Unattended secure device authorization
View Patent ↗Unattended secure device authorization techniques are provided. An operating system (OS) module, which is responsible for device validation when that device is interfaced to a host device, is enhanced. The enhanced OS module silently checks the peripheral device's identifier against a white list and if a match occurs, the enhanced OS module grants permission to the host device applications; if no match occurs, the enhanced OS module silently rejects application access to the device. In an embodiment, the enhanced OS module interacts with the device to determine whether the device is to be authorized or rejected.
1. A method, comprising:
identifying, by an operating system (OS) device validator executing on a Self-Service Terminal (SST), a notification that a peripheral device is interfaced to a device port of the SST; and
authenticating, by the OS device validator, the peripheral device for access by an application executing on the SST without any action on the part of the application,
wherein authenticating further includes sending an encrypted “hello” message to the peripheral device decrypting the encrypted hello message at the peripheral device by using a security key of the peripheral device and receiving a decrypted response back from the peripheral device with the decrypted response including a device identifier for the peripheral device and comparing, by the OS device validator, the device identifier obtained from the decrypted response against a white list of valid device identifiers for valid peripheral devices that can service the application within an OS of the SST.
2. The method of claim 1 further comprising, providing, by the OS device validator, the application access when authentication was successful and without any action on the part of the application.
3. The method of claim 1 further comprising, preventing, by the OS device validator, the application from having access to the peripheral device when authentication failed and without any action on the part of the application.
4. The method of claim 1 further comprising, logging, by the OS device validator, actions taken by the OS device validator when attempting to authenticate the peripheral device.
5. A Self-Service Terminal (SST), comprising:
a device comprising a secure storage having a security key and device identifiers;
an SST core wherein the SST core comprising an operating system (OS) validator module and one or more applications processing on the SST core, wherein the operating system (OS) validation module operable to:
(i) execute on one or more processors of the SST,
(ii) identify a connected device to the SST, and
(iii) authenticate the connected device for access by an application executing on the SST within an OS of the SST and without any action by the application by the OS validation module sending an encrypted “hello” message to the connected device decrypting the encrypted hello message at the connected device by using the security key of the connected device and the OS validation module receiving a decrypted response back from the connected device that includes a device identifier for the connected device, and wherein the OS validation module is further configured to obtain the device identifier from the decrypted response and determine whether the device identifier is present in a white list of valid device identifiers for the application to access the connected device from the OS of the SST.
6. The SST of claim 5 , wherein the SST is an ATM and the OS executing on the ATM includes the OS validation module, wherein the OS is an open source OS, and wherein the OS validation module is an enhancement to or a replacement for an existing validation module of the OS.