Composite security interconnect device and methods
Various embodiments include composite security interconnect devices and methods. One method embodiment that may be performed by a composite security interconnect device, also referred to herein as a security controller, includes decrypting a first encrypted input received from a peripheral device with a first encryption key to obtain clear text. The first encryption key may be an encryption key established between the security controller and the peripheral device. The method further includes encrypting the clear text with a second encryption key to obtain second encrypted input, the second encryption key being a key of an encryption key pair established with a transaction processing host.
1. A method comprising:
decrypting, by a security controller of a dedicated peripheral device interconnect device that is physically distinct from a computer controlling operation, is communicatively coupled to the computer controlling operation of a Self-Service Terminal (SST), and to which at least two peripheral devices are directly coupled, the dedicated peripheral device interconnect device physically positioned between each of the at least two peripheral devices and the computer controlling operation of the SST, a first encrypted input received from a peripheral device with a first encryption key to obtain clear text, the dedicated peripheral device interconnect device embedded within a peripheral device and operable to provide security services to an SST when coupled thereto; and
encrypting, by the security controller of the peripheral device interconnect device, the clear text with a second encryption key to obtain second encrypted input, the second encryption key being a key of an encryption key pair established with a transaction processing host.
2. The method of claim 1 , further comprising:
receiving a device status message from the peripheral device, the peripheral device being one of two or more peripheral devices coupled to the security controller performing the method;
calling a platform service of the SST to which the security controller is coupled to cause the SST to generate and send a message to an SST device manager, the SST platform service call including identifying data of the peripheral device from which the device status message was received and data representative of the device status message.
3. The method of claim 1 , further comprising:
storing, in a memory of the peripheral device, a third encryption key, the third encryption key being an encryption key of an encryption key pair established between the peripheral device and the security controller to which the peripheral device is coupled;
receiving input into the peripheral device;
encrypting, with the third encryption key, the received input to obtain the first encrypted input; and
transmitting the first encrypted input to the security controller.
4. The method of claim 3 , wherein the method is triggered for execution upon the peripheral device receiving an input ENTER command.
5. The method of claim 1 , wherein the method is performed by the security controller of the SST and the peripheral device is an encrypting Personal Identification Number (PIN) pad device.
6. The method of claim 5 , wherein the security controller is integrated within an encrypting touch screen device.
7. The method of claim 5 , wherein the SST is an Automated Teller Machine (ATM).
8. A method comprising:
providing a prompt, on a Self-Service Terminal (SST) by an application executing on the SST, for entry of a user credential;
receiving, by an encrypting input device, user credential input;
encrypting, by the encrypting input device, the received user credential input with a first encryption key to obtain first encrypted input, the first encryption key being an encryption key of an encryption key pair established between the encrypting input device and a security controller, wherein the security controller is embedded within another peripheral device that is a dedicated device that provides security services to an SST when coupled thereto, the dedicated peripheral device interconnect device is physically distinct from a computer controlling operation of the SST and physically positioned between the encrypting input device and the computer controlling operation of the SST;
transmitting the first encryption input from the encrypting input device to the security controller;
decrypting, by the security controller, the first encryption input with a second encryption key to obtain clear text, the second encryption key being an encryption key of the encryption key pair established between the encrypting input device and the security controller;
encrypting, by the security controller, the clear text with a third encryption key to obtain second encrypted input, the third encryption key being an encryption key of an encryption key pair established between the security controller and a transaction processing host; and
providing, by the security controller, the second encrypted input to the application executing on the SST.
9. The method of claim 8 , further comprising:
detecting a fault condition on the encrypting input device;
transmitting a device status message including data representative of the fault condition from the encrypting input device to the security controller;
calling, by the security controller in response to receiving the device status message, an SST platform service to cause the SST to generate and send a message to an SST device manager, the SST platform service call including encrypting input device identifying data and data representative of the device status message.
10. The method of claim 8 , wherein the encrypting input device is one of at least two encrypting input devices.
11. The method of claim 10 , wherein the at least two encrypting input devices consist of an encrypting Personal Identification Number (PIN) pad device and an encrypting touch screen device.
12. The method of claim 10 , wherein:
the security controller is integrated within a first encrypting input device of the at least two encrypting input devices;
the first encrypting input device is coupled to another component of the SST; and
the other of the at least two encrypting input devices are coupled to the first encrypting input device.
13. The method of claim 8 , further comprising:
receiving, in the security controller, an encrypted message from the transaction processing host;
decrypting the encrypted message with the third encryption key;
determining the decrypted message is a currency dispenser command for a dispenser device coupled to the security controller;
encrypting the decrypted message with a fourth encryption key to obtain an encrypted dispense command, the fourth encryption key being an encryption key of an encryption key pair established between the security controller and the dispenser device; and
transmitting the encrypted dispense command to the dispenser device.
14. The method of claim 8 , further comprising:
detecting a tampering event in the security controller; and
erasing all encryption keys from the security controller.
15. A Self-Service Terminal (SST) comprising:
a security controller device including a memory device and at least two peripheral device connections, the security controller device embedded within a dedicated peripheral device that is physically distinct from a computer controlling operation of the SST and provides security services to the SST when coupled thereto, the dedicated peripheral device physically positioned between each of the at least two peripheral devices and the computer controlling operation of the SST, the security controller device operable to:
couple to the SST and interact with SST software;
receive, via a peripheral device connection of the at least two peripheral device connections, a first encrypted input;
decrypt the first encrypted input with a first encryption key stored in the memory device to obtain clear text, the first encryption key being an encryption key of an asynchronous encryption key pair established between the security controller and a peripheral device from which the first encrypted input was received; and
encrypt the clear text with a second encryption key stored in the memory device to obtain second encrypted input, the second encryption key being a key of an asynchronous encryption key pair established between the security controller and a transaction processing host.
16. The SST of claim 15 , wherein the security controller device is further operable to provide the second encrypted input to the SST software.
17. The SST of claim 15 , wherein the memory device is a volatile memory and includes a battery that provides power to the memory device to maintain keys stored in the memory device when the SST is cycled.
18. The SST of claim 16 , further comprising:
a peripheral device connected to one of the at least two peripheral device connections of the security controller, the peripheral device including:
a memory storing a third encryption key, the third encryption key being an encryption key of an asynchronous encryption key pair established between the peripheral device and the security controller;
an input receiving device; and
an encryption module to receive input from the input receiving device, encrypt received input to obtain the first encrypted input, and transmit the first encrypted input to the security controller device.
19. The SST of claim 18 , wherein the SST is an Automated Teller Machine (ATM) and the input receiving device is a Personal Identification Number (PIN) input device.
20. The SST of claim 19 , wherein the PIN input device is an encrypting touch screen device.