System and method to control the access on information of a peripheral storage device
A peripheral digital storage device has an interface allowing a connection to a self-service machine for performing maintenance operation to the self-service machine. The device provides a storage area divided into a set of partitions which are interpretable by the self-service machine as independent storage areas for file operation when connected to the self-service machine. A control unit which is configured to control the access to the partitions by refusing or granting the self-service machine an access to the partition depending on identity information receivable from the self-service machine for providing access to individual partitions for each assigned self-service machine connectable to the interface.
1. A method to control access to a peripheral digital storage device comprising the steps:
providing a peripheral digital storage device, having an interface allowing a connection to a self-service machine being an automated transaction machine (ATM), for performing maintenance operation to the self-service machine, the peripheral digital storage device including:
a storage device providing a storage area composed of a plurality of memory chips, wherein the storage area is divided into partitions including a first set of partitions which are interpretable by a self-service machine as independent storage areas for file operation when the storage device is connected to the self-service machine and the storage area also includes at least one second partition;
wherein the first set of partitions are further defined as read/write partitions allowing individual read/write file operations on the first set of partitions by the self-service machine being exclusively assigned to the first set of partitions thereby avoiding a data exchange between the self-service machine and a second self-service machine; and
a control unit which is configured to control access to the first set of partitions by refusing or granting the self-service machine access to the first set of partition depending on identity information receivable by the control unit from the self-service machine for providing access to individual partitions of the first set of partitions assigned to the self-service machine connectable to the interface, each of the individual partitions of the first set of partitions being defined by the control unit based on memory chip level such that each of the partitions is defined by one of or a group of the plurality of memory chips, wherein the first set of partitions are further defined by the control unit on a file system level, wherein the control unit dynamically configures a partition table defining physical memory areas for each of the individual partitions of the first set of partitions, wherein depending on the identity information of the self-service machine the control unit is configured to modify the partition table to provide only information of the individual partitions assigned to the self-service machine;
performing a maintenance operation to the self-service machine including:
plugging the peripheral digital storage device into the self-service machine;
determining, by the control unit, an identity of the self-service machine;
providing, by the control unit, access to only those partitions to the self-service machine which match the identity;
mounting, on the self-service machine, the at least one second partition; and
performing, by both of the control unit as well as the self-service machine, only file read operations on the at least one second partition while the at least one second partition is mounted on the self-service machine.
2. The method according to claim 1 further comprising:
controlling access to the file system level with the control unit by providing files and file relevant information only when matching the identity information received from the self-service machine and rejecting the access to files when the identity is not matching.
3. The method according to claim 1 further comprising:
modifying, with the control unit, a filesystem table depending on the identity information of the self-service machine to allow access only to the files which are assigned to the self-service machine.
4. The method according to claim 1 , wherein at least one partition of the set of partitions stores certificates and/or cryptic keys for determining the identity of the peripheral digital storage device and/or the self-service machine, wherein the certificates and/or cryptic keys can be used to determine the identity of the self-service machine.
5. The method according to claim 1 , further comprising the steps:
removing the peripheral digital storage device from the self-service machine;
plugging the peripheral digital storage device into a personal computer;
accessing the peripheral digital storage device in the personal computer, in a non standard way, avoiding the automatic installation or execution of malware; and
directly transferring the data from the personal computer over the network to a server being protected against malware.
6. The method according to claim 1 , further comprising the steps:
utilizing a proprietary file system that is unknown to the operating system of the self-service machine;
writing data utilizing a proprietary API; and
reading data utilizing a proprietary API.
7. The method of claim 1 further comprising:
writing to the at least one second partition only at a notebook of a technician servicing the ATM.