Abstract:
A secure data entry device including a housing, tamper sensitive circuitry located within the housing and tampering alarm indication circuitry arranged to provide an alarm indication in response to attempted access to the tamper sensitive circuitry, the tampering alarm indication circuitry including at least one conductor, a signal generator operative to transmit a signal along the at least one conductor and a signal analyzer operative to receive the signal transmitted along the at least one conductor and to sense tampering with the at least one conductor, the signal analyzer being operative to sense the tampering by sensing changes in at least one of a rise time and a fall time of the signal.

Description:
FIELD OF THE INVENTION 
       [0001]    The present invention relates generally to secure keypad devices and more particularly to data entry devices having anti-tamper functionality. 
       BACKGROUND OF THE INVENTION 
       [0002]    The following patent publications are believed to represent the current state of the art: 
         [0003]    U.S. Pat. Nos. 5,506,566; 3,466,643; 3,735,353; 4,847,595 and 6,288,640; and 
         [0004]    G.B. Patent No.: GB892,198. 
       SUMMARY OF THE INVENTION 
       [0005]    The present invention seeks to provide improved secure keypad devices. 
         [0006]    There is thus provided in accordance with a preferred embodiment of the present invention a secure data entry device including a housing, tamper sensitive circuitry located within the housing and tampering alarm indication circuitry arranged to provide an alarm indication in response to attempted access to the tamper sensitive circuitry, the tampering alarm indication circuitry including at least one conductor, a signal generator operative to transmit a signal along the at least one conductor and a signal analyzer operative to receive the signal transmitted along the at least one conductor and to sense tampering with the at least one conductor, the signal analyzer being operative to sense the tampering by sensing changes in at least one of a rise time and a fall time of the signal. 
         [0007]    Preferably, the tamper sensitive circuitry is located within a protective enclosure within the housing and wherein the at least one conductor forms part of the protective enclosure. Additionally, at least part of the tampering alarm indication circuitry is located within the protective enclosure. 
         [0008]    In accordance with a preferred embodiment of the present invention the at least one of the rise time and the fall time is less than the order of a time normally required for the signal to traverse the conductor. 
         [0009]    Preferably, the at least one of the rise time and the fall time is less than a time normally required for the signal to traverse the conductor. Additionally, the at least one of the rise time and the fall time is less than one hundredth of the time normally required for the signal to traverse the conductor. 
         [0010]    In accordance with a preferred embodiment of the present invention the signal analyzer compares a reference signal with the signal transmitted along the conductor. Additionally, the signal analyzer also includes a reference signal memory, operative to provide the reference signal. 
         [0011]    Preferably, the signal analyzer includes an analog-to-digital converter and a digital signal comparator. Additionally, the reference signal is a Fast Fourier Transform (FFT) reference signal and the signal analyzer also includes a processor including FFT calculation functionality. Alternatively, the signal analyzer includes a digital-to-analog converter and an analog comparator. 
         [0012]    In accordance with a preferred embodiment of the present invention the signal generator is also operative to provide a signal timing input to the signal analyzer. 
         [0013]    Preferably, the at least one conductor includes a pair of conductors running in parallel to each other. Additionally, one of the pair of conductors is grounded. 
         [0014]    In accordance with a preferred embodiment of the present invention the at least one conductor is routed parallel to a ground plate. Additionally or alternatively, the at least one conductor includes multiple conductors of different lengths. 
         [0015]    Preferably, the at least one conductor is formed on a printed circuit substrate. Additionally or alternatively, the at least one conductor forms part of at least one of an integrated circuit and a hybrid circuit. 
         [0016]    In accordance with a preferred embodiment of the present invention the signal generator and the signal analyzer are located within a protective enclosure defined within a secure integrated circuit 
     
    
     
       BRIEF DESCRIPTION OF DRAWINGS 
         [0017]    The present invention will be understood and appreciated more fully from the following detailed description, taken in conjunction with the drawings in which: 
           [0018]      FIG. 1A  is a simplified partially pictorial, partially schematic illustration of a secure keypad device constructed and operative in accordance with a preferred embodiment of the present invention; 
           [0019]      FIG. 1B  is a simplified partially pictorial, partially schematic illustration of a secure keypad device constructed and operative in accordance with another preferred embodiment of the present invention; 
           [0020]      FIG. 1C  is a simplified partially pictorial, partially schematic illustration of a secure keypad device constructed and operative in accordance with yet another preferred embodiment of the present invention; 
           [0021]      FIG. 1D  is a simplified partially pictorial, partially schematic illustration of a secure keypad device constructed and operative in accordance with still another preferred embodiment of the present invention; 
           [0022]      FIG. 2  is a simplified partially pictorial, partially schematic illustration of the operation of the secure keypad device of  FIG. 1D  responsive to a first type of tampering; 
           [0023]      FIG. 3  is a simplified partially pictorial, partially schematic illustration of the operation of the secure keypad device of  FIG. 1D  responsive to a second type of tampering; 
           [0024]      FIG. 4  is a simplified partially pictorial, partially schematic illustration of the operation of the secure keypad device of  FIG. 1D  responsive to a third type of tampering; and 
           [0025]      FIG. 5  is a simplified partially pictorial, partially schematic illustration of the operation of the secure keypad device of  FIG. 1D  responsive to a fourth type of tampering. 
       
    
    
     DETAILED DESCRIPTION OF PREFERRED EMBODIMENTS 
       [0026]    Reference is now made to  FIG. 1A , which illustrates a secure keypad device  100  constructed and operative in accordance with a preferred embodiment of the present invention. 
         [0027]    As seen in  FIG. 1A , the secure keypad device  100  includes a housing, preferably including a top housing element  102  and a bottom housing element  104 . Top housing element  102  includes, on a top surface  106  thereof, a display window  108 , through which a display  109  may be viewed. An array  110  of keys  112  is engageable on top surface  106 . 
         [0028]    An anti-tampering grid  122 , preferably formed of a multiplicity of anti-tampering electrical conductors  124 , is preferably provided to define a protective enclosure within the housing. Alternatively or additionally, a protective enclosure may be defined within a secure integrated circuit  126 , which may be within or outside the protective enclosure defined by grid  122 . 
         [0029]    In accordance with a preferred embodiment of the present invention, there is provided one or more conductor  130  which interconnects a signal generator assembly  132  and a signal analysis assembly  134 , both of which are preferably located within the protective enclosure defined by grid  122  and may be located within a protective enclosure defined within secure integrated circuit  126 . In accordance with one embodiment of the invention, when multiple conductors  130  are employed, preferably their lengths differ significantly, so that time required for an electrical signal to pass therealong differs accordingly. Alternatively, this need not be the case. 
         [0030]    For the sake of clarity and simplicity of explanation, signal diagrams are provided in  FIGS. 1A-5 , all of which relate to an embodiment having a single conductor  130 . 
         [0031]    One or more conductor  130  may form part of anti-tampering grid  122  as one or more of conductors  124  and alternatively may not. Alternatively, one or more of conductors  130  may be formed on a rigid or flexible printed circuit substrate or form part of an integrated circuit or hybrid circuit. Signal generator assembly  132 , one or more conductor  130  and signal analysis assembly  134  together provide tampering detection functionality, as will be described hereinbelow in greater detail. 
         [0032]    It is appreciated that one or more conductor  130  may be a part of a pair of conductors extending in parallel to each other, wherein one of the conductors of the pair of conductors is grounded. Alternatively, one or more conductor  130  may not form part of a pair of conductors running in parallel to each other. It is also appreciated that the one or more conductor  130  may be routed parallel to a ground plate. Alternatively, the one or more conductor  130  is not routed parallel to a ground plate. 
         [0033]    It is a particular feature of the present invention that the tampering detection functionality senses signal variations which occur very quickly in response to tampering with one or more conductor  130  or its connection to either or both of assemblies  132  and  134 , typically within an elapsed time of approximately 100 ns and depending on the signal generator and comparator employed. These signal variations typically occur within an elapsed time which is less than 100 nanoseconds or even as short as 1 nanosecond. Preferably, the elapsed time during which tampering responsive signal variations take place is generally of the order of the time required for the signal to pass along the length of each conductor  130  or less. 
         [0034]    A preferred length of electrical conductor  130  is about 75 in. for a signal having a rise/fall time of approximately 10 nanoseconds (ns). The signal analysis assembly  134  preferably enables sensing tampering attempts in an electrical conductor  130  as short as 6 inches, wherein the signal has a rise/fall time of one nanosecond. The time required for an electrical signal to pass along a typical conductor  130  embodied in a conventional FR4 PCB is 140-180 picoseconds/inch (ps/in). 
         [0035]    In accordance with a preferred embodiment of the present invention, signal generator assembly  132  comprises a signal generator  150 , such as a Xilinx 7 Series FPGA, commercially available from Xilinx, Incorporated of San Jose, Calif., which outputs, via a Digital to Analog (D/A) converter  152 , such as a TI-DAC 5670, commercially available from Texas Instruments, operating at 2.4 Gigasamples/second, a signal typically having a rise time of the order of 10 ns and a duration of the order of 150 ns. This signal preferably is repeated every 1 ms. The time duration required for the signal to traverse a conductor  130 , here designated TD, is typically of the order of tens of nanoseconds. A simplified signal diagram illustrating the rise of the output of D/A converter  152  appears at A. In this simplified example, the signal rises nearly instantaneously to a voltage V 1 , typically 3 volts. 
         [0036]    The signal output of D/A converter  152  is applied to one or more conductor  130  via a resistor  154  and is supplied via the one or more conductor  130  to a junction C and thence to signal analysis assembly  134 , which also receives a signal timing input from signal generator assembly  132 . A simplified signal diagram illustrating the rise of a signal supplied from one conductor  130  to signal analysis assembly  134  appears as signal diagram C. It is seen that the rise of the signal at C is delayed from time 0 by time duration TD and, where the resistance of conductor  130  is generally equal to the resistance of resistor  154 , the resulting signal rises nearly instantaneously after delay TD to V 1  and includes harmonics about voltage V 1 . 
         [0037]    Signal analysis assembly  134  may be embodied in a number of different ways, three examples of which are described hereinbelow and shown in  FIG. 1A  as Examples I, II and III. 
         [0038]    In Example I, signal analysis assembly  134  preferably comprises an Analog to Digital (A/D) converter  160 , such as an ADC12D18-x00, commercially available from National Semiconductor, which operates at 3.6 Giga samples per second, which receives a signal at junction C from one or more conductor  130  and supplies it to a signal comparator  162 , such as a NL27WZ86, commercially available from On-Semi, Phoenix Ariz., USA. Comparator  162  also receives a reference signal C from a reference signal memory  164 , which reference signal represents the signal at C in the absence of tampering. Should the signal received from one or more conductor  130  not match the reference signal in the signal reference memory  164  within predetermined tolerances, a tampering alarm indication is provided by the comparator  162 . 
         [0039]    In a non-tampered situation, reference signal C is identical to the input received by comparator  162  from A/D converter  160  and no alarm indication is provided. 
         [0040]    In Example II, signal analysis assembly  134  preferably comprises a microprocessor  170 , such as a TMS320C6X commercially available from Texas Instruments, which receives the signal at junction C via an A/D converter  172 . The input from A/D converter  172  is supplied to Fast Fourier Transform (FFT) calculation functionality  174  of microprocessor  170 . An FFT calculation result is supplied by FFT calculation functionality  174  to signal comparator functionality  176  of microprocessor  170 . Comparator functionality  176  also receives a reference signal C from a FFT reference memory  178 , which FFT reference represents the signal at C in the absence of tampering. Should the FFT calculation result representing the signal received from one or more conductor  130  not match the FFT reference signal in the FFT reference memory  178  within predetermined tolerances, a tampering alarm indication is provided by the microprocessor  170 . 
         [0041]    In a non-tampered situation, the FFT reference stored in FFT reference memory  178  is identical to the input received by comparator functionality  176  from FFT calculation functionality  174  and no alarm indication is provided. 
         [0042]    In Example III, signal analysis assembly  134  preferably comprises an analog comparator  180 , such as a ADA4960-1 differential amplifier, commercially available from Analog Devices, which receives an analog signal at junction C from one or more conductor  130 . Comparator  180  also receives a reference signal C from a reference signal memory  182  via a D/A converter  184 , such as a TI-DAC 5670, commercially available from Texas Instruments, operating at 2.4 Gigasamples/second, which reference signal represents the signal at C in the absence of tampering. Should the signal received from one or more conductor  130  not match the reference signal in the signal reference memory  182  within predetermined tolerances, a tampering alarm indication is provided by the comparator  180 . 
         [0043]    In a non-tampered situation, reference signal C is identical to the input received by comparator  180  and no alarm indication is provided. 
         [0044]    It is appreciated that the operation of signal generator assembly  132  and of signal analysis assembly  134  preferably takes place continuously whether or not the secured keypad device is being used and whether or not it is in operation. 
         [0045]    It is appreciated that any suitable signal having a fast rise or fall may be employed. Although a square wave signal is illustrated, it is appreciated that the signal need not be a square wave. Different signal configurations may be employed at different times. 
         [0046]    Reference is now made to  FIG. 1B , which illustrates a secure keypad device  200  constructed and operative in accordance with another preferred embodiment of the present invention. 
         [0047]    As seen in  FIG. 1B , the secure keypad device  200  includes a housing, preferably including a top housing element  202  and a bottom housing element  204 . Top housing element  202  includes, on a top surface  206  thereof, a display window  208 , through which a display  209  may be viewed. An array  210  of keys  212  is engageable on top surface  206 . 
         [0048]    An anti-tampering grid  222 , preferably formed of a multiplicity of anti-tampering electrical conductors  224 , is preferably provided to define a protective enclosure within the housing. Alternatively or additionally, a protective enclosure may be defined within a secure integrated circuit  226 , which may be within or outside the protective enclosure defined by grid  222 . 
         [0049]    In accordance with a preferred embodiment of the present invention, there is provided one or more conductor  230  which interconnects a signal generator assembly  232  and a signal analysis assembly  234 , both of which are preferably located within the protective enclosure defined by grid  222  and may be located within a protective enclosure defined within secure integrated circuit  226 . In accordance with one embodiment of the invention, when multiple conductors  230  are employed, preferably their lengths differ significantly, so that time required for an electrical signal to pass therealong differs accordingly. Alternatively, this need not be the case. 
         [0050]    One or more conductor  230  may form part of anti-tampering grid  222  as one or more of conductors  224  and alternatively may not. Alternatively, one or more of conductors  230  may be formed on a rigid or flexible printed circuit substrate or form part of an integrated circuit or hybrid circuit. Signal generator assembly  232 , one or more conductor  230  and signal analysis assembly  234  together provide tampering detection functionality, as will be described hereinbelow in greater detail. 
         [0051]    It is appreciated that one or more conductor  230  may be a part of a pair of conductors extending in parallel to each other, wherein one of the conductors of the pair of conductors is grounded. Alternatively, one or more conductor  230  may not form part of a pair of conductors running in parallel to each other. It is also appreciated that the one or more conductor  230  may be routed parallel to a ground plate. Alternatively, the one or more conductor  230  is not routed parallel to a ground plate. 
         [0052]    It is a particular feature of the present invention that the tampering detection functionality senses signal variations which occur very quickly in response to tampering with one or more conductor  230  or its connection to either or both of assemblies  232  and  234 , typically within an elapsed time of approximately 100 ns and depending on the signal generator and comparator employed. These signal variations typically occur within an elapsed time which is less than 100 nanoseconds or even as short as 1 nanosecond. Preferably, the elapsed time during which tampering responsive signal variations take place is generally of the order of the time required for the signal to pass along the length of each conductor  230  or less. 
         [0053]    A preferred length of electrical conductor  230  is about 75 in. for a signal having a rise/fall time of approximately 10 ns. The signal analysis assembly  234  preferably enables sensing tampering attempts in an electrical conductor  230  as short as 6 inches, wherein the signal has a rise/fall time of a few nanoseconds. The time required for an electrical signal to pass along a typical conductor  230  embodied in a conventional FR4 PCB is 140-180 ps/in. 
         [0054]    In accordance with a preferred embodiment of the present invention, signal generator assembly  232  comprises a signal generator  250 , such as a Xilinx 7 Series FPGA, commercially available from Xilinx, Incorporated of San Jose, Calif., which outputs, via a D/A converter  252 , such as a TI-DAC 5670, commercially available from Texas Instruments, operating at 2.4 Gigasamples/second, a signal typically having a rise time of the order of 10 ns and a duration of the order of 150 ns. This signal preferably is repeated every 1 ms. The time duration required for the signal to traverse a conductor  230 , here designated TD, is typically of the order of tens of nanoseconds. A simplified signal diagram illustrating the rise of the output of D/A converter  252  appears at A. In this simplified example, the signal rises nearly instantaneously to a voltage V 1 , typically 3 volts. 
         [0055]    The signal output of D/A converter  252  is applied to one or more conductor  230  via a resistor  254 . The signal passes along one or more conductor  230  and is reflected back along one or more conductor  230  to a junction between the one or more conductor  230  and resistor  254 , designated B. This signal is supplied to signal analysis assembly  234 , which also receives a signal timing input from signal generator assembly  232 . 
         [0056]    A simplified signal diagram illustrating the rise of the signal supplied from junction B to signal analysis assembly  234  appears as signal diagram B. It is seen that the signal at B rises generally instantaneously to a voltage of approximately 0.5V 1  and includes harmonics about voltage 0.5V 1 . Following a time duration  2 TD, which corresponds to two traversals of one or more conductor  230 , the signal rises generally instantaneously to voltage V 1  and includes harmonics about voltage V 1 . 
         [0057]    Signal analysis assembly  234  may be embodied in a number of different ways, three examples of which are described hereinbelow and shown in  FIG. 1B  as Examples I, II and III. 
         [0058]    In Example I, signal analysis assembly  234  preferably comprises an A/D converter  260 , such as an ADC12D1800, commercially available from National Semiconductor, which operates at 3.6 Giga samples per second, which receives a signal at junction B from one or more conductor  230  and supplies it to a signal comparator  262 , such as a NL27WZ86, commercially available from On-Semi, Phoenix Ariz., USA. Comparator  262  also receives a reference signal B from a reference signal memory  264 , which reference signal represents the signal at B in the absence of tampering. Should the signal received from one or more conductor  230  not match the reference signal in the signal reference memory  264  within predetermined tolerances, a tampering alarm indication is provided by the comparator  262 . 
         [0059]    In a non-tampered situation, reference signal B is identical to the input received by comparator  262  from A/D converter  260  and no alarm indication is provided. 
         [0060]    In Example II, signal analysis assembly  234  preferably comprises a microprocessor  270 , such as a TMS320C6X commercially available from Texas Instruments, which receives the signal at junction B via an A/D converter  272 . The input from A/D converter  272  is supplied to Fast Fourier Transform (FFT) calculation functionality  274  of microprocessor  270 . An FFT calculation result is supplied by FFT calculation functionality  274  to signal comparator functionality  276  of microprocessor  270 . Comparator functionality  276  also receives a reference signal B from a FFT reference memory  278 , which FFT reference represents the signal at B in the absence of tampering. Should the FFT calculation result representing the signal received from one or more conductor  230  not match the FFT reference signal in the FFT reference memory  278  within predetermined tolerances, a tampering alarm indication is provided by the microprocessor  270 . 
         [0061]    In a non-tampered situation, the FFT reference is identical to the input received by comparator functionality  276  from FFT calculation functionality  274  and no alarm indication is provided. 
         [0062]    In Example III, signal analysis assembly  234  preferably comprises an analog comparator  280 , such as an ADA4960-1 differential amplifier, commercially available from Analog Devices, which receives an analog signal at junction B from one or more conductor  230 . Comparator  280  also receives a reference signal B from a reference signal memory  282  via a D/A converter  284 , such as a TI-DAC 5670, commercially available from Texas Instruments, operating at 2.4 Gigasamples/second, which reference signal represents the signal at B in the absence of tampering. Should the signal received from one or more conductor  230  not match the reference signal in the signal reference memory  282  within predetermined tolerances, a tampering alarm indication is provided by the comparator  280 . 
         [0063]    In a non-tampered situation, reference signal B is identical to the input received by comparator  280  and no alarm indication is provided. 
         [0064]    It is appreciated that the operation of signal generator assembly  232  and of signal analysis assembly  234  preferably takes place continuously whether or not the secured keypad device is being used and whether or not it is in operation. 
         [0065]    It is appreciated that any suitable signal having a fast rise or fall may be employed. Although a square wave signal is illustrated, it is appreciated that the signal need not be a square wave. Different signal configurations may be employed at different times. 
         [0066]    Reference is now made to  FIG. 1C , which illustrates a secure keypad device  300  constructed and operative in accordance with yet another preferred embodiment of the present invention. 
         [0067]    As seen in  FIG. 1C , the secure keypad device  300  includes a housing, preferably including a top housing element  302  and a bottom housing element  304 . Top housing element  302  includes, on a top surface  306  thereof, a display window  308 , through which a display  309  may be viewed. An array  310  of keys  312  is engageable on top surface  306 . 
         [0068]    An anti-tampering grid  322 , preferably formed of a multiplicity of anti-tampering electrical conductors  324 , is preferably provided to define a protective enclosure within the housing. Alternatively or additionally, a protective enclosure may be defined within a secure integrated circuit  326 , which may be within or outside the protective enclosure defined by grid  322 . 
         [0069]    In accordance with a preferred embodiment of the present invention, there is provided one or more conductor  330  which interconnects a signal generator assembly  332  and a signal analysis assembly  334 , both of which are preferably located within the protective enclosure defined by grid  322  and may be located within a protective enclosure defined within secure integrated circuit  326 . In accordance with one embodiment of the invention, when multiple conductors  330  are employed, preferably their lengths differ significantly, so that time required for an electrical signal to pass therealong differs accordingly. Alternatively, this need not be the case. 
         [0070]    One or more conductor  330  may form part of anti-tampering grid  322  as one or more of conductors  324  and alternatively may not. Alternatively, one or more of conductors  330  may be formed on a rigid or flexible printed circuit substrate or form part of an integrated circuit or hybrid circuit. Signal generator assembly  332 , one or more conductor  330  and signal analysis assembly  334  together provide tampering detection functionality, as will be described hereinbelow in greater detail. 
         [0071]    It is appreciated that one or more conductor  330  may be a part of a pair of conductors extending in parallel to each other, wherein one of the conductors of the pair of conductors is grounded. Alternatively, one or more conductor  330  may not form part of a pair of conductors running in parallel to each other. It is also appreciated that the one or more conductor  330  may be routed parallel to a ground plate. Alternatively, the one or more conductor  330  is not routed parallel to a ground plate. 
         [0072]    It is a particular feature of the present invention that the tampering detection functionality senses signal variations which occur very quickly in response to tampering with one or more conductor  330  or its connection to either or both of assemblies  332  and  334 , typically within an elapsed time of approximately 100 ns and depending on the signal generator and comparator employed. These signal variations typically occur within an elapsed time which is less than 100 nanoseconds or even as short as 1 nanosecond. Preferably, the elapsed time during which tampering responsive signal variations take place is generally of the order of the time required for the signal to pass along the length of each conductor  330  or less. 
         [0073]    A preferred length of electrical conductor  330  is about 75 in. for a signal having a rise/fall time of approximately 10 ns. The signal analysis assembly  334  preferably enables sensing tampering attempts in an electrical conductor  330  as short as 6 inches, wherein the signal has a rise/fall time of a few nanoseconds. The time required for an electrical signal to pass along a typical conductor  330  embodied in a conventional FR4 PCB is 140-180 ps/in. 
         [0074]    In accordance with a preferred embodiment of the present invention, signal generator assembly  332  comprises a signal generator  350 , such as a Xilinx 7 Series FPGA, commercially available from Xilinx, Incorporated of San Jose, Calif., which outputs, via a D/A converter  352 , such as a TI-DAC 5670, commercially available from Texas Instruments, operating at 2.4 Gigasamples/second, a signal typically having a rise time of the order of 10 ns and a duration of the order of 150 ns. This signal preferably is repeated every 1 ms. The time duration required for the signal to traverse a conductor  330 , here designated TD, is typically of the order of tens of nanoseconds. A simplified signal diagram illustrating the rise of the output of D/A converter  352  appears at A. In this simplified example, the signal rises nearly instantaneously to a voltage V 1 , typically 3 volts. 
         [0075]    The signal output of D/A converter  352  is applied to one or more conductor  330  via a resistor  354  and is supplied via the one or more conductor  330  to a junction C and thence to a signal analysis subassembly  355  of signal analysis assembly  334 , which also receives a signal timing input from signal generator assembly  332 . 
         [0076]    A simplified signal diagram illustrating the rise of a signal supplied from one conductor  330  to signal analysis assembly  334  appears as signal diagram C. It is seen that the rise of the signal at C is delayed from time 0 by time duration TD and, where the resistance of conductor  330  is generally equal to the resistance of resistor  354 , the resulting signal rises nearly instantaneously after delay TD to V 1  and includes harmonics about voltage V 1 . 
         [0077]    In this embodiment the signal passes along conductor  330  and a portion thereof is reflected back along conductor  330  to a junction between the conductor  330  and resistor  354 , designated B. A signal from junction B is supplied to a signal analysis subassembly  356  of signal analysis assembly  334 , which also receives a signal timing input from signal generator assembly  332 . 
         [0078]    A simplified signal diagram illustrating the rise of the signal supplied from junction B to signal analysis subassembly  356  appears as signal diagram B. It is seen that the signal at B rises generally instantaneously to a voltage of approximately 0.5V 1  and includes harmonics about voltage 0.5V 1 . Following a time duration  2 TD, which corresponds to two traversals of conductor  330 , the signal rises generally instantaneously to voltage V 1  and includes harmonics about voltage V 1 . 
         [0079]    Each of subassemblies  355  and  356  of signal analysis assembly  334  may be embodied in a number of different ways, three examples of which are described hereinbelow and shown in  FIG. 1C  as Examples I, II and III. 
         [0080]    In Example I, one or both of subassemblies  355  and  356  of signal analysis assembly  334  preferably comprises an A/D converter  360 , such as an ADC112D1800, commercially available from National Semiconductor, which operates at 3.6 Giga samples per second, which receives a signal at junction C or junction B, respectively, from one or more conductor  330  and supplies it to a signal comparator  362 , such as a NL27WZ86, commercially available from On-Semi, Phoenix Ariz., USA. Comparator  362  also receives a reference signal C or a reference signal B from a reference signal memory  364 , which reference signal represents the signal at C or B, respectively, in the absence of tampering. Should the signal received from one or more conductor  330  not match the reference signal in the signal reference memory  364  within predetermined tolerances, a tampering alarm indication is provided by the comparator  362 . 
         [0081]    In a non-tampered situation, reference signal C or reference signal B is identical to the input received by comparator  362  from A/D converter  360  and no alarm indication is provided. 
         [0082]    In Example II, one or both of subassemblies  355  and  356  of signal analysis assembly  334  preferably comprises a microprocessor  370 , such as a TMS320C6X commercially available from Texas Instruments, which receives the signal at junction C or junction B via an A/D converter  372 . The input from A/D converter  372  is supplied to Fast Fourier Transform (FFT) calculation functionality  374  of microprocessor  370 . An FFT calculation result is supplied by FFT calculation functionality  374  to signal comparator functionality  376  of microprocessor  370 . Comparator functionality  376  also receives a reference signal C or a reference signal B from a FFT reference memory  378 , which FFT reference represents the signal at C or B, respectively, in the absence of tampering. Should the FFT calculation result representing the signal received from one or more conductor  330  not match the FFT reference signal in the FFT reference memory  378  within predetermined tolerances, a tampering alarm indication is provided by the microprocessor  370 . 
         [0083]    In a non-tampered situation, the FFT reference is identical to the input received by comparator functionality  376  from FFT calculation functionality  374  and no alarm indication is provided. 
         [0084]    In Example III, one or both of subassemblies  355  and  356  of signal analysis assembly  334  preferably comprises an analog comparator  380 , such as an ADA4960-1 differential amplifier, commercially available from Analog Devices, which receives an analog signal at junction C or junction B, respectively, from one or more conductor  330 . Comparator  380  also receives a reference signal C or a reference signal B from a reference signal memory  382  via a D/A converter  384 , such as a TI-DAC 5670, commercially available from Texas Instruments, operating at 2.4 Gigasamples/second, which reference signal represents the signal at C or B, respectively, in the absence of tampering. Should the signal received from one or more conductor  330  not match the reference signal in the signal reference memory  382  within predetermined tolerances, a tampering alarm indication is provided by the comparator  380 . 
         [0085]    In a non-tampered situation, reference signal C or reference B is identical to the input received by comparator  380  and no alarm indication is provided. 
         [0086]    The alarm indications from respective signal analysis subassemblies  355  and  356  are preferably supplied to alarm logic  390 , which may provide an alarm output in response to any suitable combination of alarm indications. 
         [0087]    It is appreciated that the operation of signal generator assembly  332  and of signal analysis assembly  334  preferably takes place continuously whether or not the secured keypad device is being used and whether or not it is in operation. 
         [0088]    It is appreciated that any suitable signal having a fast rise or fall may be employed. Although a square wave signal is illustrated, it is appreciated that the signal need not be a square wave. Different signal configurations may be employed at different times. 
         [0089]    Reference is now made to  FIG. 1D , which illustrates a secure keypad device  400  constructed and operative in accordance with still another preferred embodiment of the present invention. 
         [0090]    As seen in  FIG. 1D , the secure keypad device  400  includes a housing, preferably including a top housing element  402  and a bottom housing element  404 . Top housing element  402  includes, on a top surface  406  thereof, a display window  408 , through which a display  409  may be viewed. An array  410  of keys  412  is engageable on top surface  406 . 
         [0091]    An anti-tampering grid  422 , preferably formed of a multiplicity of anti-tampering electrical conductors  424 , is preferably provided to define a protective enclosure within the housing. Alternatively or additionally, a protective enclosure may be defined within a secure integrated circuit  426 , which may be within or outside the protective enclosure defined by grid  422 . 
         [0092]    In accordance with a preferred embodiment of the present invention, there is provided one or more conductor  430  which interconnects a signal generator assembly  432  and a signal analysis assembly  434 , both of which are preferably located within the protective enclosure defined by grid  422  and may be located within a protective enclosure defined within secure integrated circuit  426 . In accordance with one embodiment of the invention, when multiple conductors  430  are employed, preferably their lengths differ significantly, so that time required for an electrical signal to pass therealong differs accordingly. Alternatively, this need not be the case. 
         [0093]    One or more conductor  430  may form part of anti-tampering grid  422  as one or more of conductors  424  and alternatively may not. Alternatively, one or more of conductors  430  may be formed on a rigid or flexible printed circuit substrate or form part of an integrated circuit or hybrid circuit. Signal generator assembly  432 , one or more conductor  430  and signal analysis assembly  434  together provide tampering detection functionality, as will be described hereinbelow in greater detail. 
         [0094]    It is appreciated that one or more conductor  430  may be a part of a pair of conductors extending in parallel to each other, wherein one of the conductors of the pair of conductors is grounded. Alternatively, one or more conductor  430  may not form part of a pair of conductors running in parallel to each other. It is also appreciated that the one or more conductor  430  may be routed parallel to a ground plate. Alternatively, the one or more conductor  430  is not routed parallel to a ground plate. 
         [0095]    It is a particular feature of the present invention that the tampering detection functionality senses signal variations which occur very quickly in response to tampering with one or more conductor  430  or its connection to either or both of assemblies  432  and  434 , typically within an elapsed time of approximately 100 ns and depending on the signal generator and comparator employed. These signal variations typically occur within an elapsed time which is less than 100 nanoseconds or even as short as 1 nanosecond. Preferably, the elapsed time during which tampering responsive signal variations take place is generally of the order of the time required for the signal to pass along the length of each conductor  430  or less. 
         [0096]    A preferred length of electrical conductor  430  is about 75 in. for a signal having a rise/fall time of approximately 10 ns. The signal analysis assembly  434  preferably enables sensing tampering attempts in an electrical conductor  430  as short as 6 inches, wherein the signal has a rise/fall time of a few nanoseconds. The time required for an electrical signal to pass along a typical conductor  430  embodied in a conventional FR4 PCB is 140-180 ps/in. 
         [0097]    In accordance with a preferred embodiment of the present invention, signal generator assembly  432  comprises a signal generator  450 , such as a Xilinx 7 Series FPGA, commercially available from Xilinx, Incorporated of San Jose, Calif., which outputs, via a D/A converter  452 , such as a TI-DAC 5670, commercially available from Texas Instruments, operating at 2.4 Gigasamples/second, a signal typically having a rise time of the order of 10 ns and a duration of the order of 150 ns. This signal preferably is repeated every 1 ms. The time duration required for the signal to traverse a conductor  430 , here designated TD, is typically of the order of tens of nanoseconds. A simplified signal diagram illustrating the rise of the output of D/A converter  452  appears at A. In this simplified example, the signal rises nearly instantaneously to a voltage V 1 , typically 3 volts. 
         [0098]    The signal output of D/A converter  452  is applied to one or more conductor  430  via a resistor  454  and is supplied via the one or more conductor  430  to a junction C and thence to a signal analysis subassembly  455  of signal analysis assembly  434 , which also receives a signal timing input from signal generator assembly  432 . 
         [0099]    A simplified signal diagram illustrating the rise of a signal supplied from one conductor  430  to signal analysis assembly  434  appears as signal diagram C. It is seen that the rise of the signal at C is delayed from time 0 by time duration TD and, where the resistance of conductor  430  is generally equal to the resistance of resistor  454 , the resulting signal rises nearly instantaneously after delay TD to V 1  and includes harmonics about voltage V 1 . 
         [0100]    In this embodiment the signal passes along conductor  430  and a portion thereof is reflected back along conductor  430  to a junction between the conductor  430  and resistor  454 , designated B. This signal is supplied to a signal analysis subassembly  456  of signal analysis assembly  434 , which also receives a signal timing input from signal generator assembly  432 . 
         [0101]    A simplified signal diagram illustrating the rise of the signal supplied from junction B to signal analysis subassembly  456  appears as signal diagram B. It is seen that the signal at B rises generally instantaneously to a voltage of approximately 0.5V 1  and includes harmonics about voltage 0.5V 1 . Following a time duration  2 TD, which corresponds to two traversals of conductor  430 , the signal rises generally instantaneously to voltage V 1  and includes harmonics about voltage V 1 . 
         [0102]    In accordance with a preferred embodiment of the present invention signals from junctions B and C are also supplied to a signal analysis subassembly  457 , which forms part of signal analysis assembly  434 . Signal analysis subassembly  457  also receives a signal timing input from signal generator assembly  432 . Signal analysis subassembly  457  preferably includes a difference circuit  458  which provides a signal representing the difference between signals B and C. The output of the difference circuit  458  is preferably supplied via an A/D converter  459  to a comparator  460  which also receives a reference signal |B−C| from a reference signal memory  461 . Should the signal received from difference circuit  458  via A/D converter  459  not match the reference signal in the signal reference memory  461  within predetermined tolerances, a tampering alarm indication is provided by the comparator  460 . 
         [0103]    In a non-tampered situation, reference signal |B−C| is identical to the input received by comparator  460  from A/D converter  459  and no alarm indication is provided. It is appreciated that in a further alternative embodiment either or both of signal analysis subassemblies  455  and  456  may be obviated. 
         [0104]    Each of subassemblies  455  and  456  of signal analysis assembly  434  may be embodied in a number of different ways, three examples of which are described hereinbelow and shown in  FIG. 1D  as Examples I, II and III. 
         [0105]    In Example I, one or both of subassemblies  455  and  456  of signal analysis assembly  434  preferably comprises an A/D converter  462 , such as an ADC12D1800, commercially available from National Semiconductor, which operates at 3.6 Giga samples per second, which receives a signal at junction C or junction B, respectively, from one or more conductor  430  and supplies it to a signal comparator  463 , such as a NL27WZ86, commercially available from On-Semi, Phoenix Ariz., USA. Comparator  463  also receives a reference signal C or a reference signal B from a reference signal memory  464 , which reference signal represents the signal at C or B, respectively, in the absence of tampering. Should the signal received from one or more conductor  430  not match the reference signal in the signal reference memory  464  within predetermined tolerances, a tampering alarm indication is provided by the comparator  463 . 
         [0106]    In a non-tampered situation, reference signal C or reference signal B is identical to the input received by comparator  463  from A/D converter  462  and no alarm indication is provided. 
         [0107]    In Example II, one or both of subassemblies  455  and  456  of signal analysis assembly  434  preferably comprises a microprocessor  470 , such as a TMS320C6X commercially available from Texas Instruments, which receives the signal at junction C or junction B via an A/D converter  472 . The input from A/D converter  472  is supplied to Fast Fourier Transform (FFT) calculation functionality  474  of microprocessor  470 . An FFT calculation result is supplied by FFT calculation functionality  474  to signal comparator functionality  476  of microprocessor  470 . Comparator functionality  476  also receives a reference signal C or a reference signal B from a FFT reference memory  478 , which FFT reference represents the signal at C or B, respectively, in the absence of tampering. Should the FFT calculation result representing the signal received from one or more conductor  430  not match the FFT reference signal in the FFT reference memory  478  within predetermined tolerances, a tampering alarm indication is provided by the microprocessor  470 . 
         [0108]    In a non-tampered situation, the FFT reference is identical to the input received by comparator functionality  476  from FFT calculation functionality  474  and no alarm indication is provided. 
         [0109]    In Example III, one or both of subassemblies  455  and  456  of signal analysis assembly  434  preferably comprises an analog comparator  480 , such as an ADA4960-1 differential amplifier, commercially available from Analog Devices, which receives an analog signal at junction C or junction B, respectively, from one or more conductor  430 . Comparator  480  also receives a reference signal C or a reference signal B from a reference signal memory  482  via a D/A converter  484 , such as a TI-DAC 5670, commercially available from Texas Instruments, operating at 2.4 Gigasamples/second, which reference signal represents the signal at C or B, respectively, in the absence of tampering. Should the signal received from one or more conductor  430  not match the reference signal in the signal reference memory  482  within predetermined tolerances, a tampering alarm indication is provided by the comparator  480 . 
         [0110]    In a non-tampered situation, reference signal C or reference B is identical to the input received by comparator  480  and no alarm indication is provided. 
         [0111]    It is also appreciated that the portions of signal analysis subassembly  457  downstream of difference circuit  458  may alternatively be constructed and operative in accordance with any of Examples I, II and III described hereinabove. 
         [0112]    The alarm indications from respective signal analysis subassemblies  455 ,  456  and  457  are preferably supplied to alarm logic  490 , which may provide an alarm output in response to any suitable combination of alarm indications. 
         [0113]    It is appreciated that the operation of signal generator assembly  432  and of signal analysis assembly  434  preferably takes place continuously whether or not the secured keypad device is being used and whether or not it is in operation. 
         [0114]    It is appreciated that any suitable signal having a fast rise or fall may be employed. Although a square wave signal is illustrated, it is appreciated that the signal need not be a square wave. Different signal configurations may be employed at different times. 
         [0115]    Reference is now made to  FIGS. 2 ,  3 ,  4  and  5 , which are simplified schematic illustrations of the operation of the secure keypad device of  FIG. 1D  responsive to four different types of tampering. For the sake of clarity and simplicity of explanation,  FIGS. 2-5  relate to an embodiment of  FIG. 1D  having a single conductor  430  and wherein the signal analysis assembly  434  is constructed and operative in accordance with Example I, as described hereinabove. It is appreciated that the explanations below which relate to  FIGS. 2 ,  3 ,  4  and  5  are also applicable with appropriate modifications to the embodiments of any of  FIGS. 1A-1C  and to any of Examples I, II and III and to any suitable number of conductors  130 ,  230 ,  330  and  430 . 
         [0116]    Reference is now made to  FIG. 2 , which is a simplified schematic illustration of the operation of the secure keypad device of  FIG. 1D  responsive to a first type of tampering. As seen in  FIG. 2 , the conductor  430  is tampered with by contact therewith as by a metal object and/or an object having inductance or capacitance, as symbolically shown at II. This tampering causes a change in the signals at junctions B and C, typically as shown, respectively, in signal diagrams B—Tampered and C—Tampered. Normally the difference |B−C| also changes. 
         [0117]    Comparators  463 , of signal analysis subassemblies  455  and  456 , and  460 , of signal analysis subassembly  457 , which receive respective reference inputs C, B and |B-C|, sense a difference and produce a corresponding alarm indication. Alarm logic  490  provides a suitable alarm indication in accordance with its logic function. 
         [0118]    Reference is now made to  FIG. 3 , which is a simplified schematic illustration of the operation of the secure keypad device of  FIG. 1D  responsive to a second type of tampering. As seen in  FIG. 3 , the conductor  430  is cut, as symbolically shown at III. This tampering causes disappearance of the signal at C and typically produces a change in the signal at B, as shown, respectively, in signal diagrams C—Tampered and B—Tampered. The difference |B−C| also changes. 
         [0119]    Comparators  463 , of signal analysis subassemblies  455  and  456 , and  460 , of signal analysis subassembly  457 , which receive respective reference inputs C, B and |B−C|, sense a difference and produce a corresponding alarm indication. Alarm logic  490  provides a suitable alarm indication in accordance with its logic function. 
         [0120]    Reference is now made to  FIG. 4 , which is a simplified schematic illustration of the operation of the secure keypad device of  FIG. 1D  responsive to a third type of tampering. As seen in  FIG. 4 , the conductor  430  is shorted to ground at junction C, as symbolically shown at IV. This tampering causes disappearance of the signal at C and typically produces a change in the signal at B, as shown, respectively, in signal diagrams C—Tampered and B—Tampered. The difference |B−C| also changes. 
         [0121]    Comparators  463 , of signal analysis subassemblies  455  and  456 , and  460  of signal analysis subassembly  457 , which receive respective reference inputs C, B and |B−C|, sense a difference and produce a corresponding alarm indication. Alarm logic  490  provides a suitable alarm indication in accordance with its logic function. 
         [0122]    Reference is now made to  FIG. 5 , which is a simplified schematic illustration of the operation of the secure keypad device of  FIG. 1D  responsive to a fourth type of tampering. As seen in  FIG. 5 , the junctions B and C are shorted together, as symbolically shown at V. This tampering causes change in the signals at B and C, as shown, respectively, in signal diagrams B—Tampered and C—Tampered. The difference |B−C| also typically changes 
         [0123]    Comparators  463 , of signal analysis subassemblies  455  and  456 , and  460 , of signal analysis subassembly  457 , which receive respective reference inputs C, B and |B−C| sense a difference and produce a corresponding alarm indication. Alarm logic  490  provides a suitable alarm indication in accordance with its logic function. This logic function may be any suitable logic function which provides an alarm output in response to a combination of alarm indications which is indicative of tampering with an acceptably high rate of accuracy and an acceptably low rate of false alarms. 
         [0124]    It is appreciated by persons skilled in the art that the present invention is not limited by what has been particularly shown and described hereinabove. Rather the scope of the present invention includes both combinations and subcombinations of various features described hereinabove as well as variations and modifications thereto which would occur to a person of skill in the art upon reading the above description and which are not in the prior art.