sent from the mobile device as a request to the server ( Fig.2). Communication can take place via UMTS, for example. The server checks the current status of the requested machine using the information in the ATM stati db (database) and sends this information to the mobile device. The transmission is also signed or encrypted with the Cert_Server certificate. The application on the end device receives the data and verifies it with Cert_Root. The status is then checked, and depending on the server's response, it is indicated whether the machine can be used or not. This communication must also be protected against manipulation using the measures described above (e.g., digital signatures and challenge-response procedures, Cert_Root). In addition, common procedures such as SSL / TLS or IPSec can be used. A corresponding program (e.g., applet) can be stored on the mobile device to communicate with the server. 3) Regularly updating the ATM status information. The server regularly queries the ATM / self-service machine for its current authentication information, e.g., every hour or as needed. Since the measurement is automatically updated when each software program on the ATM is started, the server receives the current status of the machine. This communication should also be secured using the mechanisms described above, such as challenge-response and signatures. A check on the server then leads to the current status of the machine, e.g., OK, tampered with, etc. Information from other mechanisms, such as the status of the anti-skimming solution or GPS information from a mobile machine, can also be transmitted at this point. It is of course also conceivable for the self-service machine to send status information at regular intervals or in the event of an attack on the system integrity.

[0028] The advantages of the approach described above are presented below using some common attack scenarios. For simplicity, we assume that the cryptographic mechanisms are secure.

[0029] Man-in-the-middle (MITM): The user is standing in front of a machine that was installed solely for the purpose of unauthorized collection of card data and PINs. Neither the machine manufacturer nor the bank has any knowledge of this machine. The attacker's goal is to collect card data and PINs from users in order to use them for later illegal transactions.

[0030] This type of attack would be detected immediately using the above method, before the user has entered their card or PIN. The consistency check in step 1 would already fail if the ATM doesn't have the certificates issued by the bank. The user is thus protected against this type of attack.

[0031] Classic attack using software manipulation: The ATM's software has been tampered with, for example, to collect user data or to dispense unauthorized money. This type of attack was detected using the above method before the customer entered sensitive data. The server's system integrity check failed. This information is forwarded directly to the user.

[0032] To further increase user-friendliness, the solution described above can be extended as follows. On the mobile device, the user provides the application with a personalized parameter. This could, for example, be the selection of a color, a code, etc. This parameter is transmitted to the server during the authentication query. The server, in turn, transmits this parameter to the ATM. If the ATM has not been tampered with, this parameter, e.g., the background color, is then displayed to the user. Alternatively, this parameter could be selected by the server and sent to both the ATM and the user. The user can thus recognize a problem with the trustworthiness of the ATM based on a changed environmental setting.

[0033] This extension can also counter the following attack scenario: Fake display on a genuine ATM: An authentic bank ATM is equipped with a tampered display. This display prompts the customer to enter their PIN, for example, even though the EPP (Encrypted PIN Pad) is not in encryption mode. The attacker can then, for example, obtain the user's PIN by analyzing the communication. This attack is prevented by the enhancement described above. The fake display is unable to correctly display the user's specific parameters. The user can therefore immediately recognize the tampered display.

[0034] The solution can also be used to support plagiarism protection. For this purpose, additional software queries specific properties of a component. This information is sent to the server along with the other information. A positive evaluation by the server is only given after successfully checking this specific property(ies). This extension can detect the following manipulation: Incorrect component in the vending machine: A vending machine is equipped with an unauthorized component. The server's query regarding the vending machine's integrity also includes specific characteristics of this component. As soon as the user, such as a technician, requests the system's integrity information from the server, they immediately recognize that the component has been replaced.

Claims

[1] Procedure for testing the system integrity of a self-service machine and thus the integrity of the self-service machine using a mobile device, comprising the following steps: - Transmitting digital information, which provides information about the system integrity, from the self-service machine to a central server and evaluating and storing the information together with identity information of the self-service machine on a data carrier; - Obtaining the identity information of the self-service machine through the mobile device; - Transmitting the identity information to the central server via the mobile device and querying the digital information from the self-service machine, which provides information about the system integrity; - Transmission of information allowing a statement about the system integrity from the central server to the mobile device; - Displaying information that allows a statement about system integrity on the mobile device. [2] The method according to the preceding claim, wherein the identity information of the self-service machine is obtained by the mobile terminal, by wireless transmission from the self-service machine to the mobile terminal, by entering location information into the mobile terminal and / or by manually entering identification data. [3] The method according to one or more of the preceding claims, wherein the communication between the mobile terminal and the self-service machine, between the mobile terminal and the central server, and / or between the self-service machine and the central server is a secure communication, with encryption and / or challenge response methods and / or counters. [4] The method according to one or more of the preceding claims, wherein the system integrity is checked by forming checksums of the software on the self-service machine, which are compared with a reference checksum, the comparison being carried out on the self-service machine or the central server. [5] The method according to the preceding claim, wherein the system integrity is measured using the Trusted Platform Module (TPM) and this system integrity information is transmitted to a central server using a secure protocol. [6] The method according to one or more of the preceding claims, wherein digital information which makes a statement about the system integrity is regularly transmitted by the self-service machine or is requested from the central server. [7] The method according to the preceding claim, wherein additional information such as a status of an anti-skimming solution and / or GPS information of a mobile machine is transmitted. [8] The method according to one or more of the preceding claims, wherein a personalized parameter is entered on the mobile terminal, which is transmitted to the central server, and which is transmitted from the central server to the self-service machine and displayed thereon. [9] The method according to one or more of the preceding claims, wherein a personalized parameter is generated by the central server and transmitted to the mobile terminal and the self-service machine in order to display it on both the mobile terminal and the self-service machine, so that a comparison of the information is possible. [10] The method according to one or more of the two preceding claims, wherein the parameter is displayed in the form of a code and / or a color on a monitor of the self-service machine. [11] The method according to one or more of the preceding claims, wherein, in order to determine the system integrity of the self-service machine, properties of a component of the self-service machine are queried, which are then transmitted to the central server to be checked. [12] System for testing the system integrity of a self-service machine and thus the integrity of the self-service machine using a mobile device and a central server, comprising the following components: - means in the self-service machine for transmitting digital information, which provides information about the system integrity, from the self-service machine to the central server and an evaluation unit and storage unit which store the information together with identity information of the self-service machine on a data carrier; - Means for obtaining the identity information of the self-service machine through the mobile device; - Transmission unit of the mobile device, which transmits the identity information to the central server, and query unit of the mobile device, which queries the digital information of the self-service machine, which provides a statement about the system integrity; - Transmission unit that transmits information allowing a statement about the system integrity from the central server to the mobile device so that it can be displayed on a display unit of the mobile device. [13] The system according to the preceding system claim, wherein the identity information of the self-service machine is transmitted to the mobile terminal by a wireless transmission unit. [14] The system according to one or more of the preceding system claims, wherein encryption units secure the communication between mobile terminal and self-service machine, between mobile terminal and central server, and / or between self-service machine and central server with encryption and / or challenge response methods and / or counters. [15] The system according to one or more of the preceding system claims, wherein a calculation unit is provided which checks the system integrity by forming checksums of the software on the self-service machine, which are compared with a reference checksum, the comparison being carried out on the self-service machine or the central server. [16] The system according to the preceding system claim, wherein the system integrity is measured using the Trusted Platform Module (TPM) and this system integrity information is transmitted to a central server using a secure protocol. [17] The system according to one or more of the preceding system claims, wherein digital information which makes a statement about the system integrity is regularly transmitted by the self-service machine or is requested from the central server. [18] The system according to the preceding system claim, wherein a verification unit is present which transmits additional information, such as a status of an anti-skimming solution and / or GPS information of a mobile machine. [19] The system according to one or more of the preceding system claims, wherein a receiving unit is provided which receives a personalized parameter from the mobile terminal, and a transmitting unit is provided which transmits this parameter from the central server to the self-service machine so that it is displayed on the self-service machine. [20] The system according to one or more of the preceding system claims, wherein a unit is provided so that a personalized parameter is generated by the central server, which is transmitted to the mobile terminal and the self-service machine in order to have it displayed on both the mobile terminal and the self-service machine, so that a comparison of the information is possible. [21] The system according to one or more of the two preceding system claims, wherein the parameter is displayed in the form of a code and / or a color on a monitor of the self-service machine. [22] The system according to one or more of the preceding system claims, wherein a verification unit is provided for verifying the property of a component of the self-service machine, for determining the properties of the system integrity of the self-service machine, which are then transmitted to the central server to be verified.

Images