Granted Patent B2

US 9,485,250 · App. 14/610,845 · Granted Nov 1, 2016

Abstract

Claims (91)

1. A method comprising:

transmitting a peripheral device encryption key (Ki) and peripheral device identifying data encrypted with a key (SC pk ) of a security controller of a Self Service Terminal (SST) to the security controller by a peripheral device of a host computer of the SST in advance of receipt by the security controller of a host message from a host computer to perform an action on the peripheral device;

receiving, from the security controller, a first encrypted message authentication code key (Km 1 ) encrypted according to a first security controller encryption key (Ke 1 ) by the peripheral; and

storing, by the peripheral device, each of Ki and the received first encrypted message authentication code key (Km 1 ) encrypted according to a first security controller encryption key (Ke 1 ) in a memory of the peripheral device.

2. The method of claim 1 , further comprising:

receiving a transaction message including a message, a message authentication code, Ke 1 encrypted according to Ki, and a second encrypted message authentication code key (Km 2 ) encrypted according to a second security controller encryption key (Ke 2 );

decrypting Ke 1 according to Ki to obtain Ke 1 clear text and Km 1 according the Ke 1 clear text to obtain clear text of the first encrypted message authentication code key;

verifying the received message authentication code in view of the first encrypted message authentication code key clear text;

executing a command included in the received transaction message when the verifying is successful; and

storing Km 2 in the memory.

3. The method of claim 2 , wherein the transaction message is received from the host computer of the SST.

4. The method of claim 1 , wherein the peripheral device identifying data includes a serial number and data identifying a type of the peripheral device that performs the method.

5. The method of claim 1 , wherein the security controller is an encrypting Personal Identification Number (PIN) pad device.

6. The method of claim 1 , wherein the peripheral device that performs the method is a cash dispenser.

7. The method of claim 1 , wherein the SST is an Automated Teller Machine (ATM).

8. A method performed by a peripheral device of a Self-Service Terminal (SST), the method comprising:

transmitting peripheral device identifying data to an SST security controller by a peripheral device of a host computer of the SST in advance of receipt by the security controller of a host message from a host computer to perform an action on the peripheral device;

receiving a public key (SC pk ) from the security controller by the peripheral device;

generating a peripheral device encryption key (Ki) by the peripheral device;

encrypting Ki according to SC pk by the peripheral device;

transmitting the encrypted Ki to the security controller by the peripheral device;

receiving, from the security controller, a first encrypted message authentication code key (K m1 ) encrypted according to a first security controller encryption key (Ke 1 ) by, the peripheral device; and

storing, by the peripheral device, each of Ki and the received K m1 in a memory of the peripheral device.

9. The method of claim 8 , further comprising:

receiving a transaction message including a message, a message authentication code, K e1 encrypted according to Ki, and a second encrypted message authentication code key (K m2 ) encrypted according to a second security controller encryption key (Ke 2 );

decrypting Ke 1 according to Ki to obtain Ke 1 clear text;

decrypting Km 1 according the Ke 1 clear text to obtain clear text of the first encrypted message authentication code key;

verifying the received message authentication code in view of the first encrypted message authentication code key clear text; and

storing Km 2 in the memory.

10. The method of claim 9 , wherein the transaction message is received from the host computer of the SST.

11. The method of claim 8 , wherein the peripheral device identifying data includes a serial number and data identifying a type of the peripheral device that performs the method.

12. The method of claim 8 , wherein the security controller is an encrypting Personal Identification Number (PIN) pad device.

13. The method of claim 8 , wherein the peripheral device that performs the method is a cash dispenser.

14. The method of claim 8 , wherein the SST is an Automated Teller Machine (ATM).

15. A Self-Service Terminal (SST) comprising:

a processor;

a peripheral device coupled to the processor;

a security controller device including a memory device and coupled to the processor and to the peripheral device, the security controller device operable to perform data processing activities between the processor and the peripheral device in advance of receipt by the security controller device of a host message from the processor to perform an action on the peripheral device comprising:

receiving peripheral device identifying data from the peripheral device;

transmitting a public key (SC pk ) of the security controller device to the peripheral device;

decrypting a received peripheral device encryption key (Ki) according to SC pk ;

generating a first security controller encryption key (Ke 1 );

generating a first message authentication code key and encrypting the first message authentication code key according to Ke 1 to obtain (Km 1 )Ke 1 ;

transmitting (Km 1 )Ke 1 to the peripheral device; and

storing Ki and (Km 1 )Ke 1 in the memory device.

16. The SST of claim 15 , further comprising:

receiving a message addressed to the peripheral device;

generating a second security controller device encryption key (Ke 2 );

generating a second message authentication code key and encrypting the second message authentication code key according to Ke 2 to obtain (Km 2 )Ke 2 ;

storing (Km 2 )Ke 2 in the memory device;

transmitting the received message, the first message authentication code, Ke 1 encrypted according to Ki, and (Km 2 )Ke 2 to the peripheral device.

17. The SST of claim 15 , wherein the peripheral device identifying data includes a serial number and data identifying a type of the peripheral device.

18. The SST of claim 15 , wherein the security controller is an encrypting Personal Identification Number (PIN) pad device.

19. The SST of claim 15 , wherein the peripheral device is a cash dispenser.

20. The SST of claim 15 , wherein the SST is an Automated Teller Machine (ATM).

21. A method comprising:

transmitting a peripheral device encryption key (Ki) and peripheral device identifying data encrypted with a key (SC pk ) of a security controller of a Self Service Terminal (SST) to the security controller;

receiving, from the security controller, a first encrypted message authentication code key (Km 1 ) encrypted according to a first security controller encryption key (Ke 1 );

storing each of Ki and the received first encrypted message authentication code key (Km 1 ) encrypted according to a first security controller encryption key (Ke 1 ) in a memory;

receiving a transaction message including a message, a message authentication code, Ke 1 encrypted according to Ki, and a second encrypted message authentication code key (Km 2 ) encrypted according to a second security controller encryption key (Ke 2 );

decrypting Ke 1 according to Ki to obtain Ke 1 clear text and Km 1 according the Ke 1 clear text to obtain clear text of the first encrypted message authentication code key;

verifying the received message authentication code in view of the first encrypted message authentication code key clear text;

executing a command included in the received transaction message when the verifying is successful; and

storing Km 2 in the memory.

22. A method performed by a peripheral device of a Self-Service Terminal (SST), the method comprising:

transmitting peripheral device identifying data to an SST security controller;

receiving a public key (SC pk ) from the security controller;

generating a peripheral device encryption key (Ki);

encrypting Ki according to SC pk ;

transmitting the encrypted Ki to the security controller;

receiving, from the security controller, a first encrypted message authentication code key (Km 1 ) encrypted according to a first security controller encryption key (Ke 1 );

storing each of Ki and the received Km 1 in a memory;

receiving a transaction message including a message, a message authentication code, Ke 1 encrypted according to Ki, and a second encrypted message authentication code key (Km 2 ) encrypted according to a second security controller encryption key (Ke 2 );

decrypting Ke 1 according to Ki to obtain Ke 1 clear text;

decrypting Km 1 according the Ke 1 clear text to obtain clear text of the first encrypted message authentication code key;

verifying the received message authentication code in view of the first encrypted message authentication code key clear text; and

storing Km 2 in the memory.

23. A Self-Service Terminal (SST) comprising:

a peripheral device;

a security controller device including a memory device and a coupling to the peripheral device, the security controller device operable to perform data processing activities comprising:

receiving peripheral device identifying data from the peripheral device; transmitting a public key (SC pk ) of the security controller device to the peripheral device;

decrypting a received peripheral device encryption key (Ki) according to SC pk ;

generating a first security controller encryption key (Ke 1 );

generating a first message authentication code key and encrypting the first message authentication code key according to Ke 1 to obtain (Km 1 )Ke 1 ;

transmitting (Km 1 )Ke 1 to the peripheral device;

storing Ki and (Km 1 )Ke 1 in the memory device;

receiving a message addressed to the peripheral device;

generating a second security controller device encryption key (Ke 2 );

generating a second message authentication code key and encrypting the second message authentication code key according to Ke 2 to obtain (Km 2 )Ke 2 ;

storing (Km 2 )Ke 2 in the memory device; and

transmitting the received message, the first message authentication code, Ke 1 encrypted according to Ki, and (Km 2 )Ke 2 to the peripheral device.

Assignments (10)