The following invention is intended to be deployed in financial terminals or “datáfonos”, PIN pads and other split case devices for which security mechanisms are required in order to detect and respond to intrusion attempts in the interior of the device.
In the scope of practical application of the this invention, the following patents are known: U.S. Pat. Nos. 7,259,341, 7,388,484, 7,292,145, 7,170,403 y 4,599,498, related to security systems and detection of intrusion in split case devices. In this sense, the financial entities impose security requirements which the devices related to financial transactions such as PIN pads, payments terminals, etc., must fulfill, since this kind of devices are normally used in insecure environment.
Some security mechanisms that detect the opening of a split case device include a switch arrangement that operates in combination with a circuit board held by both split cases of the device. The mechanical force applied by the superior and inferior split case when they are closed maintains a conductive surface of the switch actuator pressed against adjacent conductive traces on the circuit board creating electrical contact between them. The conductive traces are normally connected to tamper detection electronics. When the split case is opened, the switch activator is released interrupting the electrical contact between the conductive traces of the circuit board which detected by an electronic circuit that triggers a terminal intrusion (tamper) response mechanism.
This tamper switch arrangement design does not protect against all attacks, such as those which include sliding a conductive member under the switch actuator with the purpose of maintaining the conducting state between the pads on the circuit board even when the switch actuator is not pressed against the circuit board and the split case is opened. As can be seen in
Even though the protection conductors contribute to the protection from attack described above, the result is not entirely satisfactory as it does not protect against attacks consisting in infusion or injection of conductive ink over the adjacent conductive traces on the circuit board maintaining the electrical connection between them even when the actuator of the intrusion detection switch is not pressed over the circuit board.
Some tamper switch implementations, as shown in
Other tamper switch arrangements, as for example in the solution provided in the U.S. Pat. No. 7,259,341, include an actuator with an open cylindrical portion in which is inserted an aligning pin of the back casing. In these cases it could be possible to access the contacts on the circuit board bellow the actuator by drilling through the casing, its aligning pin and the actuator and to inject a conductive material over the contacts on the circuit board, thereby defeating the tamper detection mechanism.
In other cases it is possible to exercise a compressing external force on a portion of the case on top of the switch to maintain the switch pressed, cut the casing around said portion and open the casing while the switch is maintained pressed.
In general, the current art tamper switch arrangements use two adjacent contacts on a circuit board, which participate in a tamper detection mechanism together with a two state switch. Since any attack that achieves to short-circuit the said adjacent contacts defeats the tamper detection mechanism, until now all efforts have been focused on protecting said adjacent contacts by additional electrical and mechanical measures, making the tamper detection switch arrangements complex, yet not sufficiently effective.
According to the present invention, a tamper switch arrangement based on a switch comprises an outer supporting tubular contact member with an electrically conducting surface at one end thereof; a intermediate tubular contact member provided interior and concentrically to the outer member, moveable within it and covered with electrically conducting material at one end thereof; and a center displaceable compressible resilient cylindrical contact member covered with an electrically conducting material at one end thereof, provided interior to and centered in the intermediate member and moveable together with the intermediate member within the outer member.
In yet a further aspect of the invention, an end of the center displaceable compressible resilient cylindrical contact member opposite the conducting surface is generally coplanar with an end of the intermediate tubular contact member opposite the conducting surface.
In yet a further aspect of the invention, the center member is of a length greater than the length of the intermediate displaceable tubular member; the end of the center displaceable member covered with conductive material projects out of the end of the intermediate tubular member covered with conductive material.
In yet a further aspect of the invention, the center cylindrical member and the intermediate tubular member are of an integral construction joined by means of connecting resilient ribs. The bottom surfaces of the ribs are covered with electrically conductive material and are joint with the conductive surfaces of the center member and the intermediate member, providing electrical connection between both surfaces.
The center cylindrical and intermediate tubular members are joined by an optional annular plane segment. As well, the two members are joint by optional ribs in the area between the annular plane segment and the coplanar ends of both members.
As well, the intermediate tubular contact member and the outer tubular supporting member are of an integral construction joined by means of connecting internal resilient ribs in a way that the conductive surface of the center cylindrical member does not reach the plane in which the conductive surface of the outer supporting member lays. The ribs provide spring bias for the intermediate and center members towards their non-conducting position. The bottom surfaces of the ribs are covered with electrically conductive material and are connect with the conductive surfaces of the exterior and intermediate members providing electrical connection between both surfaces.
According to another aspect of the invention, the outer tubular supporting member and the intermediate displaceable member are joined by radial ribs made of resilient material providing for the intermediate tubular member a spring bias towards the non-conducting position.
As well, the outer tubular supporting member and the intermediate displaceable members are joined by a web spring segment, providing a spring bias towards the non-conducting position of the intermediate member.
According to another aspect of the invention, the tamper switch arrangement is complemented by a metal flat disk with diameter equal to the external diameter of the intermediate tubular member positioned to the non-conductive side of the intermediate and the center members. The disk is situated in a region of the back casing which receives part of the tubular body of the intermediate member. The disk is made from a material with adequate strength so that to be difficult to damage, drill and penetrate.
With this arrangement, initial axial compression force applied on the coplanar ends of the intermediate member and the center member moves both members towards the conducting position of both members. The application of further compression force causes the adoption of conducting position of the center member and the displacement of the intermediate member towards its conducting position without having adopted yet the contact state. The tamper switch is in this state when the casing is assembled. Further increase of the force over the disk results in a compression of the cylindrical member and a conducting state of the intermediate tubular displaceable member. This switch state is caused by tampering attempts. As well, during initial separation of the casings the reduction of the axial force applied on the coplanar ends of the intermediate and the center members results in biasing of said members towards the non-conducting position due to the spring bias effect provided by the internal and external ribs joining the intermediate and the outer tubular members, as well as the annular bridge segment joining the said tubular members.
According to another aspect of the invention, the tamper switch is placed on top of outer, intermediate and center conductive contacts situated on the circuit board under a corresponding conductive surface of the cylindrical and tubular members of the tamper switch.
According to another aspect of the invention, the three conductive contacts are electrically isolated from each other. The center contact is situated inside the intermediate contact, and the intermediate inside the outer contact; preferably, the outer and the intermediate contacts are concentric ring pads and the center one is a circle area. The outer and center contacts are wired electrically to a tamper detection circuitry which triggers a tamper responsive mechanism if the electrical connection between the outer and the center contacts is broken. The intermediate contact is connected electrically to an input of another tamper detection circuitry which expects a continuous signal with a predetermined level. Any short-circuit between the intermediate contact and the center or the outer contacts triggers a tamper-responsive mechanism.
The above as well as other advantages and features of the present invention will be described in greater detail according to the preferred embodiments of the present invention in which:
The present invention consist in a tamper detection switch arrangement that provides more effective protection by an innovative disposition of three tamper detection conductors on the circuit board connected to two different tamper detection electronic circuitries and a tamper detection switch with a special design providing three different interconnections between said conductors in response to different tampering attacks. The special disposition of the contacts on the circuit board provides protection against different sophisticated attacks even without the cooperation of the tamper detection switch.
The proposed tamper switch arrangement not only detects more attacks, but at the same time is more cost effective, as it can manufactured and installed in a more simplified manner.
As shown in
As shown in
If the tamper detection switch adopts a state that creates a non-permitted electrical connection between the three contacts on the circuit board, a corresponding tamper detection electronic circuitry wired to the contacts 16, 17 and 18 on the circuit board 36 is activated and the terminal assumes a security breech has occurred, automatically initiating an appropriate electronic action of the tamper responsive mechanism.
As shown in
Preferably the tamper detection switch is of an integral construction, meaning of one piece, molded of resilient material.
The surfaces 7, 8 and 9 of the three members constitute an outer ring, an intermediate ring and a center circle and are covered with carbon conductive material for electrical engagement with the correspondent contacts on the circuit board.
The surface 38 of the center actuator 4 and the surface 14 of the displaceable tubular actuator 3 are preferably coplanar, so that an axial compressing force over the coplanar surfaces 38 and 14 is applied to both actuators at the same time. The length of actuator 4 is bigger than the length of actuator 3. The end of actuator 4, covered with conductive material, projects out from the end of the actuator 3, also covered with conductive material.
The tubular actuator 3 includes three internal resilient ribs 11 that serve to join and locate the cylindrical actuator 4 preferably in the center of the tubular actuator 3. The surfaces 42 of the ribs 11 are covered with electrically conductive material and are joined with the conductive surface 8 of the intermediate tubular actuator 3 and the conductive surface 9 of the center cylindrical actuator 4, providing electrical connection between them. Preferably, the displaceable tubular actuator 3 includes an optional annular plane segment 13 that serves to locate the actuator 4 in the center of the tubular actuator 3.
The optional ribs 15 join the actuators 3 and 4 in the area between the annular plane segment 13 and the plane defined by the coplanar ends of the actuators 3 and 4 to reinforce the straight disposition of the actuator 4 when an axial force is applied on its top surface 38.
The outer supporting member 2 includes three resilient internal ribs 10 that serve to join and center the intermediate tubular actuator 3 in a way that the conductive surface 9 of the center cylindrical member 4 does not reach the plane in which lays the conductive surface 7 of the outer supporting member 2.
The ribs 10 provide spring bias for the intermediate actuator 3 and the center actuator 4 towards their non-conducting position.
The surfaces 43 of the ribs 10 are covered with electrically conductive material and connect the conductive surface 7 of the supporting member 2 and the conductive surface 8 of the tubular actuator 3, providing electrical connection between them.
The supporting member 2 includes an optional resilient annular bridging segment 12 that serves to locate the intermediate actuator 3 and to provide a spring bias for the actuator 3 towards its non-conductive position.
The three optional external resilient ribs 5 join the outer member 2 with intermediate actuator member 3 and provide a spring bias for actuator 3 towards its non-conducting position.
As shown in
The tamper detection switch 1 is placed on top of outer, intermediate and center conductive contacts 16, 17 and 18 of the circuit board 36, which are placed under a corresponding conductive surface 7, 8 and 9 of the tubular members and the cylindrical member of the tamper detection switch.
The part of the tamper detection switch arrangement situated on the circuit board includes three conductive contacts, electrically isolated from each other, which could be traces or pads placed under the conductive surface of the tubular members and the cylindrical member of the tamper detection switch. Preferably, the outer and the intermediate contacts are concentric ring areas/pads and the center one is a circle area/pad. As shown in
The outer contact 16 and center contact 18, in a situation of normal use, are wired to a tamper detection circuitry which generates on the output a random signal variable between logical level ‘0’ and ‘1’ and expects to receive the same signal on the input. The interruption of the electrical connection between the contacts 16 and 18 is detected by a tamper detection electronic circuit connected to them, which triggers a tamper responsive mechanism.
The intermediate contact 17 is wired to an input of another tamper detection circuitry which expects to receive on this input a static signal with logical level ‘1’ and generates an alarm if the signal adopts a level corresponding to a logical level ‘0’.
As can be appreciated from the description of the operation of the tamper detection circuitries above, when there is an electrical connection between contacts 16 and 18, any short-circuit between contact 17 and any of the contacts 16 or 18 is detected by the tamper detection circuitry wired to contact 17, which triggers a tamper responsive mechanism of the terminal.
Both tamper detection electronic circuitries work even when the terminal is turned off, as they are maintained always powered by a separate back-up battery. In the preferred implementation both electronics circuitries are embedded in a specialized secure micro controller.
An important advantage of the special disposition and shape of the three conductive contacts, where the short-circuiting of the intermediate circle contact with any of the other two contacts activates a tamper responsive mechanism, is that it protects against attacks involving sliding of a conductive member over the contacts with no need of additional guard traces. Moreover, the special disposition and shape of the contacts 16, 17 and 18 protect against attacks involving infusion or injection of conductive liquid over said contacts with no need for complex, and ineffective measures for sealing the access to the interior of the switch.
With the current invention, each of the above mentioned attacks causes short-circuit between the intermediate contact 17 and contacts 16 or 18. As a result, the variable signal on contacts 16 and 18 is applied to the input of the tamper detection circuitry wired to contact 17, which triggers the corresponding tamper responsive mechanism of the terminal.
The particular construction of the circuit board can vary depending on the specific purpose. In the present implementation the circuit board 36 is multi-layer and, as shown in
Assembly of the tamper detection switch arrangement and the terminal is shown in
If further axial force is applied over the disk 31 as a result of a tampering attack, the resilient center actuator 4 compresses further, the intermediate tubular actuator 3 moves towards the circuit board and its conductive surface 8 electrically engages with the intermediate conductive contact 17 on the circuit board. This way, the conductive surfaces 7, 8 and 9 of the switch members 2, 3 and 4 of the switch are electrically engaged with the contacts 16, 17 and 18 on the circuit board. As the conductive surfaces 7, 8 and 9 of the tamper detection switch are connected electrically between them by the conductive surfaces 42 and 43 of the ribs 10 and 11 as shown on in
If the back casing of the terminal is separated, the axial compressing force applied to actuators 3 and 4 is reduced, the bias force provided by the internal ribs 10, the external ribs 5 and the bridge segment 12 moves the intermediate actuator 3, separating the center actuator 4 from the circuit board and disconnecting it from the center contact 18. This breaks the electrical connection between contacts 16 and 18, which is detected by the tamper detection circuitry connected to them activating a tamper responsive mechanism of the terminal.
With this arrangement, any tampering attempt to gain access to the interior of the switch by drilling through it is detected by the provided tamper switch arrangement. The same way are detected the attacks in which is applied a compressing external force on a portion of the case on top of the switch to maintain the switch pressed, meanwhile cutting the casing around in order to open the casing. As well, the attacks based on sliding, infusion or injection of conductive material over the conductive contacts of the circuit board, are detected.
Filing Document | Filing Date | Country | Kind | 371c Date |
---|---|---|---|---|
PCT/ES09/00276 | 5/20/2009 | WO | 00 | 12/15/2011 |