SECURITY SYSTEM FOR CASH HANDLING MACHINE

The invention provides a security system for preventing unauthorised dispensing of cash from a cash dispenser (5), the cash dispenser (5) being located inside a physically protected area (10) of a cash handling machine (1), the cash handling machine having a host controller (2) outside the physically protected area (10) configured to issue dispensing instructions to the cash dispenser (5) over a dispensing instruction data link (3), the security system comprising: an access permission device (11) located inside the physically protected area (10) configured and connected to receive verification signals over a verification data link (2, 3, 22) and to block transmission of dispensing instructions over the dispensing instruction data link (3) to the cash dispenser if the verification signals are not received or are received but are incorrect; and access permission software operatively associated with the host controller (2) configured to send the verification signals to the access permission device (11).

FIELD

The present invention relates to a system for securing cash handling machines against unauthorised operation of a cash dispenser. Cash handling machines include automated teller machines, but also any automatic machine which dispenses cash.

BACKGROUND

Attacks on automatic teller machines and other cash handling machines have become a multi billion dollar organised crime industry and a new high technology level of intrusion attempts now exists in response to the tightening of conventional security methods.

A recent round of attacks involves the hijacking of control signals passing between a host controller and the cash dispensing device, to effectively cause the dispensing of cash by an intruder at will from a cash handling machine.

There is therefore a need to provide a system for securing cash handling machines against hijacking of the above-mentioned control signals.

SUMMARY OF THE INVENTION

In accordance with a first broad aspect of the invention there is provided a security system for preventing unauthorised dispensing of cash from a cash dispenser, the cash dispenser being located inside a physically protected area of a cash handling machine, the cash handling machine having a host controller outside the physically protected area configured to issue dispensing instructions to the cash dispenser over a dispensing instruction data link, the security system comprising:

an access permission device located inside the physically protected area configured and connected to receive verification signals over a verification data link and to block transmission of dispensing instructions over the dispensing instruction data link to the cash dispenser if the verification signals are not received or are received but are incorrect; and

access permission software operatively associated with the host controller configured to send the verification signals to the access permission device.

In one embodiment, the security system is formed by installing the access permission device and the access permission software in a pre-existing cash handling machine, such that the access permission device is connected in line with the dispensing instruction data link between the host controller and the cash dispenser, and the access permission device performs the step of blocking instructions being transmitted over dispensing instruction data link by breaking the dispensing instruction data link.

In one embodiment, the verification data link and the dispensing instruction data link utilise a communications bus, and the access permission device is recognised by the host controller as a communications hub having at least two ports, with one port providing the verification data link and another port providing the dispensing instruction data link.

In one embodiment, the verification signals are derived using one or more encryption keys and the system is configured so that the one or more encryption keys can be remotely updated or replaced in the event of a security breach.

In one embodiment, the verification signals are sent periodically to the access permission device.

DETAILED DESCRIPTION OF EMBODIMENTS

An embodiment of the current invention will now be described.

Referring first toFIG. 1, a block diagram of a conventional cash handling machine1shows a host controller2which may be based on a personal computer or other computer-based control system communicating over a cash dispensing instruction data link3in the form of a USB cable to a cash dispenser controller4of a cash dispenser5adapted to dispense cash from cash drawers6,7,8,9. Cash dispenser5is disposed within a physically protected area defined by an intrusion resistant container10so that the only way of accessing cash is via an appropriate instruction received by cash dispenser controller4through a cash dispensing slot (not shown). Typically, host controller2is a master computer which, in addition to cash dispenser controller4, controls a user interface provided by a display, user input buttons including keypads, a printer, and a bank card reader.

Now referring toFIG. 2, which is a block diagram of the cash handling machine ofFIG. 1modified by installation of an access permission device11in accordance with an embodiment of the current invention, it can be seen that access permission device11is connected in line with the dispensing instruction data link3and located inside the protected area defined by the intrusion resistant container10

Now referring toFIG. 3, details of the access permission device11and its connections are shown. On installation in the pre-existing cash handling machine, a USB cable3which is originally connected as shown inFIG. 1between host controller2and cash dispenser controller4is disconnected from cash dispenser controller4and reconnected to a first USB connector30of the access permission device11. An additional USB cable50is then connected between a second USB connector31and cash dispenser controller4. Dispensing instructions data link passes through connection43through connector31when switch41is closed, allowing dispensing instructions to proceed from host controller2to cash dispenser controller4. When switch41is open, dispensing instructions are blocked. A microprocessor22and communications controller21are powered via power controller20from the USB power supply. Communications controller21is configured as a 2-port USB hub with one port connecting to the dispensing instruction data path via connection43and another port connecting to microprocessor via connection40. Ancillary connections to microprocessor22include status LEDs23, test switch24, external communications bus25, Digital output26and digital input27which together enable direct configuration and diagnosis if desired. Microprocessor22controls switch41through control line42.

In addition to the installation of access permission device11in the dispensing instruction data link path, adaptation of the conventional cash handling machine also involves addition of software modules in host controller2enabling operation and establishment of the verification data link, and further involves a modification of peripheral initialisation procedures which ensure that the verification data link is established before at least the cash dispenser controller4is recognised and initialised, otherwise switch41will be open and communications with cash dispensing controller4over the USB interface will fail.

There are many approaches and protocols which can be used and are well known in the art to establish and maintain a verification data link between two connected devices. The method of this embodiment involves identical encryption keys stored in memory on both host controller2and microprocessor22. The encryption key can be modified in the event of a security alert situation, such as may be presented by a detected intrusion attempt at one cash handling machine owned by the bank. This modification may be achieved by a central bank data processing centre loading down over a trusted secure communications link a new encryption key to host controller2. Host controller2then sends the encryption key over the USB interface to microprocessor22, ensuring that both devices share the same encryption key.

The verification data link operates by verification data signals between the host controller2and microprocessor22of access permission device11using the appropriate USB port number. In this embodiment, access permission device11periodically (typically once every30seconds or more frequently) initiates an authentication request by first producing a random number and sending the random number to host controller2over the verification data link. Host controller2transforms the random number using an encryption algorithm and the encryption key stored on host controller2and then sends the resulting transformed number back as a verification data signal to access permission device11over the verification data link. Microprocessor22then also transforms the random number previously generated using the same encryption algorithm and the encryption key stored on microprocessor22, and checks that the transformed number so calculated is the same as the transformed number received from host controller2. If the two numbers are not the same, or alternatively if no valid number is received from host controller2after a predefined interval, then the link is not verified and microprocessor22opens switch41to block communication over the dispensing instruction data link3,43,50. Conversely, if the two numbers are the same then the link is verified and microprocessor22closes switch41to allow communication over the dispensing instruction data link3,43,50.

As an alternative, in a variation of the above verification signal exchange the authorisation request could be initiated by the host controller2generating the random number and sending the random number and the transformed number as the verification data signal to the microprocessor22, which can then perform the same calculation on the random number to check that the transformed number sent by host controller2is the same.

Because the added access permission device is contained within the physically protected area and will only allow dispensing instructions to pass if the verification signals are received indicating connection of the host computer, an intruder will be unable to operate the cash dispenser by severing the USB cable3and attempting to send cash dispensing instructions to the cash dispenser5. Further in the embodiment shown above, a bank can retrofit an existing cash handling machine with the invention by the addition of the access permission device and software adjustments in the host controller.

Persons skilled in the art will also appreciate that many variations may be made to the invention without departing from the scope of the invention, which is determined from the broadest scope and claims.

For example, in its broadest aspect any method of providing a verification signal is contemplated, which may or may not include encryption keys, and the only fundamental requirement of the verification signal is that the signal effectively verifies connection of the host computer by sharing of a secret of some form between the access permission device and the host controller, which could be as simple as an unencrypted password. Many different such methods are known and a person skilled in the art will choose an appropriate method depending on the desired level of security.

Further, in other embodiments, the verification data link can be a separate physical data connection from the dispensing instruction data link, rather than passing over the same USB cable as in the embodiment above.

Further still, although in the embodiment described above the access permission software is contained within a software module in host controller2, the access permission software needs only to be operatively associated with host controller2and could be operated from a separate unit in the unprotected area outside or inside host controller2.

Also, the start-up and installations sequences and procedures described above are exemplary only.