Patent Application
20170046673
The present invention relates to an automatic transaction device and an automatic transaction system.
In an automatic transaction device such as an automated teller machine (ATM), it may happen that unauthorized processing is executed by an unauthorized command being transmitted to an internal device constituting the automatic transaction device. For example, cash may be withdrawn when an unauthorized withdrawal command which has nothing to do with an actual transaction is sent to a banknote processing unit that handles deposit and withdrawal of banknotes. As a countermeasure to prevent unauthorized processing of this kind, encryption processing is executed so as to protect communications between an overall control unit and the internal device of the automatic transaction device.
The encryption processing requires an encryption key. When the encryption key is not properly managed, protection of the communications by an encryption feature cannot be expected even when an encryption algorithm whose safety is authenticated by a third party is adopted. Accordingly, there is a need of secure encryption key management (specification of the encryption key, etc.) for each of the overall control unit and the internal device(s) of the automatic transaction device.
As a scheme of specifying an encryption key in an automatic transaction device, the patent literature 1 discloses a scheme in which a secret key is specified in advance in an automatic transaction device and an encryption key is decrypted by a master key encrypted by a host system connected to the automatic transaction device via a network.
PATENT LITERATURE 1: U.S. Pat. No. 6,705,517
When the configuration disclosed in the patent literature 1 is adopted between the ATM control unit and an internal device mounted inside of the ATM, encryption and decryption of communications between the ATM control unit and the internal device is realized by executing processing such that a secret key is specified in advance in the internal device and a communication encryption key that has been encrypted by the ATM control unit is decrypted by the secret key so as to ensure that the communication encryption key is only shared between the ATM control unit and the internal device.
However, in a case where encrypted communications are executed and in a case where communications with the internal device is to be protected for an automatic transaction device for which no encryption key is specified using an encrypted communication feature, when an external terminals (laptop PC, etc.) whose environment is configured to be identical to the overall control unit of the automatic transaction device is connected to the internal device of the automatic transaction device, then the encryption key necessary for encryption communications with the internal device is created by and saved on the side of the external terminal. The external terminals in which the encryption key is saved and the internal device of the currently operating automatic transaction device are interconnected, the external terminal is allowed to transmit an unauthorized command, which may lead to execution of unauthorized processing.
Particularly, when an encryption key is to be specified in an ATM installed in a place other than a place where security is physically guaranteed (a place with access management function), it is unrealistic in terms of man-hours, costs, and service stoppage period to transport the ATM to a place where the security is physically guaranteed to specify the key. As a consequence, it is necessary to specify the encryption key in the place where the ATM is installed.
In order to address the above-identified problem, safety and validity of the environment where an encryption key is to be generated needs to be guaranteed as a valid ATM. In view of the above, an object of the present invention is to guarantee safety and validity in generation of an encryption key necessary for encryption communications between the overall control unit and the internal device of the automatic transaction device.
In order to solve the above-identified problem, the present invention is an automatic transaction device comprising a first device mounted internally and a control unit configured to control devices, wherein transmission and reception of data are performed between the first device and the control unit. The first device is configured to execute a process of generating a first code relating to the first device and transmitting the first code to the control unit, and a process of performing verification of a second code received from the control unit and generating an encryption key in accordance with a result of the verification. The control unit is configured to execute a process of performing verification regarding the fact that an operation environment exists in the automatic transaction device after reception of the first code and a process of generating the second code and transmitting the second code to the first device in response to it having been determined that the operation environment exists in the automatic transaction device.
In accordance with the present invention, it is made possible to guarantee safety and validity in generation of the encryption key necessary for the encryption communications between the overall control unit and the internal device of the automatic transaction device. Particularly, it is made possible to ensure that unauthorized processing cannot be made from an external terminal by ensuring safety and validity in a case where an encryption key is to be newly specified for an automatic transaction device for which no encryption key is specified.
A technique called “challenge response authentication” is used as a mode of performing authentication regarding whether or not a communication partner is a valid partner. In this embodiment, a control unit (hereinafter referred to as “ATM control unit (AC)”) of an automatic transaction device (hereinafter referred to as “ATM”) carries out recognition of an environment of the ATM. Also, an internal device (DEV) specific to the ATM (hardware such as a banknote processing unit, a coin processing unit, a card reader, an encryption keypad, a receipt printer, a passbook printer, a journal printer, and a security camera) executes “challenge response authentication” between devices for the ATM control unit (AC). By virtue of the “challenge response authentication” between the devices, it is made possible to specify in advance a secret key, which is associated with the ATM control unit (AC), in the internal device (DEV) banknote processing unit. Thus, a communication encryption key that is encrypted by the ATM control unit (AC) is decrypted by the above secret key and it is thus made possible to allow only the ATM control unit (AC) and the internal device to share the above communication encryption key and perform encryption and decryption of the subsequent communications.
As typical “challenge response authentication” is authentication that can be realized by software and performed between a server and a device, authentication can be performed even when an authentication program is copied into an external terminal (for example, laptop PC) other than the ATM control unit (AC). In order to prevent authentication by the external terminal, the ATM control unit (AC) refers to a connection status of the internal device (DEV) and thereby carries out recognition of whether or not the operation environment is an environment in the ATM (environment recognition). More specifically, “challenge response authentication” between the devices will take place in contrast to typical “challenge response authentication.” In this state, the ATM control unit (AC) transmits a response code (DEV RS) and the internal device (DEV) carries out verification of this response code (DEV RS). By virtue of the challenge response authentication of this kind between the ATM control unit (AC) and the internal device (DEV), it is made possible to carry out verification of the fact that the connection environment of the internal device (DEV) exists in the ATM. It should be noted that, although explanations are provided in the context of a case where the banknote processing unit is used as the internal device (DEV) in accordance with this embodiment, the same or similar processing can be performed on other internal devices (the coin processing unit, the card reader, the encryption keypad, the receipt printer, the passbook printer, the journal printer, the security camera, or the like).
The first embodiment is described below with reference to
The ATM 101 is a device that carries out transactions such as deposit and withdrawal of cash through operation by a user. The financial transaction network 102 is, by way of example and not limited to, a local area network (LAN) or a wide area network (WAN). The host computer 103 is a computer connected to a plurality of the ATMs 101 and information regarding an account of the user of the ATM 101 and its balance and the like is recorded in the host computer 103.
An ATM transaction application 302 that controls the entire ATM transaction, two types of software, i.e., pieces of software 303 and 304 each associated with encryption processing, nine types of device control software, i.e., pieces of device control software 305 to 313, and a settings file 314 associated with settings of a software environment are stored in the program area 301.
The encryption key installer 303 is software that is associated with generation of an encryption key necessary for encryption communication between the ATM control unit (AC) 201 and the banknote processing unit 203 and configured to perform verification regarding whether or not a secure environment necessary for generation of an encryption key is realized in the ATM. It should be noted that the encryption key installer 303 may be part of functions of software for maintenance of the ATM. The encryption communication control software 304 is software that carries out encryption communications with the internal device using an encryption key generated or specified by the encryption key installer 303. The pieces of device control software 305 to 313 are software corresponding to one of the functions 202 to 210, respectively.
Two types of data, i.e., pieces of data 316 and 317 relating to the ATM control unit (AC) 201 and pieces of data 321 to 323 relating to the banknote processing unit 203, are stored in the data area 315.
The maintenance worker ID 316 is a piece of information (an identification code) for identifying a worker who specifies an encryption key in the ATM. The ATM serial number (ATM Ser. No.) 317 is a piece of information for identifying the individual ATM, which may include a production serial number assigned by a so-called production line or lines, an identification number given by a financial institution independently of the production serial number so as to identify the ATM, or the like.
The internal device (DEV) serial number (DEV Ser. No.) 321 is a piece of information for identifying the banknote processing unit 203, which may include a production serial number assigned by a so-called production line or lines, an identification number given by a maintenance company independently of the production serial number, and the like. In addition, the internal device (DEV) serial number (DEV Ser. No.) 321 is transmitted from the banknote processing unit 203.
The DEV challenge code 1 (DEV CH 1) 322 is a piece of data that is transmitted from the banknote processing unit 203 along with the internal device (DEV) serial number (DEV Ser. No.) 321 and used by the banknote processing unit 203 to carry out challenge response authentication for the ATM control unit (AC) 201.
The DEV response code 1 (DEV RS 1) 323 is generated by the encryption key installer 303 based on the DEV challenge code 1 (DEV CH 1) 322 using a predetermined one-way conversion algorithm. In addition, the DEV response code 1 (DEV RS 1) 323 is generated so as to verify the validity of the banknote processing unit 203 for the ATM control unit (AC) 201.
Pieces of firmware, i.e., internal device (DEV) control firmware 402 configured to control transportation of banknotes of the banknote processing unit 203 or the like, communication control firmware 403 for performing communications with the ATM control unit (AC) 201, encryption processing firmware 404 for carrying out encryption of the communications between the ATM control unit (AC) 201 and the banknote processing unit 203, are stored in the program area 401.
Three types of data, i.e., pieces of data 406 to 408 are stored in the data area 405. The internal device serial number (DEV Ser. No.) 406 is a piece of information for identification of the banknote processing unit 203. The DEV challenge code 1 (DEV CH 1) 407 is generated when the banknote processing unit 203 carries out the challenge response authentication so as to verify the validity of the ATM control unit (AC) 201.
The internal device serial number (DEV Ser. No.) 406 and the DEV challenge code 1 (DEV CH 1) 407 are both transmitted to the ATM control unit (AC) 201. The DEV response code 1 (DEV RS 1) 408 is a piece of data used in the above-mentioned challenge response authentication. The DEV response code 1 (DEV RS 1) 408 is generated by the banknote processing unit 203 which is the internal device (DEV). In addition, the DEV response code 1 (DEV RS 1) 408 is a piece of data that is to be compared to determine whether or not it agrees with the DEV response code 1 (DEV RS 1) 323 transmitted from the ATM control unit (AC) 201.
The flow of the entire processing in accordance with the first embodiment is described below with reference to
The internal device serial number (DEV Ser. No.) 406 and the DEV challenge code 1 (DEV CH 1) 407 are received by the ATM control unit (AC) 201, and the internal device (DEV) serial number (DEV Ser. No.) 321 and the DEV challenge code 1 (DEV CH 1) 322 in the data area 315 are respectively stored as well. Further, the internal device (DEV) serial number (DEV Ser. No.) 321 is registered in a log file such as an electronic journal as trace information regarding the encryption key generation. The encryption key generation status can be confirmed by referring to this log file when a problem such as encryption key leakage occurs. It is desirable that a security measure such as falsification prevention is implemented for this log file.
After that, the encryption key installer 303 carries out recognition of the environment of the ATM so as to perform verification regarding the fact that the environment in which the ATM control unit (AC) is operating exists not within an external terminal (typical laptop PC) but within the ATM 101 (S103). For example, it is determined whether or not the I/O control unit 202, the card reader 204, the encryption keypad 205 and the like, which are devices specific to the ATM 101, are connected to the ATM control unit (AC) 201. The determination is performed, for example, by the ATM application 302 confirming, for each device, a response to the effect that activation of a device has been instructed and the device in fact has been activated. In addition, in order to increase accuracy of the recognition of the environment of the ATM, whether or not each device is properly operating may be determined by referring to installed software, environment setting parameters, error statuses of the device in addition to the simple determination of whether or not each device is connected.
In addition, as an example of the recognition of the environment of the ATM, it is also possible to perform verification regarding whether or not the program and settings within the ATM control unit (AC) 201 are valid, for example, by using an electronic signature and/or a predetermined tool.
In the context of the recognition of the environment of the ATM of this kind, processing may be executed by using a management table 1500 for management of the connection states (startup status) of the devices and software statuses as illustrated in
At this point, in the process of the ATM being started, the connection states (startup statuses) of the individual devices are stored in advance in the management table 1500. In addition, in the course of the recognition of the environment of the ATM, the encryption key installer 302 refers to this table and confirms whether or not each device is normally started or whether or not the integrity of each piece of software has been verified.
The result of the recognition of the environment of the ATM is displayed on the maintenance display unit 212.
Pieces of data corresponding to the pieces of data 1504 to 1512 illustrated in
When the connection states (startup statuses) of the individual data are normal and pressing of the “Continue” key 1603 by the maintenance worker has been detected, the next step and the steps after that of the processing are executed. Meanwhile, when abnormal data has been detected, it is necessary to confirm the states of the relevant device or devices and software by the maintenance worker. After that, when the pressing of the “Retry” key 1604 by the maintenance worker has been detected, the environment recognition is executed again. Meanwhile, the processing is stopped when abnormal data has been detected and the pressing of the “Cancel” key 1605 by the maintenance worker has been detected. It is desirable that the “Continue” key 1603 is not to be displayed and the pressing of the “Continue” key 1603 is not to be detected when the abnormal data has been detected.
When the recognition of the environment of the ATM was not successful, the ATM control unit (AC) 201 determines that the environment is not a valid ATM environment and records the result of unsuccessful recognition of the environment of the ATM in the log file. It is desirable that this log file is protected against falsification by encryption or the like. After that, the ATM control unit (AC) 201 transmits data indicative of the fact that the environment is not a valid ATM environment to the banknote processing unit 203. The banknote processing unit 203 receives this data and records the fact that the environment is not a valid ATM environment. It is also possible to implement further security measures. For example, when the cumulative number of times of recording the fact that the environment is not a valid ATM environment or the number of times of consecutive recording of the fact that the environment is not a valid ATM environment has exceeded a predetermined value, it may be determined that an unauthorized access is made not from the ATM but from an external terminal (laptop PC or the like) to block the encryption key generation of the banknote processing unit 203.
When the recognition of the environment of the ATM has been successful, the DEV response code 1 (DEV RS 1) 323 is generated from the internal device (DEV) serial number (DEV Ser. No.) 321 and the DEV challenge code 1 (DEV CH 1) 322 (S104). The generated DEV response code 1 (DEV RS 1) 323 is transmitted to the banknote processing unit 203 (S105).
When the banknote processing unit 203 has received the DEV response code 1 (DEV RS 1) 323, the banknote processing unit 203 generates a DEV response code 1 (DEV RS 1) 408 from an internal device serial number (DEV Ser. No.) 406 and a DEV challenge code 1 (DEV CH 1) 407 using a predetermined conversion algorithm. Here, the “predetermined conversion algorithm” as used herein refers to a conversion algorithm that is identical to the conversion algorithm for generating the DEV response code 1 (DEV RS 1) 323 from the internal device (DEV) serial number (DEV Ser. No.) 321 and the DEV challenge code 1 (DEV CH 1) 322 of the ATM control unit (AC) 201.
Next, the banknote processing unit 203 performs verification regarding whether or not the received DEV response code 1 (DEV RS 1) 323 agrees with the generated DEV response code 1 (DEV RS 1) 408 (S106).
In this manner, the conversion algorithm in the banknote processing unit 203 is shared by the ATM control unit (AC) 201. As a result, whether or not the internal device serial number (DEV Ser. No.) 406 has been registered in the log file of the ATM control unit (AC) 201 is allowed to be confirmed on the side of the banknote processing unit 203 by verifying the agreement of the DEV response code 1 (DEV RS 1) 323 with the DEV response code 1 (DEV RS 1) 408. By virtue of this verification, the banknote processing unit 203 determines that the environment is a secure ATM operation environment and thereafter executes the encryption key generation processing when an encryption key generation command is subsequently received.
Here, it is also possible that an upper time limit may be specified for the period after the banknote processing unit 203 having determined that the environment is a secure ATM operation environment and until reception of the encryption key generation command. By specifying the time limit, the risk of any third party transmitting an encryption key generation command to the banknote processing unit 203 which is an internal device (DEV) and illegally generating an encryption key can be avoided even when the maintenance worker leaves the site while operating the AIM 101.
When the received DEV response code 1 (DEV RS 1) 323 does not agree with the generated DEV response code 1 (DEV RS 1) 408, then the banknote processing unit 203, determining that there is not an appropriate environment for generating an encryption key, rejects the processing even when an encryption key generation command is subsequently received. It should be noted that the processing may be executed again starting from the step S101 as long as the frequency of the disagreement of the DEV response code 1 (DEV RS 1) 323 with the DEV response code 1 (DEV RS 1) 408 does not exceed a predetermined number of times. In this case, when the disagreement occurs exceeding the predetermined number of times, then the banknote processing unit 203, determining that an unauthorized access is being made to the banknote processing unit 203, rejects the processing of the step S101 for a predetermined period of time. In addition, in addition to rejection of the processing, communications between the ATM control unit (AC) and the banknote processing unit 203 may be blocked.
In accordance with the first embodiment, the ATM control unit (AC), which is a communication partner that communicates with internal devices, carries out the environment recognition to recognize the fact that the operation environment of the software that generates the encryption key is not an environment existing in an external terminal but an environment existing in the ATM. More specifically, the ATM control unit (AC) refers to the connection status of the internal device and transmits the response code (DEV RS) thereto, and the internal device verifies it, and thus the connection environment of the internal device is verified. Thus, it is made possible to perform verification regarding the fact that the software that generates the encryption key does not operate on external terminals different than the ATM in a case where the encrypted communication is to be carried out or in a case where an encryption key is to be newly specified for the automatic transaction device for which no encryption key is specified.
In addition, even when the encryption key is internally generated inside of hardware using secure hardware such as a secure chip having tamper resistance, it is effective to confirm that the environment is a secure environment. When the encryption key is to be internally generated inside of the hardware, access control needs to be provided for sending an encryption key generation command. In that case, password authentication or the like is used in the access control. When leakage of the password occurs, for example, a secret key and a public key are generated inside of the hardware without any permission to do so and the public key may be unnecessarily taken out of the hardware. Thus, unintended extraction of the encryption key leads to vulnerability and accordingly security of the environment is important even in the case of hardware.
It should be noted in the context of this embodiment that the DEV response code 1 (DEV RS 1) 323 is generated in the step S104 from two pieces of information, i.e., the internal device (DEV) serial number (DEV Ser. No.) 321 and the DEV challenge code 1 (DEV CH 1) 322 in order to make it possible for the banknote processing unit 203 to perform verification regarding whether or not the internal device serial number (DEV Ser. No.) 406 has been recorded in the log file of the ATM control unit (AC) 201. However, if the registration of the ATM control unit (AC) 201 into the log file does not need to be confirmed by the banknote processing unit 203 through the response code verification of the step S106, then the DEV response code 1 (DEV RS 1) 323 may be generated in the step S104 from one single piece of information, i.e., the DEV challenge code 1 (DEV CH 1) 322. In that case, the verification in the step S106 will proceed in the same or similar manner such that the DEV response code 1 (DEV RS 1) 408 is generated from one single piece of information, i.e., the DEV challenge code 1 (DEV CH 1) 407.
In addition, this embodiment has been described based on the example where the DEV response code 1 (DEV RS 1) is verified by the internal device (DEV). Meanwhile, for example, when there is a possibility of an unauthorized internal device (DEV) being connected, then the response code may be generated and verified by the ATM control unit (AC).
In this case, as illustrated in
Although this embodiment has been described based on the example of challenge response authentication using the challenge code and the response code between the ATM control unit (AC) and the internal device (DEV), it should be noted that this embodiment may rely on other authentication schemes. For example, a scheme that relies on a one-time password (One Time PW) which is a password that can be used only once may be mentioned. Whilst there may be more than one one-time password scheme, one scheme is described with reference to
First, the internal device (DEV) refers to an embedded clock and obtains time data (S121). A one-time password (DEV One Time PW) is generated from the obtained time data using an appropriate algorithm (S122). After that, the internal device (DEV) transmits to the ATM control unit (AC) a request to transmit the AC one-time password (AC One Time PW) (S123).
The encryption key installer 303 of the ATM control unit (AC) carries out the recognition of the environment of the ATM on the basis of the same or similar procedure as that in the step S103 (S124). When the recognition of the environment of the ATM has been successful, the encryption key installer 303 refers to the clock embedded in the ATM control unit (AC) 201 and obtains the time data (AC time data) (S125). The encryption key installer 303 then generates the one-time password (AC One Time PW) from the obtained time data using the same algorithm as that of the internal device (DEV) (S126) and transmits the AC one-time password (AC One Time PW) to the internal device (DEV) (S127). The internal device (DEV) performs verification regarding whether or not the DEV one-time password (DEV One Time PW) and the AC one-time password (AC One Time PW) agree with each other (S128) and executes processing such as execution of the encryption key generation processing according to the result of the verification.
In this manner, it is made possible for the internal device (DEV) to authenticate the ATM control unit (AC) 201 by using the one-time password scheme using the shared time data.
A second embodiment is described below with reference to
For example, when an ATM is stored in a maintenance warehouse (in other words, when the ATM is not operating), pieces of software necessary for its operation can be copied onto the ATM control unit (AC), which makes it possible to generate an encryption key in this state. In this case, where the ATM is not operating, when the configuration of the software is changed and memory dump is performed in response to an encryption key being generated, then the encryption key is fraudulently acquired.
In order to prevent such an unauthorized action, it is necessary to make further verification of whether or not the ATM is currently operating in addition to the verification regarding the fact that the connection environment of the internal device (DEV) exists in the ATM (see the section (a)) which has been described in the context of the first embodiment. The fact that the ATM is connected to the host computer serves as a basis for determining that the ATM is currently operating. However, when an encryption key is to be specified into an ATM, the ATM is operated in a maintenance mode which is a mode different than the operation mode in which normal transactions are carried out. As a consequence, the ATM is often disconnected from the host computer, so that it is difficult to perform verification regarding the fact that the ATM is a currently operating ATM on the basis of the communication state between the ATM 101 and the host computer 103. For this reason, it is necessary to make a determination by means other than checking connection to the host computer 103 in order to determine that the ATM is a currently operating ATM.
In view of the above, as illustrated in the section (b), the following processing may be envisaged: The internal device (DEV) transmits information necessary for traceability of encryption key generation (the serial number of the internal device (DEV), the serial number of the ATM, date, worker ID, etc.) to the management server installed outside of the ATM and this information is stored by the management server. If unauthorized encryption key generation occurs, tracking of the person who made the fraudulent behavior can be achieved using this traceability information, which makes it possible to prevent unauthorized encryption key generation using an ATM that is not currently operated.
Whether or not the information necessary for the traceability of the encryption key generation has been successfully stored in the management server is verified by the internal device (DEV) using the challenge response authentication. For example, the management server generates a response code from the challenge code generated by the internal device and the information necessary for traceability using a predetermined conversion algorithm such as a one-way function. When the internal device (DEV) can correctly verify the response code transmitted from the management server, then it is made possible to confirm the fact that the information necessary for the traceability of the encryption key generation has been successfully registered in the management server.
In this manner, when verification is made by the internal device (DEV) regarding the fact that the information that is necessary in terms of traceability has been successfully registered in the management server, it is made possible to confirm, regardless of whether the maintenance mode is entered or not, the fact that the connection to the currently operating ATM is established.
In addition, it is necessary at the time of generation of an encryption key to perform verification regarding the fact that not only the internal device (DEV) but also the ATM control unit (AC) resides in the environment of a currently operating ATM. In view of the above, as illustrated in the section (c), a possible processing will be as follows: The ATM control unit (AC) also transmits the information necessary for the traceability of the encryption key generation to the management server installed outside of the ATM and this information is stored by the management server. In addition, verification regarding the fact that the information necessary for the traceability of the encryption key generation has been successfully stored in the management server is made by the ATM control unit (AC) using the challenge response authentication.
Combination of the concepts that have been described in the above sections (a) to (c) makes it possible to trance a problematic ATM by referring to history information registered in the authentication server in the event of illegal leakage of the encryption key, as a result of which it is made possible to prevent fraudulent behaviors caused by illegal encryption key generation. More specifically, it is made possible for the internal device to accurately perform verification regarding the fact that it is connected to the currently operating ATM using the information indicative of the fact that the ATM control units (AC) illustrated in the sections (a) and (c) are one and the same one and the management servers illustrated in the sections (b) and (c) are one and the same management server and the valid communication partners. In this embodiment, the configuration and processing to achieve (d) which is the concepts that have been described in the sections (a) to (c) is described in detail below.
Since the functional block diagram of the ATM 101 is the same as that of the first embodiment (see
Two types of data, i.e., pieces of data 316 to 320 associated with the ATM control unit (AC) 201 and pieces of data 321 to 325 associated with the internal device (DEV) are stored in the data area 315.
The time data 318 is a piece of data indicative of the time at which the data is transmitted to the management server 106. The maintenance worker ID 316 is an identification code to identify the worker who specifies the encryption key in the ATM. The ATM serial number (ATM Ser. No.) 317 is a piece of information for identifying individual ATMs, which may include a production serial number assigned by a so-called production line or lines, an identification number given by a financial institution independently of the production serial number so as to identify an ATM, or the like.
An AC challenge code (AC CH) 319 is generated to carry out the challenge response authentication when the ATM control unit (AC) 201 verifies the validity of the management server 106. More specifically, the AC challenge code (AC CH) 319 is generated for the ATM control unit (AC) 201 to authenticate the management server 106 and perform verification regarding whether or not the registered data for traceability has been successfully stored by the management server 106. An AC response code (AC RS) 320 is a piece of data that is used in the challenge response authentication and generated by the ATM control unit (AC) 201. In addition, the AC response code (AC RS) 320 is a piece of data that is to be compared to determine whether or not it agrees with the AC response code (AC RS) 711 transmitted from the management server 106 (see
An internal device (DEV) serial number (DEV Ser. No.) 321 is a piece of information for identifying the banknote processing unit 203, which may include a production serial number assigned by a so-called production line or lines, an identification number given by a maintenance company independently of the production serial number, and the like. In addition, the internal device (DEV) serial number (DEV Ser. No.) 321 is transmitted from the banknote processing unit 203 and transmitted to the management server 106 as part of the trace information of the encryption key generation.
A DEV challenge code 1 (DEV CH 1) 322 is a piece of data that is transmitted from the banknote processing unit 203 along with the internal device (DEV) serial number (DEV Ser. No.) 321 and used by the banknote processing unit 203 to carry out challenge response authentication for the ATM control unit (AC) 201. In addition, the DEV challenge code 1 (DEV CH 1) 322 is also used by the banknote processing unit 203 when the banknote processing unit 203 performs verification regarding the fact that the internal device (DEV) serial number (DEV Ser. No.) 321 has been successfully transmitted to the management server 106.
A DEV response code 1 (DEV RS 1) 323 is generated by the encryption key installer 303 based on a DEV response code 2 (DEV RS 2) 324, which will be described later, using a predetermined one-way conversion algorithm. In addition, the DEV response code 1 (DEV RS 1) 323 is generated so as to verify the validity of the banknote processing unit 203 for both of the ATM control unit (AC) 201 and the management server 106. Further, it is made possible by the DEV response code 1 (DEV RS 1) 323 to perform verification regarding the fact, as the encryption key trace information, that the internal device (DEV) serial number (DEV Ser. No.) 321 has been successfully delivered to the management server 106.
The DEV challenge code 2 (DEV CH 2) 324 is generated by the encryption key installer 303 through performing one-way conversion from the DEV challenge code 1 (DEV CH 1) 322. In addition, the DEV challenge code 2 (DEV CH 2) 324 is used by the banknote processing unit 203 when the validity of the management server 106 is verified, and transmitted to the management server 106 along with the internal device (DEV) serial number (DEV Ser. No.) 321. It should be noted that the data transmitted to the management server 106 is not limited to the above data but any data may be transmitted as long as it is data that contributes to tracing of the encryption key generation.
A DEV response code 2 (DEV RS 2) 325 is a response code generated by the management server 106. More specifically, the DEV response code 2 (DEV RS 2) 325 is generated on the management server 106 through appropriate one-way conversion from two pieces of data, i.e., the banknote processing unit production serial number 321 and the DEV challenge code 1 (DEV CH 1). The DEV response code 2 (DEV RS 2) 325 is generated by the banknote processing unit 203 to verify the validity of the management server 106.
The configuration of the programs and data stored in the memory unit in the banknote processing unit 203 are the same as those of the first embodiment (see
Four types of software, i.e., pieces of software 502 to 505 are stored in the program area 501. The communication control software 502 is software for performing communications via the wireless network 105. The data transmission software 503 is software for transmitting data to the management server 106, for example, short message or electronic mail software. The data input software 504 is software for inputting data displayed on the maintenance display unit 212 of the ATM 101 into the mobile terminal 104, for example, software for reading a two-dimensional code. The data display software 505 is software for converting the format of representation of data so as to input the information of the mobile terminal 104 to the ATM 101, for example, software for performing generation and indication of a bar code and/or a two-dimensional code.
Pieces of data to be transmitted to the management server 106 and pieces of data to be received from the management server 106 are stored in the data area 506. More specifically, pieces of data to be displayed on the maintenance display unit 212 of the ATM 101, loaded into the mobile terminal 104, and transmitted to the management server 106 and pieces of data to be received from the management server 106 and input to the ATM 101 are stored therein.
Specifically, eight types of data, i.e., the pieces of data 507 to 512, 601, and 602 are stored in the data area 506. The time data 507, the maintenance worker ID 508, the ATM serial number (ATM Ser. No.) 509, the internal device (DEV) serial number (DEV Ser. No.) 510, the AC challenge code (AC CH) 511, and the DEV challenge code 2 (DEV CH 2) 512 are pieces of data that correspond to the pieces of data 318, 316, 317, 321, 319, and 324 stored in the data area 315 of the ATM control unit (AC) 201, respectively. In addition, the AC response code (AC RS) 601 and the DEV response code 2 (DEV RS 2) 602 correspond to the pieces of data 320 and 325 stored in the data area 315 of the ATM control unit (AC) 201, respectively.
Two types of software, i.e., pieces of software 702 and 703 are stored in the program area 701. The ATM encryption key generation control software 702 is software for generating the AC response code (AC RS) and the DEV response code 2 (DEV RS 2) from the log management of the ATM encryption key generation, the received AC challenge code (AC CH), and the DEV challenge code 2 (DEV CH 2) and storing encryption key trace information in the storage unit 107. The communication control software 703 is software for performing communications with the mobile terminal 104 via the network 105.
Eight types of data, i.e., pieces of data 705 to 712 are stored in the data area 704 as data to be stored as a log. Among these pieces of data, the time data 705, the maintenance worker ID 706, the ATM serial number (ATM Ser. No.) 707, the internal device (DEV) serial number (DEV Ser. No.) 708, the AC challenge code (AC CH) 709, and the DEV challenge code 2 (DEV CH 2) 710 are pieces of data received from the mobile terminal 104 and correspond to the pieces of data 507 to 512, respectively.
The AC response code (AC RS) 711 is a piece of data generated by the ATM encryption key generation control software 702. When generating the AC response code (AC RS) 711, the ATM encryption key generation control software 702 executes appropriate one-way conversion processing (hash computation, etc.) using the time data 705, the maintenance worker ID 706, the ATM serial number (ATM Ser. No.) 707, and the AC challenge code (AC CH) 709 that have been input.
The DEV response code 2 (DEV RS 2) 712 is a piece of data generated by the ATM encryption key generation control software 702 in the same or similar manner as the AC response code (AC RS) 711. When generating the DEV response code 2 (DEV RS 2) 712, the ATM encryption key generation control software 702 executes appropriate one-way conversion processing (hash computation, etc.) using the internal device (DEV) serial number (DEV Ser. No.) 708 and the DEV challenge code 2 (DEV CH 2) 710 that have been input.
The flow of the overall processing in accordance with the second embodiment is described below with reference to
The processing steps S201 to S203 are the same or similar ones as the processing steps S101 to S103 in the first embodiment. Meanwhile, in the case of the second embodiment, it is also possible to confirm that the ATM is an ATM that is normally operating by making a determination by the ATM application 302 of whether or not the ATM 101 and the host computer 103 are interconnected via the financial transaction network 102. When an encryption key is to be specified in the ATM 101, it is necessary to activate the ATM 101 in the maintenance mode and stop providing normal transaction service. When the maintenance mode is entered, it is generally not possible to determine whether or not the ATM 101 and the host computer 103 are interconnected. In such a case, data including time such as an electronic journal included in the log data in the ATM 101 may be referred to for confirmation of the fact that the ATM is the one that is connected to the host computer 103 and normally operating.
The processing in the event of unsuccessful ATM environment recognition proceeds in the same or similar manner as in the first embodiment and accordingly explanation thereof is omitted.
When the recognition of the environment of the ATM has been successful, the AC challenge code (AC CH) 319 is generated using a predetermined random number generator (S204). After that, the DEV challenge code 2 (DEV CH 2) 324 is generated from the DEV challenge code 1 (DEV CH 1) 322 using a predetermined conversion algorithm (S205). It is assumed here that the conversion algorithm is shared by the ATM control unit (AC) 201 and the banknote processing unit 203. For example, the internal device serial number (DEV Ser. No.) 406, which is a piece of data transmitted from the banknote processing unit 203 to be registered in the management server 106, may be used as one of the inputs to the conversion algorithm.
After that, the maintenance worker ID 316, the ATM serial number (ATM Ser. No.) 317, the time data 318, the AC challenge code (AC CH) 319, the internal device (DEV) serial number (DEV Ser. No.) 321, and the DEV challenge code 2 (DEV CH 2) 324 are displayed on the maintenance display unit 212 as the data for management server authentication (S206).
An example of the authentication screen for the management server displayed on the maintenance display unit 212 is illustrated in
In addition, when it is difficult to read the two-dimensional code 1707 displayed on the maintenance display unit 212 using a reading device of the mobile terminal due to bad conditions such as outside light, then the processing may be continued by reading a two-dimensional code printed by a printer. In this case, when the “Print” key indicated in the element 1708 has been pressed, the two-dimensional code is printed using any one of the printing units implemented in the ATM. Further, the management server authentication data may be output to an external unit outside of the ATM 101 by wireless communication or the like.
The mobile terminal 104 confirms the fact that the management server authentication data has been input and stores the above-mentioned information in the pieces of data 507 to 512 in the data area 506 (S207). With regard to the input of the management server authentication data to the mobile terminal 104, code information displayed on the maintenance display unit 212 of the ATM 101 may be read, for example, by a bar code reader and/or a two-dimensional code reader when the data input software 504 includes these readers. An example of display of the authentication screen for the management server displayed on the display unit of the mobile terminal 104 is illustrated in
After that, when pressing of the “Transmit” key 1807 has been detected, the data transmission software 503 transmits the pieces of data 507 to 512 via the communication network 105 to the management server 106 (S208).
The management server 106 receives the pieces of data 507 to 512 transmitted from the mobile terminal 104 and stores them using the ATM encryption key generation control software 702 as the pieces of data 705 to 710 on the data area 704 (S209). After that, the ATM encryption key generation control software 702 generates the AC response code (AC RS) 711 from the time data 705, the maintenance worker ID 706, the ATM serial number (ATM Ser. No.) 707, and the AC challenge code (AC CH) 709 using a predetermined conversion algorithm. Likewise, the ATM encryption key generation control software 702 generates the DEV response code 2 (DEV RS 2) 712 from the internal device (DEV) serial number (DEV Ser. No.) 708 and the DEV challenge code 2 (DEV CH 2) 710 using a predetermined conversion algorithm (S210).
The predetermined conversion algorithm may be configured, for example, as a function that combines the challenge code (AC CH, DEV CH2) and other input data and subjecting the combination to a predetermined one-way conversion function to generate a response code. In this manner, the ATM control unit (AC) 201 verifying the response code and the banknote processing unit 203 are allowed to confirm the fact that the transmitted data has been successfully delivered to the management server 106 by using a conversion algorithm shared between the management server 106 and the ATM control unit (AC) 201 or between the management server 106 and the banknote processing unit 203 and including the challenge code and the other input data in the course of generation of the response code (AC RS, DEV RS 2).
The ATM encryption key generation control software 702 stores the data received from the mobile terminal 104 and the generated two types of response codes in the storage unit 107 as the encryption key generation log (trace information) illustrated in
When data identical to all or part of the pieces of data 507 to 512 transmitted from the mobile terminal 104 is repeatedly received by the management server 106 in a predetermined period of time while the processing steps S209 to S212 are executed, then it is determined that the an unauthorized access has been made to the management server 106, the ATM 101, or the banknote processing unit 203 and transmission of data to the mobile terminal 104 is stopped. More specifically, an upper limit is specified for the number of times of consecutive reception of the data identical to all or part of the pieces of data 507 to 512 transmitted from the mobile terminal 104 or the number of times of its reception in a predetermined period of time. When the upper limit has been exceeded, this fact is recorded in the storage unit 107 and a warning is issued for an administrator of the management server 106. Alternatively, it is also possible to include information indicative of the fact that an unauthorized access has been made in the AC response code (AC RS) 711 and the DEV response code 2 (DEV RS 2) 712. Thus, the ATM control unit (AC) 201 which has received the response code and the banknote processing unit 203 are allowed to determine that an unauthorized access has been made to the management server 106. As a result, it is made possible to determine that an appropriate ATM operation environment is not established (or it has been detected the ATM control unit (AC) and the banknote processing unit are subjected to an attack) to reject the subsequent encryption key generation processing.
When the mobile terminal 104 has received the AC response code (AC RS) 711 and the DEV response code 2 (DEV RS 2) 712, the mobile terminal 104 stores these response codes as the AC response code (AC RS) 601 and the DEV response code 2 (DEV RS 2) 602 of the data area 506 (S213). After that, the data display software 505 displays the (element) 601 and the DEV response code 2 (DEV RS 2) 602 on the display unit of the mobile terminal, for example, in the form of a bar code, a two-dimensional code, or a text (S214). An example of display of the response reception screen of the management server displayed on the display unit of the mobile terminal is illustrated in
The displayed bar code or two-dimensional code is read by the security camera 209, the text is entered by the maintenance worker through the maintenance keyboard 213, and the results are displayed on the maintenance display unit 212. An example of display of the response reception screen of the management server displayed on the maintenance display unit 212 is illustrated in
With regard to the response codes (AC RS, DEV RS 2) that have been sent from the management server, validity of the AC response code (AC RS) is verified by the ATM control unit (AC) 201. Specifically, when pressing of the “Verify” key 2004 has been detected, the encryption key installer 303 verifies validness of the AC response code (AC RS) 320 using the conversion algorithm identical to that which has been described in the context of the step S210 (S215). More specifically, it is verified whether or not the AC response code (AC RS) 320 which has been generated by inputting the pieces of data 316 to 319 into the conversion algorithm agrees with the AC response code 601 which has been received from the mobile terminal 104. Thus, the ATM control unit (AC) 201 is allowed to perform verification regarding the fact that the communication partner is the appropriate management server 106 and confirm the fact that the transmitted registered data has been successfully stored in the management server.
When they do not agree with each other, it is determined that failure in the communication of the mobile terminal 104 and/or erroneous operation by the maintenance worker have occurred so as to urge the maintenance worker to confirm the occurrence of the erroneous operation. As a result, when the AC response code (AC RS) 1901 and the DEV response code 2 (DEV RS 2) 1902 of the response reception screen of the management server of the mobile terminal 104 illustrated in
In addition, when the AC response code (AC RS) 601 cannot be obtained due to communication failure or the like, transition is made to a temporary encryption key generation state. More specifically, a mode is entered that generates an encryption key necessary for encryption communication between the ATM control unit (AC) 201 and the banknote processing unit 203 in the subsequent processing in the same or similar manner as in the case where the validity of the AC response code (AC RS) 320 is correctly verified. Meanwhile, it is necessary that a time to live (TTL) is specified for the generated encryption key and the appropriate AC response code (AC RS) 601 is input to the encryption key installer 303 during the TTL. When the appropriate AC response code (AC RS) 601 is not input during the TTL, then the generated encryption key becomes invalid and the encryption key installer 303 changes settings so that the encryption communication between the ATM control unit (AC) 201 and the banknote processing unit 203 is prohibited.
When the processing step S215 is completed, the encryption key installer 303 uses a predetermined conversion algorithm and generate a DEV response code 1 (DEV RS 1) 323 from the DEV response code 2 (DEV RS 2) 325 (S216). This conversion algorithm is shared by the ATM control unit (AC) 201 and the banknote processing unit 203. In addition, the conversion algorithms for generating the DEV response code 1 (DEV RS 1) 323 may be changed according to whether or not transition has been made to the above-described temporary encryption key generation state. In addition, the generated DEV response code 1 (DEV RS 1) 323 is transmitted to the banknote processing unit 203 (S217).
When the banknote processing unit 203 has received the DEV response code 1 (DEV RS 1) 323, the banknote processing unit 203 generates a DEV response code 1 (DEV RS 1) 408 from an internal device serial number (DEV Ser. No.) 406 and a DEV challenge code 1 (DEV CH 1) 407 using a predetermined conversion algorithm. In addition, the banknote processing unit 203 performs verification regarding whether or not the received DEV response code 1 (DEV RS 1) 323 agrees with the DEV response code 1 (DEV RS 1) 408 (S218).
Here, the “predetermined conversion algorithm” as used herein refers to an algorithm constituted by combining three conversion algorithms, i.e., (I) the conversion algorithm for generating the DEV challenge code 2 (DEV CH 2) 324 from the DEV challenge code 1 (DEV CH 1) 322 of the ATM control unit (AC) 201; (2) the conversion algorithm for generating the DEV response code 2 (DEV RS 2) 712 from the internal device (DEV) serial number (DEV Ser. No.) 708 and the DEV challenge code 2 (DEV CH 2) 710 in the management server 106; and (3) the conversion algorithm for generating the DEV response code 1 (DEV RS 1) 323 from the DEV response code 2 (DEV RS 2) 325 of the ATM control unit (AC) 201.
In this manner, the conversion algorithm of the banknote processing unit 203 is partly shared by the ATM control unit (AC) 201 and the management server 106. As a result, whether or not the internal device serial number (DEV Ser. No.) 406 has been registered in the storage unit 107 of the management server 106 via the ATM control unit (AC) 201 is allowed to be confirmed on the side of the banknote processing unit 203 by verifying the agreement of the DEV response code 1 (DEV RS 1) 323 with the DEV response code 1 (DEV RS 1) 408. By virtue of this agreement verification, the banknote processing unit 203 determines that the environment is a secure ATM operation environment and thereafter executes the encryption key generation processing when an encryption key generation command is subsequently received.
Here, it is also possible that an upper time limit may be specified for the period after the banknote processing unit 203 having determined that the environment is a secure ATM operation environment and until reception of the encryption key generation command. By specifying the time limit, the risk of any third party transmitting an encryption key generation command to the banknote processing unit 203 and generating an encryption key without authorization to do so can be avoided even when the maintenance worker leaves the site while operating the ATM.
When the DEV response code 1 (DEV RS 1) 323 and the DEV response code 1 (DEV RS 1) 408 do not agree with each other, then the banknote processing unit 203, determining that the regarding that the environment is not an environment appropriate for generation of the encryption key, rejects the processing even when an encryption key generation command is subsequently received. Alternatively, when it has been determined that failure occurred in the communications of the network 105 by the fact that (the elements represented by) 1901 and 1902 of the response reception screen of the management server of the mobile terminal 104 agree with (the elements represented by) 2001 and 2002 of the response reception screen of the management server of the ATM, respectively, or when it has been determined that erroneous operation by the maintenance worker has occurred, the processing step of S201 and the subsequent steps are executed again if the number of times of occurrence is below a predetermined number of times. When the predetermined number of times has been exceeded, then it is assumed that an unauthorized access has been made to the banknote processing unit 203, and re-execution of the processing of the step S201 and the subsequent steps is rejected for a predetermined period of time.
When the ATM control unit (AC) 201 is in the state of temporary encryption key generation, the DEV response code 1 (DEV RS 1) 323 is generated by a conversion algorithm in accordance with this state. As a consequence, the banknote processing unit 203 generates the DEV response code 1 (DEV RS 1) 408 using this conversion algorithm. In addition, the banknote processing unit 203 performs verification regarding whether or not the DEV response code 1 (DEV RS 1) 408 agrees with the DEV response code 1 (DEV RS 1) 323. If they agree with each other, the banknote processing unit 203 determines that the temporary encryption key generation state is entered and, after that, generates an encryption key in response to reception of the encryption key generation command.
When an unauthorized access to the management server 106 has been detected, then this information is included in the DEV response code 1 (DEV RS 1) 408. Accordingly, it is made possible to confirm occurrence of the unauthorized access to the management server 106 by the banknote processing unit 203 verifying presence or absence of this information. In that case, the banknote processing unit 203 determines that the environment is not an operation environment of an appropriate ATM (or it has been detected that the ATM control unit (AC) and/or the banknote processing unit are subjected to an attack) and rejects the encryption key generation processing for an indefinite period or a predetermined period of time even when an encryption key generation command is subsequently received.
This embodiment has been described on the premise that the management server (the management server illustrated in
Although this embodiment has been described on the premise that communications with the management server external to the ATM are performed, it should be noted that an encryption keypad inside of the ATM may be used in place of the management server. Since the encryption keypad has the function of performing communications with the host computer 103, whether or not this ATM is a currently operating ATM may be determined based on presence or absence of communications between the encryption keypad and the host.
In addition, although this embodiment has been described on the premise that the ATM 101 and the host computer 103 are often disconnected from each other in the maintenance mode, the ATM 101 and the host computer 103 may be interconnected.
In addition, although the automatic transaction system S2 that includes the mobile terminal 104 has been described in this embodiment, the automatic transaction system S3 may be configured as illustrated in
| Number | Date | Country | Kind |
|---|---|---|---|
| 2014-090861 | Apr 2014 | JP | national |
| Filing Document | Filing Date | Country | Kind |
|---|---|---|---|
| PCT/JP2015/062171 | 4/22/2015 | WO | 00 |
