Abstract:
An apparatus includes a keyboard and circuitry. The keyboard includes at least an interface line and a key. The key is configured to connect the interface line to first and second different capacitances when positioned in first and second positions, respectively. The circuitry is connected to the interface line and is configured to detect whether the key is in the first position or in the second position, by sensing electrical current flowing on the interface line in response to a stimulation waveform.

Description:
FIELD OF THE INVENTION 
     The present invention relates generally to data security, and particularly to methods and systems for secure readout of a keyboard. 
     BACKGROUND OF THE INVENTION 
     In various applications a person is required to provide confidential information, such as a personal identification number (PIN) in automatic teller machines (ATM) and a user ID number in mobile point of sale (POS) terminals. Typically, the confidential information is provided via a man-machine interface such as a keyboard. The keyboard and its interfaces may be vulnerable to attacks in which an unauthorized party attempts to recognize the input confidential information. Examples of prior art techniques for preventing keyboard attacks are provided below. 
     U.S. Pat. No. 6,426,710, whose disclosure is incorporated herein by reference, describes a security keyboard matrix scanning method. The method utilizes bi-directional input/output ports (e.g., X-port and Y-port), in which each line of the X-port and the Y-port can be selectively designated as a sensing line or an output line, to construct the X-port and Y-port such that at least one line of one of the two ports can output a scanning signal representative of a dummy scanning signal at the time the actual scanning signal is output from another line of either port. 
     U.S. Patent Application Publication 2011/0095919, whose disclosure is incorporated herein by reference, describes a keyboard having a plurality of key fields and a plurality of capacitive elements, which are associated with the key fields, and measuring electronics. The measuring electronics are implemented for the purpose of detecting a change of the capacitance value of one of the capacitive elements between a non-actuation level, which is in a first capacitance value range, and an actuation level, which is in a second capacitance value range, and then outputting an actuation signal. An attempt to manipulate the keyboard can thus be detected on the basis of the capacitance value increase associated therewith. 
     SUMMARY OF THE INVENTION 
     An embodiment of the present invention that is described herein provides an apparatus including a keyboard and circuitry. The keyboard includes at least an interface line and a key. The key is configured to connect the interface line to first and second different capacitances when positioned in first and second positions, respectively. The circuitry is connected to the interface line and is configured to detect whether the key is in the first position or in the second position, by sensing electrical current flowing on the interface line in response to a stimulation waveform. 
     In some embodiments, the circuitry is configured to sense the electrical current by integrating a voltage across a resistance that the electrical current flows through, over a predefined time interval. In some embodiments, the circuitry includes a waveform generator that is configured to produce the stimulation waveform. In a disclosed embodiment, the waveform generator is configured to produce the stimulation waveform with rise and fall times that are longer than a Resistance-Capacitance (RC) time constant of the interface line and the first or second capacitances. In an embodiment, the waveform generator is connected to the interface line via a series resistor, and is configured to receive feedback indicative of the voltage drop across the series resistor and to adjust the stimulation waveform based on the feedback to compensate for the voltage drop. 
     In an example embodiment, the at least interface line includes a matrix including first and second interface lines that intersect at the key, wherein in the first position the first interface line is connected to a first capacitor and the second interface line is connected to a second capacitor, and in the second position the key connects the first and second capacitors in parallel to both the first and the second interface lines. In an embodiment, a voltage applied over the at least interface line does not change when the position of the key changes between the first and second positions. 
     There is additionally provided, in accordance with an embodiment of the present invention, a method including connecting at least an interface line of a keyboard to first and second different capacitances, by positioning a key of the keyboard in first and second positions, respectively. Using circuitry that is connected to the keyboard by the interface line, a detection is made whether the key is in the first position or in the second position, by sensing electrical current flowing on the interface line in response to a stimulation waveform. 
     The present invention will be more fully understood from the following detailed description of the embodiments thereof, taken together with the drawings in which: 
    
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         FIG. 1  is a block diagram that schematically illustrates a secured keyboard system, in accordance with an embodiment of the present invention; and 
         FIG. 2  is a graph that schematically illustrates a scanning scheme for a keyboard matrix, in accordance with an embodiment of the present invention. 
     
    
    
     DETAILED DESCRIPTION OF EMBODIMENTS 
     Overview 
     Keyboards are used in various applications, such as in mobile point of sale (POS) terminals or in various computing devices. Keyboards may be used for inputting various types of information including confidential information, such as personal identification number (PIN) code. A keyboard may therefore be a target for hacking attacks that attempt to obtain such information. 
     Consider, for example, a hypothetical keyboard that comprises a matrix of keys, each key connecting a column-line and a row-line. Such a keyboard may be read by applying pulses to the column-lines and monitoring the row-lines. When pressing a given key, the column-line and row-line that intersect at the given key become connected together and the pulse can be sensed on the row-line. An eavesdropper may recognize the column-line and the row-line on which the pulse appears simultaneously, and conclude which key was pressed. Such an attack is simple to launch, e.g., using a simple voltmeter, and difficult to detect. 
     Embodiments of the present invention that are described hereinbelow provide improved techniques for reading keyboards in a manner that is protected from hacking attacks. In some embodiments, each column-line and row-line is connected to ground potential via a respective capacitor at one end, and to a respective interface line at the other end. The capacitance of the capacitors connected to the row-lines is referred to herein as “row capacitance,” and the capacitance of the capacitors connected to the column-lines is referred to herein as “column capacitance.” The row capacitance is different from the column capacitance. When a key is pressed, the interface line connected to the column-line, and the interface line connected to the row-line, are both connected to the sum of the row and column capacitances. 
     In some embodiments, a sequence of voltage pulses having a predefined waveform (e.g., a triangular waveform) is applied by multiple voltage sources to the row-lines and column-lines. In an embodiment, each interface line is connected to a respective current measurement circuitry comprising an integrator that senses and integrates the absolute value of a voltage across a resistance that the current flow through, over a period of the pulse sequence. The outputs of the integrators connected to the various column-lines and row-lines are provided to circuitry that detects whether a key was pressed, and which key it was. 
     The disclosed techniques are highly effective in preventing attacks on the keyboard interface lines, because a pressed key cannot be identified by monitoring the voltage over the interface lines. When using the disclosed techniques, an attacker is unable to even determine whether a key has been pressed or not, let alone identify which key was pressed. Illegitimately sensing the current flowing through the interface lines is considerably more difficult. Furthermore, an attack by current measurement may be detected relatively easily, e.g., by detecting changes in the resistance at the respective circuitry. 
     System Description 
       FIG. 1  is a block diagram that schematically illustrates a secured keyboard system  20 , in accordance with an embodiment of the present invention. System  20  comprises a capacitive matrix keyboard  22  and an application-specific integrated circuit (ASIC)  24 . 
     In the present example, keyboard  22  comprises a matrix of six keys arranged in three columns (denoted col 0, col 1 and col 2) and two rows (denoted row 0 and row 1). Each key is identified by two indices corresponding to a respective pair of row-line and column-line. For example, k12 refers to a key located at row-line 1 and column-line 2. The columns and rows of keys are associated with respective column-lines and row-lines that are each connected to ground via a respective capacitor. For example, column-line 0 connects to ground via a capacitor C 1  and row-line 0 connects to ground via a capacitor C 4 . The column-lines and row-lines also serve as interface lines between keyboard  22  and ASIC  24 . 
     Column-lines 0, 1, and 2 are connected to ASIC  24  via respective wires  40 ,  41  and  42 , and at their other ends to ground via respective capacitors C 1 , C 2  and C 3 . Row-lines 0 and 1 are connected to ASIC  24  via respective wires  43  and  44 , and at their other ends to respective capacitors C 4  and C 5 . Capacitors C 1 , C 2  and C 3  are substantially similar having same capacitance denoted C. Capacitors C 4  and C 5  are substantially similar having, in the present example, capacitance that is nine-times higher than C (i.e., 9C). All five capacitors are connected at one end to a common ground point  23 . 
     In the example of  FIG. 1 , ASIC  24  comprises five substantially similar line units  26 A- 26 E. Wires  40 - 44  connect to units  26 A- 26 E, respectively. In the example of  FIG. 1 , column-lines 0-2 are connected via wires  40 - 42  to units  26 A- 26 C, respectively, and row-lines 0 and 1 are connected via wires  43  and  44  to units  26 D and  26 E, respectively. 
     Reference is now made to an inset  28  that depicts a detailed block diagram of one of line units  26  (e.g., unit  26 E). Each line unit comprises a voltage source  32 , configured to produce stimulation signals. Each signal comprises one or more stimulus pulses, such as voltage pulses having a triangular waveform as depicted in  FIG. 2 . Source  32  is connected to its respective column-line or row-line via a resistor  34 . An integrator  30  is connected in parallel to resistor  34 , and is configured to integrate the absolute value of the voltage across resistor  34  over time. 
     In the present example, voltage source  32  is provided with a feedback that is indicative of the voltage at the far terminal of resistor  34 . Using this feedback, voltage source  32  is able to compensate for the voltage drop across resistor  34 . Typically, source  32  adjusts the voltage at its own output, such that the pulses on the respective interface line (one of lines  40 - 44 ) remains substantially the same regardless of the voltage drop over resistor  34 . 
     ASIC  24  further comprises logic  36 , which receives the integrator outputs from units  26 A- 26 C, and is configured to identify a pressed key of keyboard  22  based on the integrator outputs. 
     Each key in keyboard  22  has two positions: pressed, when pressed by a user, or released, when the key is untouched. Line units  26 A- 26 E produce the voltage pulses stimulus regardless of whether any of the keys is pressed or not. When all keys are untouched, each column-line connects to a capacitance “C”, and each row-line connects to a capacitance “9C”. When the user presses a key intersected by a certain column-line and a certain row-line, the pressed key connects between the column-line and the row-line, causing their respective capacitors to connect in parallel. 
     Therefore, when a key is pressed, both its row-line and column-line are connected to a capacitance that is equal to the sum of the row-capacitance and the column capacitance. For example, when pressing key K10, the resultant capacitance of capacitors C 1  (of column-line 0) and C 5  (of row-line 1) equal 9C+C=10C. 
     The difference in capacitance between the two key positions causes different respective currents to flow through resistors  34  of line units of the row-line and column-line, and therefore results in different respective outputs of the integrators of these line units. Based on this difference, logic  36  is able to identify the pressed key. For example, logic  36  may compare the output of each integrator  30  to a threshold, which is set at the mid-point between the nominal output of the integrator when the key is pressed, and the nominal output of the integrator when the key is not pressed. 
     The configuration of system  20  shown in  FIG. 1  is depicted purely by way of example. In alternative embodiments, any other suitable system configuration can be used. For example,  FIG. 1  refers to a specific configuration of keyboard  22 . In alternative embodiments, the disclosed techniques can be used, mutatis mutandis, in various other types of keyboards, such as desktop and laptop, ATMs and POS terminals. Furthermore, the number of keys in the keyboard may vary from a single key to any number of keys suitable for a desired application. 
     The various elements of system  20  are typically implemented in hardware as shown in the figure. Some system elements, however, for example logic  36 , may also be implemented in software. 
       FIG. 2  is a graph  50  that schematically illustrates a scanning scheme for matrix keyboard  22 , in accordance with an embodiment of the present invention. Graph  50  shows five scanning waveforms (WFs), which are produced by generators  30  of line units  26 A- 26 C. WFs C 0 , C 1  and C 2  stimulate respective columns C 0 , C 1  and C 2 , and WFs R 0  and R 1  stimulate respective rows R 0  and R 1 . In the example of  FIG. 2 , all the WFs have a triangular shape. In other embodiments, the WFs may have any other suitable shape. 
     Line units  26 A,  26 B and  26 C generate pulses  52 ,  54  and  56  to stimulate column-lines 0, 1 and 2, respectively, at a staggered sequence having a given frequency. To capture a pressed key, the column-lines scanning cycle is shorter than the minimal expected key-press duration. In parallel, units  26 D and  26 E generate pulses for stimulating rows 0 and 1, respectively, together with every pulse stimulating the columns. 
     In other words, a pulse stimulating a column-line is accompanied with pulses stimulating each of the row-lines at the same time. For example, pulse  52  on column-line 0 is generated simultaneously with pulses  58  and  64  generated on row-lines 0 and 1, respectively. Similarly, pulses  54 ,  60  and  66  are generated simultaneously over column-line 2 and row-lines 0 and 1, respectively. The WFs of all the stimulating pulses in graph  50  are substantially similar. 
     In some embodiments, integrator  30  of each unit  26  integrates the absolute voltage across the series resistor  34  of its respective column-line or row-line. When a user presses a key, the corresponding column-line and row-line are shorted together while the respective sources  32  continue generating substantially similar waveform pulses over the respective row-lines and column-lines. 
     Typically, the row-lines and column-lines do not comprise series resistances other than the negligible resistance of the wiring. The charging/discharging duration of the capacitors, which is determined by the Resistance-Capacitance (RC) time constant, is thus also close to zero. As a result, the voltage developing over the row-lines and column-lines does not change between the two key positions. Therefore, an eavesdropper who senses the voltages on wires  40 - 44  is unable to identify the pressed key. In some embodiments, an underlying assumption is that the rise and fall times of the pulses is designed to be significantly greater than the RC time constant. 
     On the other hand, the change in resultant capacitance between the two key positions causes a change to the integrators outputs that is recognized by logic  36 . For example, when typing key K01, the resultant capacitance seen by units  26 B and  26 D together is “10C”, or “5C” as seen by each unit. As a result, the resultant capacitance seen by unit  26 B changes from “C”, which is the capacitance of C 2  before typing, to 5C, which is half of the resultant capacitance of C 2 +C 5  after typing. Similarly, the resultant capacitance as seen by unit  26 D changes from “9C” to “5C”. In other words, logic  36  indicates that key K01 was pressed by receiving higher integrator output readings from unit  26 B (e.g., charging “5C” rather than “C”) and lower integrator output reading from unit  26 D (e.g., charging “5C” rather than “9C”). 
     Logic  36  receives the integrator outputs from units  26 A- 26 E and determines whether the user pressed a key, and which key was pressed. In an embodiment, logic  36  holds predefined thresholds for determining the respective integrator outcomes obtained for a column-line (corresponds to “C” capacitance), a row (corresponds to “9C” capacitance), and for a pressed key (corresponds to “10C” capacitance). Logic  36  may determine the status of each key in keyboard  22  by comparing the currents to these thresholds. 
     It will be appreciated that the embodiments described above are cited by way of example, and that the present invention is not limited to what has been particularly shown and described hereinabove. Rather, the scope of the present invention includes both combinations and sub-combinations of the various features described hereinabove, as well as variations and modifications thereof which would occur to persons skilled in the art upon reading the foregoing description and which are not disclosed in the prior art. Documents incorporated by reference in the present patent application are to be considered an integral part of the application except that to the extent any terms are defined in these incorporated documents in a manner that conflicts with the definitions made explicitly or implicitly in the present specification, only the definitions in the present specification should be considered.