Peripheral Device Identification for ATM Encryption Key Generation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing ATM encryption systems face challenges in key generation, particularly in self-service systems, where USB devices may report inconsistent or changing firmware versions, VID/PID changes, and missing serial numbers, leading to boot failures and security vulnerabilities.
Innovation Solution
A digital computing device with a control unit connected to peripheral devices generates a key encryption key based on identification information, using a USB descriptor's 0x80 field for serial number storage and excluding problematic devices from key generation, allowing for secure booting and encryption of data on an ATM's hard disk, with options for re-init and secure management of encrypted data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If USB devices are used for key generation in self-service systems, then device versatility and ease of operation are improved, but reliability deteriorates due to inconsistent firmware versions, changing VID/PID, and missing serial numbers
Solution Approach 1:
The patent changes the parameters used for device identification from unstable USB descriptors (serial numbers, VID/PID) to stable hardware identifiers (MAC addresses, device paths). This parameter substitution resolves the reliability issue while maintaining device versatility, as MAC addresses and device paths remain consistent across firmware updates and reconnections.
2Ease of operation
If peripheral devices are connected via serial connections for key generation, then ease of operation is improved, but security deteriorates due to potential unauthorized access and device theft
Solution Approach 1:
The patent binds the encryption key to the specific peripheral device configuration before the device can be used for encryption operations. This preliminary binding ensures that even if a device is stolen or disconnected, the key cannot be transferred or reused with another device, preventing unauthorized access while maintaining ease of operation for authorized users.
Solution Approach 2:
The patent introduces a binding mechanism that acts as an intermediary between the peripheral device and the encryption key. This binding creates a secure association that prevents direct key extraction from stolen devices, as the key is mathematically bound to the original device's identification information rather than being stored separately.
3Object-affected harmful factors
If key encryption key is generated from identification information of peripheral devices, then security is improved by preventing key theft, but device complexity increases due to multiple devices and binding management
Solution Approach 1:
The system automatically performs device detection, identification information extraction, and key binding without requiring manual user intervention. The control unit autonomously manages the complex processes of scanning for peripheral devices, reading their identifiers, generating the key encryption key, and binding it to the data encryption key, thereby reducing the perceived complexity for users while maintaining high security.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A computing device controlling access to encrypted information, comprising: a data encryption key for encrypting data stored on a disk; a control unit to which one or more peripheral devices are connected, and which is configured to: detect the peripheral devices; read from each of the peripheral devices identification information based on one or more USB descriptors of the peripheral device; generate for each peripheral device a respective key encryption key on the basis of the identification information read; initially store on the hard disk at least one encrypted data encryption key generated by encrypting the data encryption key using the respective key encryption keys; after the initial storage, determine the data encryption key by decrypting the encrypted data encryption key using the respective key encryption keys derived from the respective identification information; and encrypt or decrypt digital data using the data encryption key.