Secure enclosure for sub-assembly of self service equipment

Description

[0001] The present invention relates to self-service equipment. It is particularly related to, but in no way limited to secure enclosures for sub-assemblies of self-service equipment.

[0002] Self-service equipment such as automated teller machines (ATMs), self-service kiosks, photocopiers, vending machines, self-service internet terminals, self-service fax machines and the like are sometimes vulnerable to unauthorized access or tampering. If security has been breached in this way it is important to detect the situation as soon as possible and to shut down the equipment in order to limit any damage or loss.

[0003] Previous approaches to dealing with this issue have involved using housings for the self-service equipment or sub-assemblies of that equipment. If unauthorized access to the housing occurs typically there is damage to the housing or the housing is replaced incorrectly or with dissimilar material. These changes are then detected visibly by users of the equipment, field operators and the like. This approach provides a good first line of defense but it relies upon users and field operatives to make their own judgments and take quick action which is not always possible. Also, if a housing is breached and replaced using a matching housing the situation is very difficult to detect by the uneducated human eye.

[0004] Another approach has been to use electronic circuits associated with such housings so that those circuits are broken in the event of unauthorized access. However, this approach is relatively complex.

[0005] A particular problem relating to self-service equipment is the need to replace sub-assemblies within the equipment in the event of break down of sub-assemblies, upgrade of those sub-assemblies or for other reasons. In that case there is a need to authenticate the replacement sub-assemblies to ensure that security has not been breached and to ensure that correct sub-assembly equipment is being used. At present manual methods are used to provide such authentication and these methods are time consuming and difficult to keep secure. US published patent application number US 2004/178258 discloses an optical system for detecting components added externally of an ATM.

[0006] An object of the present invention is therefore to provide a secure enclosure for protection of one or more sub-assemblies in a self-service apparatus which overcomes or at least mitigates one or more of the problems mentioned above.

[0007] Housings are typically used to protect sub-assemblies in self-service equipment such as key-pad assemblies in automated teller machines (ATMs), self-service kiosks, pay-as-you-go photocopiers and the like. There is a need to secure those housings to prevent access to and tampering of the equipment within. In addition, when replacement sub-assemblies are used, for example, for maintenance or upgrade, then it is necessary to authenticate those sub-assemblies. By providing markers fixed in sub-assembly housings and sensors in the housings or self-service equipment, it is possible to overcome these problems. The markers and sensors are brought into alignment when the sub-assembly housing is fully assembled. The markers and sensors are arranged to detect when a particular physical relationship between the markers and sensors is lost or altered. For example, the markers provide spectral signatures and comprise rare earth metals such as lanthanides.

[0008] According to an aspect of the invention there is provided a secure enclosure for protection of at least one sub-assembly in a self-service apparatus according to Claim 1.

[0009] This provides the advantage that not only it is possible to detect tampering of the sub-assembly but it is also possible to authenticate the sub-assembly in a simple, reliable, secure and cost effective manner. If the trigger is activated this indicates that the sub-assembly has either been tampered with or is not the authentic sub-assembly. It is not necessary to rely on users or field engineers to detect tampering or train and use operatives to carry out authentication (for example, if sub-assemblies are replaced for maintenance). This improves security and reduces costs.

[0010] Preferably the markers each have an associated spectral signature.

[0011] For example the markers are fluorescent. This can be achieved by using one or more lanthanides; for example, in microscopic carrier beads.

[0012] The sensors each comprise one or more light sources. Light from the sensors incident on the markers produces fluorescence with a particular spectral profile as described in more detail below.

[0013] The invention also encompasses a sub-assembly of a self-service apparatus, the sub-assembly being housed in a secure enclosure as described above.

[0014] The invention also encompasses a self-service apparatus comprising a sub-assembly as described above.

[0015] According to another aspect of the invention there is provided a method of protecting or authenticating at least one sub-assembly in a self-service apparatus according to Claim 7.

[0016] Preferably the method further comprises shutting down the self-service apparatus if the trigger is activated.

[0017] Advantageously, the method comprises fixing the particular physical relationship between the markers and sensors in a controlled environment prior to use of the sub-assembly in a self-service apparatus in the field.

[0018] Preferably the step of providing the markers comprises applying paint incorporating the markers to the housing.

[0019] Preferably the sensors are arranged to detect the particular physical relationship by means of monitoring spectral profiles of the markers.

[0020] The preferred features may be combined as appropriate, as would be apparent to a skilled person, and may be combined with any of the aspects of the invention.

[0021] Embodiments of the invention will be described, by way of example, with reference to the following drawings, in which:

Figure 1 is a schematic diagram of a self-service apparatus;

Figure 2 is a schematic diagram of a key-pad assembly of an ATM encased in a housing;

Figure 3 is a schematic diagram of a sub-assembly of a self-service apparatus in a housing having a lid which is removed;

Figure 4 is a flow diagram of a method of protecting or authenticating a sub-assembly in a self-service apparatus.

[0022] Embodiments of the present invention are described below by way of example only. These examples represent the best ways of putting the invention into practice that are currently known to the Applicant although they are not the only ways in which this could be achieved.

[0023] Figure 1 is a schematic diagram of a self-service apparatus 10 comprising sub-assemblies 11, 12, 13. The self-service apparatus 10 is shown as connected to a communications network 14 which comprises a central control center 15. However, it is not essential for the self-service apparatus to be connected in this way; it may also be stand-alone. The self-service apparatus is of any suitable type such as an automated teller machine (ATM), self-service kiosk, pay-as-you-go device (e.g. photocopier, fax, internet terminal, media player) photo booth or other self-service apparatus.

[0024] Figure 1 illustrates three sub-assemblies 11, 12, 13 incorporated in the self-service apparatus 10. These sub-assemblies are of any suitable type and are functional units which may or may not be removably inserted in the self-service apparatus. That is, the sub-assemblies can be of the type where they are easily taken out of and replaced into the self-service apparatus in a "plug and play" type manner. Examples of sub-assemblies comprise key-pad assemblies, cash dispenser pick units, media cassettes, ink cartridges, goods dispensing units; smart card reading units, key-pad assemblies, cash dispensers, encryption assemblies, note recognition assemblies, printer consumables and biometric modules.

[0025] Figure 2 is a schematic plan view of a key-pad assembly 100 of an ATM encased in a housing 102. Within the housing are layers of electronic circuits and other equipment beneath the key-pad itself as known in the art. The housing 102 incorporates one or more markers (not shown) on its inner surfaces or integral with those surfaces. Sensors (not shown) are also provided attached to the contents of the housing 102.

[0026] For example, in the case of a secure enclosure, sensors are located within the sub-assembly being protected by the enclosure. This eliminates the need for sensors external (and therefore vulnerable to attack) to the sub-assembly electronics. In the case of a field-replaceable part, it is possible (although not essential) that a sensor is placed in the replacement part itself.

[0027] Figure 3 is a schematic diagram of a sub-assembly 30 of a self-service apparatus in a housing 31 having a lid 32 which is removed. The sub-assembly 30 comprises sensors 35 fixed to the sub-assembly itself. The sub-assembly 30 is fixed into the housing base 31 although this is not essential.

[0028] The housing base 31 and/or lid 32 also comprise one or more markers 36. For example, these are printed onto the base 31 and lid 32 in regions arranged to align or be substantially opposite the sensors 35 when the housing and sub-assembly are assembled in use.

[0029] Prior to use the sub-assembly is installed in the housing and the markers and sensors calibrated or "set" by authorized personnel such as during manufacturing or at a controlled premises. That is, the sensors are arranged to detect a particular physical relationship between themselves and the markers and to "recognize" particular unique characteristics of the markers. If these relationships or characteristics change or are lost the sensors activate a trigger 37. Thus if the sub-assembly is moved with respect to the housing (or vice versa) the sensors detect this fact. Also, if the sub-assembly is replaced with an unauthorized sub-assembly this fact is detected. In this way it is possible to authenticate sub-assemblies and detect tampering or unauthorized access to the housing.

[0030] The trigger 37 comprises electronic components or other suitable means for shutting down the self-service apparatus, sending an alarm signal to the central control center 15, and/or taking any other suitable damage limitation and security promoting actions.

[0031] The markers can be of any suitable type. In a preferred example, the markers are arranged to provide a spectral profile, for example, by being fluorescent. They are preferably microscopic or of smaller scale (for example, using nanotechnology).

[0032] In a particularly preferred example, the markers comprise rare earth metals, such as lanthanides supported in a suitable medium such as microscopic glass beads. Those glass beads can be incorporated into paint and applied to parts of the housing and/or sub-assembly. Alternatively the glass beads can be incorporated into plastics or other material used to form the housing or sub-assembly. Full details about example suitable markers are provided in European Patent Application EP 1491350. That document describes optically detectable security markers for emitting light at pre-selected wavelengths. The markers comprise a rare-earth dopant and a carrier incorporating the rare earth dopant. The interaction between the carrier and the dopant is such that a fluorescent fingerprint of the marker is different from that of the rare earth dopant. The carrier doped with the rare earth ion has a new energy level profile that allows transitions different to those allowed by either the rare earth element or the undoped carrier. The new energy profile is advantageous for security purposes because it provides narrow emissions at wavelengths not naturally found in either the rare earth element or the undoped carrier.

[0033] The sensors comprise one or more light sources such as LEDs or similar and a receptor arranged to detect particular spectral profiles of the markers in the case that the markers provide a spectral profile. This type of arrangement is particularly advantageous because it is very unlikely that "noise" will be present, that is, material having the same spectral profile outwith the self-service apparatus. This differs from the situation where other types of markers such as RF tags are used. Also, the sensors themselves are small and inexpensive. In addition they are easy to fix to or incorporate in the housing and/or sub-assembly.

[0034] Figure 4 is a flow diagram of a method of protecting or authenticating at least one sub-assembly in a self-service apparatus. The sub-assembly is placed in its housing and one or more markers are fixed to the housing and/or sub-assembly (see box 40 of Figure 4). In a preferred example, the sub-assembly is placed, fixed to, or encased in the housing. The markers and sensors are then set with respect to one another in a secure, authorized environment (see box 41). For example, this is done at the manufacturing site. During this setting or calibration process the sensors are tailored to 'expect' a particular unique spectral signature or other characteristic signal from the markers. This original spectral signature or other characteristic signal (also referred to as a security profile) is stored in the central control centre 15 or in non-erasable memory within the sub-assembly. The security profile is also dependent in part on the physical relationship between the sensor and the marker(s). A trigger is then arranged to activate if the sensors detect loss or change in the physical relationship between the markers and sensors.

[0035] It is also possible for the sensors to be present in the self-service apparatus itself, outwith the sub-assembly. The sensors in this case can be pre-set to detect authorized sub-assemblies for authentication. This is particularly advantageous because it enables replaceable units such as spare parts to be authenticated such that they are only able to operate if they are genuine. For example, consider a sub-assembly enclosed in a housing, the whole housed sub-assembly being a replacement part for a self-service apparatus or other equipment in the field. Markers are attached to or incorporated into the housing as described herein. The self-service apparatus comprises one or more sensors pre-configured to operate with the markers of the sub-assembly housing. When the replacement sub-assembly is inserted into the self-service apparatus, for example, by a field engineer, then the sensors operate with the markers in the housing to authenticate the replacement sub-assembly. In the event that the sub-assembly is not authenticated operation of the self-service device is prevented.

Claims

1. A secure enclosure for protection of at least one sub-assembly (30) in a self-service apparatus (10), said secure enclosure comprising:

(i) a housing (102) arranged to contain the sub-assembly (30);

(ii) one or more markers (36) fixed in said housing (102);

(iii) one or more sensors (35) fixed to the sub-assembly, each sensor (35) being arranged to detect a particular physical relationship between one or more of the markers (36) and itself;

(iv) a trigger (37) arranged to automatically activate if any of the particular physical relationships between the sensors (35) and markers (36) is lost; characterised in that

(v) the marker (36) comprises a rare earth dopant and a carrier incorporating the rare earth dopant, the marker (36) having a fluorescent fingerprint different from that of the rare earth element or the undoped carrier, and said markers (36) each have an associated spectral signature.

2. A secure enclosure as claimed in Claim 1, wherein said markers (36) each comprise microscopic carrier beads.

3. A secure enclosure as claimed in either Claim 1 or Claim 2, wherein said sensors (35) each comprise one or more light sources.

4. A sub-assembly of a self-service apparatus, said sub-assembly being housed in a secure enclosure according to any one of Claims 1 to 3.

5. A sub-assembly as claimed in claim 4 which is selected from a key-pad assembly; a cash dispenser assembly; a card-reader assembly; an encryption assembly; a note recognition assembly; a printer consumable and a biometric module.

6. A self-service apparatus comprising a sub-assembly housed in a secure enclosure according to any one of Claims 1 to 3.

7. A method of protecting or authenticating at least one sub-assembly (30) in a self-service apparatus, said method comprising:

(i) providing a housing (102) arranged to contain the sub-assembly (30);

(ii) providing one or more markers (36) fixed in said housing (102);

(iii) providing one or more sensors (35) fixed to the sub-assembly, each sensor (35) being arranged to detect a particular physical relationship between one or more of the markers (36) and itself;

(iv) automatically activating a trigger (37) if any of the particular physical relationships between the sensors (35) and markers is lost:

characterised by

the marker (36) comprising a rare earth dopant and a carrier incorporating the rare earth dopant, the marker (36) having a fluorescent fingerprint different from that of the rare earth element or the undoped carrier, and said markers (36) each have an associated spectral signature.

8. A method as claimed in Claim 7 which further comprises shutting down the self-service apparatus if the trigger (37) is activated.

9. A method as claimed in Claim 7 or Claim 8, which further comprises fixing the particular physical relationship between the markers (36) and sensors (35) in a controlled environment prior to use of the sub-assembly (30) in a self-service apparatus in the field.

10. A method as claimed in any one of Claims 7 to 9, wherein said step of providing the markers (36) comprises applying paint incorporating the markers (36) to the housing.

11. A method as claimed in any one of Claims 7 to 10, wherein said sensors (35) are arranged to detect the particular physical relationship by means of monitoring spectral profiles of the markers(36).

Ansprüche

1. Sicheres Gehäuse zum Schutz von mindestens einer Teilbaugruppe (30) in einer Selbstbedienungsvorrichtung (10), wobei das sichere Gehäuse umfasst:

(i) ein Gehäuse (102), das ausgeführt ist, die Teilbaugruppe (30) zu enthalten;

(ii) eine oder mehrere Markierungen (36), die in dem Gehäuse (102) fixiert sind;

(iii) einen oder mehrere Sensoren (35), die an der Teilbaugruppe fixiert sind, wobei jeder Sensor (35) ausgeführt ist, eine bestimmte physische Beziehung zwischen einer oder mehreren von den Markierungen (36) und sich selbst zu detektieren,

(iv) einen Auslöser (37), der ausgeführt ist, automatisch aktiviert zu werden, wenn irgendeine der bestimmten physischen Beziehungen zwischen den Sensoren (35) und Markierungen (36) verloren gegangen ist; dadurch gekennzeichnet, dass

(v) die Markierung (36) einen Seltenerddotierstoff und einen Träger umfasst, der den Seltenerddotierstoff einschließt, wobei die Markierung (36) einen fluoreszierenden Fingerabdruck aufweist, der sich von dem des Seltenerdelements oder des undotierten Trägers unterscheidet, und die Markierungen (36) jeweils eine zugehörige spektrale Signatur aufweisen.

2. Sicheres Gehäuse nach Anspruch 1, wobei die Markierungen (36) jeweils mikroskopische Trägerteilchen umfassen.

3. Sicheres Gehäuse nach Anspruch Anspruch 1 oder Anspruch 2, wobei die Sensoren (35) jeweils eine oder mehrere Lichtquellen umfassen.

4. Teilbaugruppe einer Selbstbedienungsvorrichtung, wobei die Teilbaugruppe in einem sicheren Gehäuse nach einem der Ansprüche 1 bis 3 aufgenommen ist.

5. Teilbaugruppe nach Anspruch 4, die ausgewählt ist aus einer Tastenfeldbaugruppe; einer Bankautomatbaugruppe; einer Kartenleserbaugruppe; einer Verschlüsselungsbaugruppe; einer Hinweiserkennungsbaugruppe; einem Druckerverbrauchsartikel und einem biometrischen Modul.

6. Selbstbedienungsvorrichtung, umfassend eine Teilbaugruppe, die in einem sicheren Gehäuse nach einem der Ansprüche 1 bis 3 aufgenommen ist.

7. Verfahren zum Schützen oder Authentifizieren von mindestens einer Teilbaugruppe (30) in einer Selbstbedienungsvorrichtung, wobei das Verfahren umfasst:

(i) Vorsehen eines Gehäuses (102), das ausgeführt ist, die Teilbaugruppe (30) zu enthalten;

(ii) Vorsehen von einer oder mehreren Markierungen (36), die in dem Gehäuse (102) fixiert sind;

(iii) Vorsehen von einem oder mehreren Sensoren (35), die an der Teilbaugruppe fixiert sind, wobei jeder Sensor (35) ausgeführt ist, eine bestimmte physische Beziehung zwischen einer oder mehreren von den Markierungen (36) und sich selbst zu detektieren;

(iv) automatisches Aktivieren eines Auslösers (37), wenn irgendeine der bestimmten physischen Beziehungen zwischen den Sensoren (35) und Markierungen verloren gegangen ist:

dadurch gekennzeichnet,

dass die Markierung (36) einen Seltenerddotierstoff und einen Träger umfasst, der den Seltenerddotierstoff einschließt, wobei die Markierung (36) einen fluoreszierenden Fingerabdruck aufweist, der sich von dem des Seltenerdelements oder des undotierten Trägers unterscheidet, und die Markierungen (36) jeweils eine zugehörige spektrale Signatur aufweisen.

8. Verfahren nach Anspruch 7, welches ferner das Abschalten der Selbstbedienungsvorrichtung umfasst, wenn der Auslöser (37) aktiviert wird.

9. Verfahren nach Anspruch 7 oder Anspruch 8, welches ferner das Fixieren der bestimmten physischen Beziehung zwischen den Markierungen (36) und Sensoren (35) in einer kontrollierten Umgebung vor dem Gebrauch der Teilbaugruppe (30) in einer Selbstbedienungsvorrichtung vor Ort umfasst.

10. Verfahren nach einem der Ansprüche 7 bis 9, wobei der Schritt des Vorsehens der Markierungen (36) das Aufbringen von die Markierungen (36) einschließender Farbe auf das Gehäuse umfasst.

11. Verfahren nach einem der Ansprüche 7 bis 10, wobei die Sensoren (35) ausgeführt sind, die bestimmte physische Beziehung mittels des Überwachens spektraler Profile der Markierungen (36) zu detektieren.

Revendications

1. Enceinte de sécurité pour la protection d'au moins un sous-ensemble (30) dans un appareil en libre-service (10), ladite enceinte de sécurité comprenant :

(i) un boîtier (102) agencé pour contenir le sous-ensemble (30) ;

(ii) un ou plusieurs marqueurs (36) fixés dans ledit boîtier (102) ;

(iii) un ou plusieurs capteurs (35) fixés au sous-ensemble, chaque capteur (35) étant agencé pour détecter une relation physique particulière entre un ou plusieurs des marqueurs (36) et lui-même ;

(iv) un déclencheur (37) disposé pour s'activer automatiquement si l'une quelconque des relations physiques particulières entre les capteurs (35) et les marqueurs (36) est perdue ; caractérisée en ce que

(v) le marqueur (36) comprend un dopant aux terres rares et un support incorporant le dopant aux terres rares, le marqueur (36) ayant une empreinte fluorescente différente de celle de l'élément des terres rares ou du support non dopé, et lesdits marqueurs (36) ont chacun une signature spectrale associée.

2. Enceinte de sécurité selon la revendication 1, dans laquelle lesdits marqueurs (36) comprennent chacun des billes de support microscopiques.

3. Enceinte de sécurité selon la revendication 1 ou la revendication 2, dans laquelle lesdits capteurs (35) comprennent chacun une ou plusieurs sources de lumière.

4. Sous-ensemble d'un appareil en libre-service, ledit sous-ensemble étant logé dans une enceinte sécurisée selon l'une quelconque des revendications 1 à 3.

5. Sous-ensemble selon la revendication 4 qui est choisi dans un ensemble clavier ; un ensemble distributeur de billets ; un ensemble lecteur de carte ; un ensemble de cryptage ; un ensemble de reconnaissance de note ; un consommable d'imprimante et un module biométrique.

6. Appareil en libre-service comprenant un sous-ensemble logé dans une enceinte sécurisée selon l'une quelconque des revendications 1 à 3.

7. Procédé de protection ou d'authentification d'au moins un sous-ensemble (30) dans un appareil en libre-service, ledit procédé comprenant :

(i) la fourniture d'un boîtier (102) agencé pour contenir le sous-ensemble (30) ;

(ii) la fourniture d'un ou plusieurs marqueurs (36) fixés dans ledit boîtier (102) ;

(iii) la fourniture d'un ou plusieurs capteurs (35) fixés au sous-ensemble, chaque capteur (35) étant agencé pour détecter une relation physique particulière entre un ou plusieurs des marqueurs (36) et lui-même ;

(iv) l'activation automatique d'un déclencheur (37) si l'une des relations physiques particulières entre les capteurs (35) et les marqueurs est perdue :

caractérisé par

le marqueur (36) comprenant un dopant aux terres rares et un support incorporant le dopant aux terres rares, le marqueur (36) ayant une empreinte fluorescente différente de celle de l'élément aux terres rares ou du support non dopé, et lesdits marqueurs (36) ont chacun une signature spectrale associée.

8. Procédé selon la revendication 7, qui comprend en outre l'arrêt de l'appareil en libre service si le déclencheur (37) est activé.

9. Procédé selon la revendication 7 ou la revendication 8, qui comprend en outre la fixation de la relation physique particulière entre les marqueurs (36) et les capteurs (35) dans un environnement contrôlé avant l'utilisation du sous-ensemble (30) dans un appareil en libre-service sur le terrain.

10. Procédé selon l'une quelconque des revendications 7 à 9, dans lequel ladite étape consistant à fournir les marqueurs (36) comprend l'application d'une peinture incorporant les marqueurs (36) au boîtier.

11. Procédé selon l'une quelconque des revendications 7 à 10, dans lequel lesdits capteurs (35) sont agencés pour détecter la relation physique particulière au moyen de la surveillance des profils spectraux des marqueurs (36).

Drawing