Patent Document

REFERENCE TO RELATED APPLICATIONS 
       [0001]    Reference is hereby made to U.S. patent application Ser. No. 11/845,435, filed Aug. 27, 2007, entitled Secure Point of Sale Device Employing Capacitive Sensors, now U.S. Pat. No. 7,843,339, the disclosure of which is hereby incorporated by reference. 
       FIELD OF THE INVENTION 
       [0002]    The present invention relates to PIN entry devices and more particularly to secure PIN entry devices. 
       BACKGROUND OF THE INVENTION 
       [0003]    The following publications are believed to represent the current state of the art: 
         [0004]    U.S. Pat. Nos. 7,843,339; 7,170,409; 6,874,092; 6,853,093; 6,646,565; 6,438,825; 6,414,884; 6,359,338; 5,998,858; 5,877,547; 5,861,662; 5,675,319; 5,353,350; 5,237,307; 4,807,284 and 4,593,384; 
         [0005]    U.S. Published Patent Application No. 2005/0184870; 
         [0006]    European Patent Nos. EP0375545 and EP1432031; 
         [0007]    Great Britain Patent No. GB2372363A; 
         [0008]    Van Ess, Dave; “Capacitive Touch Switches for Automotive Applications,” http://www.automotivedesignline.com, February 2006; and 
         [0009]    Kremlin, Victor, et al., “Capacitive Sensing—Waterproof Capacitance Sensing”, Cypress Perform, December, 2006. 
       SUMMARY OF THE INVENTION 
       [0010]    The present invention seeks to provide a secure data entry device, particularly useful for PIN entry devices. 
         [0011]    There is thus provided in accordance with a preferred embodiment of the present invention a secure PIN entry device including a PIN entry assembly operative to receive a PIN from a user, a PIN entry prompter operative when actuated to prompt a user to enter a PIN via the PIN entry assembly, a PIN entry prompt security check enabled controller operative to prevent operation of the PIN entry prompter unless a predetermined security check has been successfully completed and security check functionality operative to check at least part of the PIN entry device for the presence of an unauthorized PIN eavesdropping element thereat and to provide an output to the PIN entry prompt security check enabled controller indicating whether the predetermined security check has been successfully completed. 
         [0012]    Preferably, the controller is operative, in the event of the predetermined security check having discovered a bug, to at least one of provide an output alarm and disable one or more functions of the PIN entry device. 
         [0013]    In accordance with a preferred embodiment of the present invention the controller also includes case open detection functionality. Additionally, the case open detection functionality is operative, in the event of a case open condition being detected, to at least one of provide an output alarm and disable one or more functions of the PIN entry device. 
         [0014]    Preferably, the security check functionality includes bug detection functionality for checking at least part of the PIN entry device for the presence of an unauthorized PIN eavesdropping element thereat. Additionally, the bug detection functionality includes an electric field generator for simultaneously generating an electromagnetic field at a first multiplicity of locations in the PIN entry device and a second multiplicity of capacitance sensors at a second plurality of locations for sensing mutual capacitance between at least some of the first multiplicity of locations and at least some of the second multiplicity of locations resulting from the electromagnetic field at each of the first multiplicity of locations. Additionally or alternatively, the bug detection functionality includes self-capacitance sensing functionality for sensing self-capacitance of multiple elements of the secure PIN entry device. 
         [0015]    In accordance with a preferred embodiment of the present invention the secure PIN device includes capacitance sensing functionality operative in a security scan mode and in a key entry detection mode. Additionally, the capacitance sensing functionality is operative in the key entry detection mode using autotuning functionality and in the security scan mode not using autotuning functionality. Additionally the capacitance sensing functionality is operative in the security scan mode to measure capacitance of elements of the device and compare the capacitance with a baseline capacitance corrected for at least one environmental factor. Preferably, the capacitance includes self-capacitance and mutual capacitance of the elements of the device. 
         [0016]    In accordance with a preferred embodiment of the present invention the capacitance sensing functionality when operative in a security scan mode combines changes in sensed capacitance of a plurality of elements of the secure PIN device which exceed a predetermined threshold in order to ascertain whether a bug is present. 
         [0017]    There is also provided in accordance with another preferred embodiment of the present invention a security check system operative to check at least part of a data entry device for the presence of an unauthorized data eavesdropping element thereat, the system including an electric field generator for simultaneously generating an electromagnetic field at a first multiplicity of locations in the data entry device and mutual capacitance sensing functionality for sensing mutual capacitance between at least some of the first multiplicity of locations and at least a second multiplicity of locations resulting from the electromagnetic field at each of the first multiplicity of locations. 
         [0018]    In accordance with a preferred embodiment of the present invention at least some of the first multiplicity of locations are identical to at least some of the second multiplicity of locations. Additionally or alternatively, the mutual capacitance sensing functionality forms part of capacitance sensing functionality which is operative in a security scan mode and in a key entry detection mode. 
         [0019]    Preferably, the capacitance sensing functionality is operative in the key entry detection mode using autotuning functionality and in the security scan mode not using autotuning functionality. Additionally or alternatively, the capacitance sensing functionality is operative in the security scan mode to measure capacitance of elements of the device and compare the capacitance with a baseline capacitance corrected for at least one environmental factor. Additionally or alternatively, the capacitance sensing functionality when operative in a security scan mode combines changes in sensed capacitance of a plurality of elements of the secure data device which exceed a predetermined threshold in order to ascertain whether a bug is present. 
         [0020]    There is further provided in accordance with yet another preferred embodiment of the present invention a secure data entry device including a data entry assembly operative to receive data from a user, a data entry security check enabled controller operative to prevent receipt of the data by the data entry assembly unless a predetermined security check has been successfully completed and capacitance security check functionality operative to check at least part of the data entry device for the presence of an unauthorized data eavesdropping element thereat by sensing mutual capacitance of at least two elements of the data entry assembly and to provide an output to the data entry security check enabled controller indicating whether the predetermined security check has been successfully completed. 
         [0021]    Preferably, the capacitance security check functionality forms part of capacitance sensing functionality which is operative in a security scan mode and in a key entry detection mode. In accordance with a preferred embodiment of the present invention the capacitance security check functionality is operative in the key entry detection mode using autotuning functionality and in the security scan mode not using autotuning functionality. Additionally or alternatively, the capacitance security check functionality is operative in the security scan mode to measure capacitance of elements of the device and compare the capacitance with a baseline capacitance corrected for at least one environmental factor. Additionally or alternatively, the capacitance security check functionality, when operative in a security scan mode, combines changes in sensed capacitance of a plurality of elements of the secure data entry which exceed a predetermined threshold in order to ascertain whether a bug is present. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0022]    The present invention will be understood and appreciated more fully from the following detailed description, taken in conjunction with the drawings in which: 
           [0023]      FIG. 1A  is a simplified illustration of a touchscreen PIN entry device constructed and operative in accordance with a preferred embodiment of the present invention; 
           [0024]      FIG. 1B  is a simplified illustration of the touchscreen PIN entry device of  FIG. 1A  showing a malicious bug overlay, whose presence can be detected in accordance with a preferred embodiment of the present invention; 
           [0025]      FIG. 2A  is a simplified illustration of another embodiment of a PIN entry device constructed and operative in accordance with a preferred embodiment of the present invention; and 
           [0026]      FIG. 2B  is a simplified illustration of the PIN entry device of  FIG. 2A  showing a malicious bug overlay whose presence can be detected in accordance with a preferred embodiment of the present invention. 
       
    
    
     DETAILED DESCRIPTION OF PREFERRED EMBODIMENTS 
       [0027]    Reference is now made to  FIG. 1A , which is a simplified illustration of a touchscreen PIN entry device  100  constructed and operative in accordance with a preferred embodiment of the present invention. PIN entry device  100  may be used for transactions, such as payment card transactions, for access points and for any other suitable purpose. As seen in  FIG. 1A , the touchscreen PIN entry device  100  includes a housing  102  which encloses a secure touchscreen assembly  104  which communicates with touchscreen operation management circuitry and touchscreen security management circuitry both preferably embodied in a single integrated circuit  106 , a preferred embodiment of which is a CY8C20666 chip, commercially available from Cypress Semiconductors, Inc., preferably located within a secure enclosure  108 . A display  110  is also mounted within housing  102  alongside secure touchscreen assembly  104 . 
         [0028]    Preferably, but not necessarily, located within secure enclosure  108  is PIN entry operation circuitry, which preferably receives inputs from touchscreen operation management circuitry and from touchscreen security management circuitry and provides conventional PIN entry functionality, such as, for example, PIN entry prompting, PIN entry acceptance, PIN encryption, encrypted PIN transmission, device disable and security alarms. It is appreciated that PIN entry operation circuitry may be embodied in integrated circuit  106 . 
         [0029]    A user interface layer  112 , on which appear key symbols used for PIN entry, such as 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, * and #, and possibly other key symbols, is preferably mounted onto housing  102  and overlies a light guide layer  114 , which lies intermediate the interface layer  112  and the secure touchscreen assembly  104 . 
         [0030]    Secure touchscreen assembly  104  preferably is embodied in a multilayer printed circuit board. A bottom layer  120  of the multilayer printed circuit board preferably includes circuit connections  121 , including circuit connections between one or more elements of the secure touchscreen assembly  104 , the touchscreen operation management circuitry, the touchscreen security management circuitry and the PIN entry operation circuitry as well as circuit connections with other circuitry located either inside or outside of the secure enclosure  108 . Touchscreen security management circuitry preferably is operative to detect the presence of an unauthorized PIN eavesdropping element thereat and provide an output to PIN entry operation circuitry, indicating whether a predetermined security check has been successfully completed. 
         [0031]    Overlying bottom layer  120  is a protective grid layer  122 , which may form part of secure enclosure  108  and preferably extends therebeyond to provide anti-tamper protection to the underside of the secure touchscreen assembly  104 . Protective grid layer  122  is preferably formed of a dense grid of electrical conductors which, together with similar grids which define protective enclosure  108 , is preferably connected to tamper protection circuitry  123  and which is operative to detect tampering and to provide an output indication responsive to tampering, which may be at least one of an output indication of tampering and disabling of one or more functions of the PIN entry device  100 . 
         [0032]    Overlying protective grid layer  122  is a ground layer  124  and overlying ground layer  124  is a pad layer  126 , on which key pads  128  are formed at typically 15 key locations. Each key pad  128  is preferably connected to touchscreen operation management circuitry  106  by a via  130  and appropriate circuit connections  121 . 
         [0033]    A plurality of bug-sensing floods  140  are preferably formed on layer  126  and preferably extend in rows, galvanically insulated from key pads  128  by separations  142  and from each other by separations  144  but generally covering most of the area of layer  126  which is not covered by the key pads  128 . Preferably, bug-sensing floods  140  are formed as meshes and are preferably connected to touchscreen operation management circuitry  106  by a via  146  and appropriate circuit connections  121 . 
         [0034]    Reference is now made to  FIG. 1B , which is a simplified illustration of the touchscreen PIN entry device of  FIG. 1A  showing a malicious bug overlay  150  which can be employed by nefarious persons for unauthorized PIN eavesdropping. Malicious bug overlays  150  may be placed by such nefarious persons overlying keypads  128 , particularly covering at least part of the PIN entry device and specifically overlying keys which are used for Personal Identification Number (PIN) entry, as in credit, debit and other payment transactions. All of the elements of  FIG. 1A  are shown in  FIG. 1B  and designated by the same reference numerals used in  FIG. 1A . 
         [0035]    The malicious bug overlay  150  may be one or more of many possible malicious bugs. The example shown in  FIG. 1B  employs a dielectric substrate  152 , such as MYLAR® film, having formed thereon a plurality of conductive pads  154 , which are connected to a malicious capacitive sensing chip (not shown) by conductors  156 . The malicious arrangement of the malicious bug overlay  150  is normally to align each of the conductive pads  154  over a corresponding key pad  128 , such that key engagements are sensed by the malicious capacitive sensing chip. 
         [0036]    Reference is now made to  FIG. 2A , which is a simplified illustration of another embodiment of a PIN entry device  200  constructed and operative in accordance with a preferred embodiment of the present invention. As seen in  FIG. 2A , PIN entry device  200  includes a top housing element  202  which, together with a bottom housing element  203 , defines a PIN entry device housing. Housing element  202  includes, on a top surface  204  thereof, a display aperture  206 , through which a display  207  may be viewed, and an array  208  of key apertures  210 . 
         [0037]    A key mat  212 , preferably formed of a resilient plastic or rubber, defines a plurality of depressible keys  214 , preferably integrally formed with key mat  212 , which partially extend through key apertures  210 . There is provided a flexible resilient protective partial enclosure  216 , which includes an anti-tampering grid  218 , formed of a multiplicity of interconnected anti-tampering electrical conductors, on a top surface  220  thereof and on side surfaces  222  thereof. 
         [0038]    Disposed within optional protective partial enclosure  216 , underlying top surface  220 , is a key contact pad  230 . Key contact pad  230  is preferably a resilient, generally planar, pad formed of flexible and resilient plastic or rubber, having an array  232  of raised resilient domes  234 . 
         [0039]    Disposed in predetermined spaced relationship with key contact pad  230  is an electrical circuit board  240 , which functions, inter alia, as a key contact board, defining a plurality of pairs of adjacent electrical contact pads  242 , each pair of adjacent electrical contact pads  242  underlying a dome  234 . The mutual arrangement of key contact pad  230  and of electrical circuit board  240  is such that depression of a key  214  by the finger of a user causes a conductor (not shown) associated with a corresponding dome  234  to establish electrical contact with and between a corresponding pair of electrical contact pads  242  lying thereunder and in registration therewith. When key  214  is not depressed, no electrical contact exists between the conductor and the pair of corresponding electrical contact pads  242  or between the adjacent pads of the pair. One or more guard rings  243 , which may be connected to ground or be floating, may be provided surrounding each pair of electrical contact pads  242  to provide anti-tamper protection. 
         [0040]    In accordance with a preferred embodiment of the present invention, case-open switches, which sense physical tampering and opening of the housing, are also preferably located within partial enclosure  216 . In the illustrated embodiment, the case-open switches are each embodied in a raised resilient dome  250  formed on key contact pad  230 . Domes  250  preferably extend outwardly from the surface of key contact pad  230  to a greater extent than do domes  234 . 
         [0041]    Disposed on electrical circuit board  240  underlying each of domes  250  are a corresponding number of pairs of adjacent electrical contact pads  254 . The arrangement of key contact pad  230  and of electrical circuit board  240  is such that as long as the housing is closed, conductors (not shown) associated with each of domes  250  each are in electrical contact with and between a corresponding pair of electrical contact pads  254  lying thereunder and in registration therewith. One or more guard rings  255 , which may be connected to ground or be floating, may be provided surrounding each pair of electrical contact pads  254  to provide anti-tamper protection. 
         [0042]    When the housing is closed, domes  258  in key mat  212  are urged towards optional partial enclosure  216  and urge partial enclosure  216  and thus corresponding domes  250  and the conductors associated therewith on the underside surfaces thereof, into electrical contact with corresponding electrical contact pads  254 . When the housing is opened, no electrical contact exists between the conductors and corresponding pairs of electrical contact pads  254  or between the adjacent pads of the pair of electrical contact pads  254 , and a suitable alarm or disablement occurs. 
         [0043]    Disposed below electrical circuit board  240 , there is preferably provided a peripheral protective grid element  260  which includes an anti-tampering grid  262 , preferably coupled to a flexible cable  264 , which is in turn connected to electrical circuit board  240 . Peripheral protective grid element  260  preferably is located interiorly of the side surfaces  222  of enclosure  216 . Fixedly attached to peripheral protective grid element  260  and preferably disposed therebelow is a bottom protective grid element  268 . Element  268  preferably includes an anti-tampering grid  270 . 
         [0044]    Electrical circuit board  240  preferably is a multilayer printed circuit board. A bottom layer  280  preferably includes circuit connections  281  with keypad operation management circuitry  286  and keypad security management circuitry  287 , circuit connections between one or more elements of circuitry  286  and one or more elements of circuitry  287  and circuit connections with other circuitry located either inside or outside of the secure enclosure formed by resilient protective partial enclosure  216 , peripheral protective grid element  260  and bottom protective grid element  268 . 
         [0045]    Keypad operation management circuitry  286  operates in a conventional manner to sense electric contact between electrical contact pads  242 , which represents a key stroke. Preferably, but not necessarily, located within the secure enclosure is PIN entry operation circuitry, providing conventional PIN entry functionality, such as, for example, PIN entry prompting, PIN entry acceptance, PIN encryption, encrypted PIN transmission, device disable and security alarms. It is appreciated that PIN entry operation circuitry may be embodied in integrated circuit  286 , which may be an ASIC incorporated, for examples, in a PINPad 1000, commercially available from VeriFone, Inc. 
         [0046]    Keypad security management circuitry  287  preferably includes bug sensing management circuitry and is preferably embodied in a CY8C20666 chip, commercially available from Cypress Semiconductors, Inc. 
         [0047]    Overlying bottom layer  280  is a protective grid layer  290 , which may form part of secure enclosure  260 . Protective grid layer  290  is preferably formed of a dense grid of electrical conductors which defines an anti-tampering grid  291 . 
         [0048]    Anti-tampering grids  218 ,  262 ,  270  and  291  are preferably connected to tamper protection circuitry which may be integrated with keypad security management circuitry  287  and which is operative to detect tampering and to provide an output indication responsive to tampering, which may be at least one of an output indication of tampering and disabling of one or more functions of the PIN entry device  200 . 
         [0049]    Overlying protective grid layer  290  is a ground layer  292  and overlying ground layer  292  is a pad layer  296 , on which electrical contact pads  242  are formed at typically 15 key locations. Each electric contact pad  242  is preferably connected to keypad security management circuitry  287  by a via  294  and appropriate circuit connections  281 . 
         [0050]    A plurality of bug-sensing floods  300  are preferably formed on layer  296  and preferably extend in rows, galvanically insulated from rings  243  by separations  302  and from each other by separations  304  and galvanically insulated from rings  255  by separations  305  but generally covering most of the area of layer  296  which is not covered by the electric contact pads  242 . Preferably, bug-sensing floods  300  are formed as grids and are preferably connected to keypad security management circuitry  287  by a via  306  and appropriate circuit connections  281 . 
         [0051]    It is appreciated that the embodiment of  FIG. 2A  is one example of a large number of different keypads, other than capacitive sensing keypads, in which the present invention may be useful. These include touchscreens which employ key press detection technology other than capacitive sensing, such as resistive touchscreens and optical touchscreens as well as other types of keypads. The present invention employs capacitive sensing for security purposes, even in such contexts where capacitive sensing is not employed for key-entry operation. 
         [0052]    Reference is now made to  FIG. 2B , which is a simplified illustration of the PIN entry device of  FIG. 2A  showing a malicious bug overlay  350 , whose presence can be detected in accordance with a preferred embodiment of the present invention. All of the elements of  FIG. 2A  are shown in  FIG. 2B  and are designated by the same reference numerals used in  FIG. 2A . 
         [0053]    The malicious bug overlay  350  may be one or more of many possible malicious bugs. The example shown in  FIG. 2B  comprises three layers of dielectric substrates  352 ,  354  and  356 , such as MYLAR® film. Layers  352  and  356  each have formed thereon a plurality of conductive pads, respectively  362  and  366 , which are connected to a malicious key entry sensing chip (not shown) by respective conductors  372  and  376 . Layers  352  and  356  are configured with apertures  378  and  380  generally surrounding conductive pads  362  and  366 , respectively, and aligned with electrical contact pads  242  to enable normal PIN entry operation of the device. Similarly apertures (not shown) may be provided in all of substrates  352 ,  354  and  356  of the malicious bug overlay  350  to avoid actuation of the case-open switches. 
         [0054]    Intermediate layers  352  and  356  of the malicious bug overlay  350  there is provided a spacer layer  354  having apertures  382  at the locations of conductive pads  362  and  366 . The malicious arrangement of the malicious bug overlay  350  is normally to align each of the conductive pads  362  and  366  over a corresponding electrical contact pad  242 , such that key engagements produce a closed circuit between respective pads  362  and  366  at apertures  382 , which closed circuits are sensed by the malicious key entry sensing chip. 
         [0055]    The operation of the devices described hereinabove with reference to  FIGS. 1A-2B  will now be described, initially generally and thereafter in greater detail. The devices of  FIGS. 1A-2B  preferably operate in a security scan mode in accordance with a preferred embodiment of the present invention, followed, in the absence of sensed bugs, by a generally conventional key entry detection mode. In the security scan mode of the present invention, capacitance of various elements in the device is used to detect the presence of a malicious overlay placed over the keys for surreptitiously sensing key entries, as well as other types of bugs. 
         [0056]    Preferably, both self-capacitance and mutual capacitance of various elements of the device is sensed and changes are noted. The various elements of the device typically include keys and preferably also include areas outside of the keys. Conventional capacitive sensing techniques, such as CAPSENSE®, may be employed, not only for operation in conventional key entry detection mode, but also, in a non-conventional manner for operation in the security scan mode of the present invention. Capacitive sensing techniques may be used for operation in the security scan mode of the present invention by disabling autotuning functionality, such as SmartSense functionality of Cypress Semiconductors Inc., during operation in the security scan mode, but not in conventional key entry detection mode. 
         [0057]    Preferably, all appropriate sensed values are encrypted. 
         [0058]    In the description which follows, reference is made to a preferred embodiment of the present invention, shown in  FIGS. 1A and 1B , wherein the self capacitance and mutual capacitance of two types of pads is sensed. One type is key pads, such as pads  128 , of which 15 are normally present, and the other type is bug sensing floods  140 , of which five are normally present. The bug sensing floods  140 , are provided in accordance with a preferred embodiment of the present invention, particularly for operation in the security scan mode. 
         [0059]    Conventional key entry detection is provided using firmware commercially available from Cypress Semiconductors Inc. under the trademark CAPSENSE®. This detection typically employs a 12-bit pseudo-random sequence generator to scan each pad  128 , preferably in a manner having acceptable immunity from external noise sources and electromagnetic emission levels. 
         [0060]    In this conventional key entry operation, the self capacitance of each pad  128 , is read discretely and temporarily stored in a Static Random Access Memory (SRAM). These self-capacitance values are checked against the autotuning calibrated threshold values recorded at the factory at the time of manufacture. If a self-capacitance value for a given pad  128  meets or exceeds its threshold value, a corresponding bit is set in a key entry register. The foregoing conventional key entry detection is preferably carried out during operation of the autotuning functionality. 
         [0061]    In accordance with a preferred embodiment of the present invention, malicious overlay detection is provided, while autotuning functionality is disabled as described below: 
         [0062]    Preferably, the self-capacitance of each of bug sensing floods  140  is read discretely and temporarily stored in a SRAM. Each value is compared with a suitably temperature adjusted baseline self-capacitance value for the same flood  140 , based on self capacitance calibration readings recorded at the factory at the time of manufacture. A suitable difference value is calculated and compared with a threshold. Exceedance of the threshold indicates the probable existence of a malicious overlay or other bug. It is appreciated that the functionality described in this paragraph is particularly useful in sensing bugs containing a conductor which is located in the area of the keys of the device. It is also appreciated that one or more of various types of suitable difference values may be calculated. 
         [0063]    Additionally or alternatively, as described in the preceding paragraph, the self-capacitance of each of bug sensing floods  140  is read discretely and temporarily stored in a SRAM. Each value is compared with a suitably temperature adjusted baseline self-capacitance value for the same flood  140 , based on self capacitance calibration readings recorded at the factory at the time of manufacture. Suitable difference values are calculated. However, as distinct from the functionality described in the preceding paragraph, the absolute values of the difference values are preferably all added together and compared with a suitable threshold. Exceedance of that threshold indicates the probable existence of a malicious overlay or other bug. It is appreciated that the functionality described in this paragraph provides enhanced sensitivity in detecting a film which is maliciously placed in the area of the keys of the device. 
         [0064]    Additionally or alternatively, the self-capacitance of each of key pads  128  is read discretely and temporarily stored in a SRAM. Each value is compared with a suitably temperature adjusted baseline self-capacitance value for the same key pad  128 , based on self capacitance calibration readings recorded at the factory at the time of manufacture. A difference value is calculated and compared with a threshold. Exceedance of the threshold indicates the probable existence of a malicious overlay or other bug. It is appreciated that the functionality described in this paragraph is particularly useful in sensing bugs containing a conductor which is located in the area of the keys of the device. 
         [0065]    Additionally or alternatively, the self-capacitance of each of key pads  128  is read discretely and temporarily stored in a SRAM. Each value is compared with a suitably temperature adjusted baseline self-capacitance value for the same key pad  128 , based on self capacitance calibration readings recorded at the factory at the time of manufacture. Suitable difference values are calculated. The absolute values of the difference values are preferably all added together and compared with a suitable threshold. Exceedance of that threshold indicates the probably existence of a malicious overlay or other bug. It is appreciated that the functionality described in this paragraph provides enhanced sensitivity in detecting a film which is maliciously placed in the area of the keys of the device. 
         [0066]    Additionally or alternatively, the self-capacitance of each of key pads  128  and each of floods  140  is read discretely and temporarily stored in a SRAM. Each value is compared with a suitably temperature adjusted baseline self-capacitance value for the same key pad  128  or flood  140 , based on self capacitance calibration readings recorded at the factory at the time of manufacture. Suitable difference values are calculated. The absolute values of the difference values are preferably all added together and compared with a suitable threshold. Exceedance of that threshold indicates the probably existence of a malicious overlay or other bug. It is appreciated that the functionality described in this paragraph provides enhanced sensitivity in detecting a film which is maliciously placed in the area of the keys of the device. 
         [0067]    In accordance with a preferred embodiment of the invention, a suitably temperature adjusted baseline self-capacitance value for each pad  128  and flood  140  preferably is obtained as follows: At the factory, at the time of manufacture, self-capacitance is measured at two different temperatures and the resulting base readings are stored. During operation of the device, the current temperature in the vicinity of the pads  128  and floods  140  is sensed and used with the baseline readings to provide temperature adjusted baseline readings. Preferably a linear function is employed for extrapolation or interpolation as appropriate. 
         [0068]    It is appreciated that the above-described functionality represents an example of the type of self-capacitance based security functionality that may be employed in accordance with embodiments of the present invention. Various alternatives may be employed, alternatively or sequentially depending on the context and the required sensitivity and reliability. 
         [0069]    Additionally in accordance with a preferred embodiment of the present invention, malicious overlay detection is provided by sensing mutual capacitance between various ones of key pads  128  and bug sensing floods  140 , while autotuning functionality is disabled as described below: 
         [0070]    Preferably a sawtooth signal is applied simultaneously to those of pads  128  and/or floods  140  indicated as TX in Table 1 below and the mutual capacitance between the TX pads  128  and/or floods  140  and those of pads  128  and/or floods  140  indicated as RX is measured. This signal may be at one or more frequencies, typically 20 KHZ and 200 KHZ. 
         [0000]    
       
         
               
               
               
             
           
               
                 TABLE 1 
               
               
                   
               
               
                 protocol 
                 transmit TX 
                 receive RX 
               
               
                   
               
             
             
               
                 A 
                 PADS 128: 
                 FLOODS 140: 
               
               
                   
                 1, 2, 3, 4, 5, 6, 7, 8, 9, *, 0, # 
                 1, 2, 3 &amp; 4 
               
               
                 B 
                 PADS 128: 
                 PADS 128: 
               
               
                   
                 1, 4, 7, *, 3, 6, 9, # 
                 2, 5, 8, 0 
               
               
                 C 
                 PADS 128: 
                 PADS 128: 
               
               
                   
                 1, 2, 3, 4, 6, 7, 9, *, 0, # 
                 5, 8 
               
               
                 D 
                 FLOODS 140: 
                 PADS 128: 
               
               
                   
                 1, 2, 3 &amp; 4 
                 1, 2, 3, 4, 5, 6, 7, 8, 9, *, 0 &amp; # 
               
               
                   
               
             
          
         
       
     
         [0071]    Various mutual capacitance protocols may be employed, examples of which are shown in Table 1. Thus it is appreciated that the protocols and the selections of pads  128  as TX or RX pads and floods  140  as TX or RX floods represent examples of possible protocols and selections. 
         [0072]    The readings on each of the RX pads and/or floods are temporarily stored in a SRAM. Each value is compared with a suitably temperature adjusted baseline mutual-capacitance value for the same RX pad  128  and/or RX flood  140 , based on mutual capacitance calibration readings recorded at the factory at the time of manufacture. A difference value is calculated and compared with a threshold. Exceedance of the threshold indicates the probably existence of a malicious overlay or other bug. It is appreciated that the functionality described in this paragraph is particularly useful in sensing bugs containing a conductor which are located in the area of the keys of the device. 
         [0073]    It is appreciated that the foregoing functionality may be carried out for each applied frequency separately or the results for multiple applied signal frequencies may be combined. 
         [0074]    Referring to Table 1, it is seen that there are provided four exemplary mutual capacitance sensing protocols, designated by the letters A, B, C and D. It is appreciated that any one or more protocols may be employed. It is further appreciated that any other suitable mutual capacitance sensing protocols may be employed in accordance with the present invention. It is further appreciated that firmware including additional or alternative capacitance sensing protocols may be securely field downloaded, from time to time, to the secure PIN entry devices of the present invention and particularly to the security management circuitry, such as that embodied in a CY8C20666 chip, as by the use of secure bootloaders. 
         [0075]    The functionality of mutual capacitance sensing for bug detection is now described generally: Using the example of protocol A, it is seen that a suitable signal is preferably simultaneously applied to all of the listed TX pads  128 , namely 1, 2, 3, 4, 5, 6, 7, 8, 9, *, 0, #. Received signals are read simultaneously or sequentially at each of the listed RX floods  140 , namely floods 1, 2, 3 &amp; 4, where flood 1 surrounds keys 1, 2 &amp; 3; flood 2 surrounds keys 4, 5 &amp; 6; flood 3 surrounds keys 7, 8 &amp; 9; and flood 4 surrounds keys *, 0 &amp; # and the resulting values are stored in a memory, preferably a SRAM. A difference value is calculated for each flood  140 , namely floods 1, 2 3 &amp; 4 using a suitably temperature corrected baseline for each of the floods, established at the factory at the time of manufacture. The difference values may each be compared separately with an appropriate threshold, or a sum of the absolute values of the difference values may be compared with a suitable threshold. 
         [0076]    Independently of the protocol employed, if one or more threshold is exceeded, security management circuitry incorporated in the PIN entry device, which may include alarm indication circuitry coupled to protective grids of the type described above, takes appropriate measures to ensure the security of the PIN entry device. These measures may include, for example, preventing prompts for PIN entry, preventing PIN entry, preventing operation of the PIN entry device, transmitting an alarm indication to a remote location and providing human sensing alarm indications such as audible or visible indications. 
         [0077]    Additionally or alternatively, the mutual capacitance of each of TX pads  128  and/or floods  140  and each of the RX pads  128  and/or floods  140  is read discretely and temporarily stored in a SRAM. Each value is compared with a suitably temperature adjusted baseline mutual-capacitance value for the same pair of TX pads  128  and/or floods  140  and each of the RX pads  128  and/or floods  140  based on mutual capacitance calibration readings recorded at the factory at the time of manufacture. Suitable difference values are calculated. However, as distinct from the functionality described in the preceding paragraph, the absolute values of the difference values are preferably all added together and compared with a suitable threshold. Exceedance of the threshold indicates the probable presence of a malicious overlay or other bug. 
         [0078]    The sensitivity and responsiveness of the security management circuitry may be modified as appropriate by secure field downloads, from time to time, to the secure PIN entry devices of the present invention and particularly to the security management circuitry, such as that embodied in a CY8C20666 chip, as by the use of secure bootloaders. 
         [0079]    The above description references to sensing capacitance values, it being appreciated that such sensing may be achieved by reading one or more of voltage, current other electrical metric. Sensed changes in capacitance of an element, when suitably corrected for environmental factors from a baseline reflect corresponding changes in the dielectric characteristics in the vicinity of the element and are here used to detect the presence of maliciously placed bugs. 
         [0080]    Changes in dielectric characteristics of multiple elements may be combined in various ways, which may but not necessarily include calculation of absolute values. Various other types of summing calculations may be employed, as appropriate. 
         [0081]    It is also appreciated that various self-capacitance and mutual capacitance sensing protocols may be applied inter alia to elements of the case open switches, as appropriate. 
         [0082]    It will be appreciated by persons skilled in the art that the present invention is not limited by what has been particularly shown and described hereinabove. Rather the present invention includes both combinations and subcombinations of various features described hereinabove as well as modifications and variations thereof which would occur to a person skilled in the art upon reading the foregoing and which are not in the prior art.

Technology Category: g