Security-Box for Secure PIN Entry on Touchscreen POS Terminals
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing point-of-sale (POS) terminals lack robust security measures for secure user information entry, particularly for financial transactions, as they often rely on limited keypads and displays, making them vulnerable to unauthorized access and observation during PIN entry.
Innovation Solution
A user-terminal configuration with a Security-Box that operates in two modes, 'PIN Entry Mode' and 'Clear Text Mode', using cryptographic methods and secure storage of keys to authenticate applications and control user input, ensuring secure PIN entry and transaction processing through a chip card reader, NFC reader, and virtual PIN pad on a touch screen.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a standard POS terminal with keypad and display is used, then the device complexity is low and ease of operation is good, but security against unauthorized access and observation is insufficient
Solution Approach 1:
The terminal is divided into two distinct operational modes: Secure Mode for PIN entry where the Security-Box controls the touch screen and blocks processor access, and Clear Text Mode for normal operations where the processor has full access. This segmentation allows the same hardware to provide both high security and normal functionality without requiring separate physical devices.
Solution Approach 2:
The Security-Box acts as an intermediary component that sits between the touch screen and the processor. It controls which applications can access the touch screen and in what mode, mediating between the user interface and the processing unit to enforce security policies without requiring complete system redesign.
2Reliability
If cryptographic authentication methods are implemented, then security against unauthorized access is improved, but the ease of operation and transaction speed may be reduced
Solution Approach 1:
Applications are authenticated with the Security-Box in advance using cryptographic methods before they can access the touch screen in Secure Mode. The Security-Box verifies application credentials and establishes trusted relationships beforehand, so that during actual PIN entry operations, the authentication process is already complete and does not add user burden.
Data Source
AI summary
A point-of-sale (POS) terminal is provided for entering a PIN to enable a financial transaction. The point-of-sale terminal has a card reader for reading information from a credit card, a processor for running an operating system, with applications, a touch screen for displaying information and receiving user inputs, and a Security-Box connected between the touch screen and the processor to control the user input on the touch screen to the processor. The Security Box is configured to run in a “PIN Entry Mode” and a “Clear Text Mode.” When running in “PIN Entry Mode” the user input is not forwarded as touch coordinates to the processor and when running in “Clear Text Mode” the touch coordinates are transmitted to the processors.