Partitioned Storage Device Access Control for ATM Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Modern self-service machines like ATMs are vulnerable to attacks through plug-and-play mechanisms, such as USB drives, which can distribute malware, and existing solutions that block unrecognized USB devices restrict functionality and are not entirely effective in preventing malware spread.
Innovation Solution
A peripheral digital storage device with a control unit that manages access to partitions based on identity information, using crypto controllers to authenticate and encrypt data, allowing only authorized access and preventing unauthorized data exchange, while maintaining operational functionality.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If USB drives are completely blocked to prevent malware attacks, then security is improved, but serviceability and operational functionality are severely restricted
Solution Approach 1:
The USB storage device is divided into multiple partitions, with each partition assigned to a specific self-service machine. The control unit manages access control on a per-partition basis, allowing the ATM to access only its designated partition while blocking access to other partitions. This segmentation enables selective access control that maintains security while preserving necessary serviceability functions.
2Ease of operation
If USB drives are allowed to connect freely for service operations, then serviceability is maintained, but malware distribution risk increases
Solution Approach 1:
The control unit acts as an intermediary between the self-service machine and the storage partitions. It intercepts access requests and validates them against the assigned machine identity before granting access. This intermediary layer prevents malware distribution by ensuring that data exchange occurs only between authorized pairs of machines and partitions, while still allowing legitimate service operations to proceed.
3Reliability
If partition access is restricted to specific machines, then malware spread is prevented, but device complexity increases
Solution Approach 1:
The system implements self-service access control where each self-service machine automatically identifies itself to the control unit upon connection. The control unit then automatically grants or denies access to specific partitions based on pre-established assignments, without requiring manual intervention or complex authentication protocols. This self-service approach reduces the operational complexity of the access control mechanism while maintaining security.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A peripheral digital storage device, having an interface allowing a connection to a self-service machine, for performing maintenance operation to the self-service machine, comprising: A storage device providing a storage area, wherein the storage area is divided into set of partitions which are interpretable by the self-service machine as independent storage areas for file operation when connected to the self-service machine; a control unit which is configured to control the access to the partitions by refusing or granting the self-service machine an access to the partition, depending on identity information receivable from the self-service machine for providing access to individual partitions for each assigned self-service machine connectable to the interface.