WO2009074994A1

WO2009074994A1 - Biometrics based device for converting regular ndc, ddc or proprietary communication protocol based automated teller machines, kiosks, self service terminals or full service terminals with pin (personal identification number) authentication to biometric based authentication

Info

Publication number: WO2009074994A1
Application number: PCT/IN2007/000588
Authority: WO
Inventors: Vasantlal Khinvasara Abhay
Original assignee: Vasantlal Khinvasara Abhay
Priority date: 2007-12-12
Filing date: 2007-12-12
Publication date: 2009-06-18

Abstract

Biometrics is used to identify or verify a person based on what s/he is rather than what s/he knows or has. Self-service terminals use data encryption to verify the identity of a person based on what the person knows i.e. a Personal Identification Number or PIN and what the person has example a card or token. PINs can be compromised are difficult to remember and hence easily forgotten. In this patent a device a device comprising: data input, output, processing, software, firmware, hardware with a fingerprint or biometric information acquirer is proposed, that converts a regular ATM or a self-service terminal to a biometric based ATM or self-service terminal. The basic PIN authentication feature of the existing ATM or self-service terminal remains intact and hence the ATM or self-service terminal can remain in use as it is. There are some configuration changes to the ATM software that may or may not have to be done. The device proposed provides the user with a choice to either use the PIN and/ or Biometric form of authentication. This patent further describes the way in which the communication happens between the device proposed and the Electronic Funds Transfer Switch (EFTS) or host and the changes that may be required to the EFTS or host software. In addition to the proposed device, an electronic hardware device with the required software for the purpose of biometric registration of users of the ATM or self-service terminal is also proposed. In addition to the above two, a Biometric Security Module hardware and software that matches the biometric information on the EFTS or host side is also proposed. The matching alternatively can also be done on the proposed device itself or even the ATM or self-service terminal.

Description

BIOMETRICS BASED DEVICE FOR CONVERTING REGULAR NDC, DDC OR PROPRIETARY COMMUNICATION PROTOCOL BASED AUTOMATED TELLER MACHINES, KIOSKS, SELF SERVICE TERMINALS OR FULL SERVICE TERMINALS WITH PIN (Personal Identification Number) AUTHENTICATION TO BIOMETRIC BASED AUTHENTICATION.

PREAMBLE TO THE DESCRIPTION Field of Invention

The present invention relates to biometrics based device for converting regular ndc, ddc or proprietary communication protocol based automated teller machines, kiosks, self service terminals or full service terminals with pin (personal identification number) authentication to biometric based authentication.

Background of Invention & Related Arts:

For the time being the TDES PIN verification techniques currently in use are reasonably secure. TDES is short for Triple Data Encryption Standard and is an encrypting technique that uses the DES or Data Encryption Standard for encryption and is developed for the purpose of secure data transmission. TDES is replacing DES, which is also an encrypting algorithm and has been in use for some time now as the security level of DES have diminished due to advancement in computing power essentially used for exhaustive attacks for finding the clear text. However in TDES or DES, the association between the PIN and the actual user is based on what the user knows. Many users write the PIN on the card or token so that they do not forget it. Hence essentially the loss of the card results in the loss of the PIN. PINs are also prone to wireless camera attacks where the camera is mounted near the PIN pad of the ATM or self-service terminal and transmits the images of the user using the PIN pad, in effect compromising the PIN. A Biometric used for authentication is secure and convenient and the responsibility of remembering something is taken away from the user.

Biometrics technology has stabilized and several governments of developed countries are using some form of a biometric for positive identification of people. It is now a well-accepted means of authentication. There are a huge and growing number of already deployed ATMs or self-service terminals in the world. A simple and easy to deploy solution is required that can connect a biometric authentication device to an existing ATM or self-service terminal and make it biometric enabled.

Existing ATM or self-service terminal networks, inter alias, use communication protocols like the NDC and the DDC and hardware to manage security and higher levels of service more efficiently. The proposed device requires a minimal change in the protocols already in place and can be easily adapted to work with any protocol.

A SAMPLE ATM or SELF-SERVICE TERMINAL LAYOUT: As shown in figure 1.

DESCRIPTION OF THE INVENTION

PROPOSED DEVICE:

The proposed device as shown in figure 2; has several input output ports, for example: Ethernet, USB etc. The proposed device is connected to the ATM or the self-service terminal via a data input port and the Electronics Funds Transfer (EFT) switch or other host if required to further process the data via the data output port. Once connected this way, the proposed device's IP -if using the Ethernet port- may be configured to that of the ATM or self-service terminal host to which the proposed device is connected and in the EFT switch or host, the ATM or self-service terminal IP may be configured to be the proposed device's IP. SAMPLE PROCESS FLOW FOR THE NDC APTRA PROTOCOL USED BY CERTAIN SELF-SERVICE TERMINALS INCLUDING ATMS

The following is the sample flow of how the proposed device controls the ATM or self-service terminal and how it handles the messages from and to the ATM or self-service terminal and EFT switch or host:

The proposed device is configured for biometric verification Operation Code Buffer. In the ATM or self-service terminal, the State Load must be changed to ask customer for PIN or Biometric verification. In case of Biometric verification, the ATM or self-service terminal is configured to not ask for PIN entry and directly go to transaction selection. ATM or self-service terminal gathers all transaction information and sends it to the proposed device. On receiving the transaction request information the proposed device checks the Operation Code Buffer for the configured Operation Code Buffer. If the configured Operation Code Buffer and Operation Code Buffer in the transaction message match, the proposed device prompts the user for Biometric entry on the attached biometric sensor. On successful grabbing of Biometric information, the proposed device generates the required Biometric Templates and appends one field separator at the end of original transaction message followed by the Biometric Template so acquired. The Proposed device then sends this newly created transaction message to the EFT switch or host. All other messages coming from the ATM or self-service terminal to the proposed device are sent directly to the EFT switch or host without any modifications. The proposed device can be configured for number of attempts for a good and matching Biometric information.

The following is a sample of the flow of how the EFT switch or host. or any other ATM or self-service terminal routing/ controlling system handles the messages it receives from the proposed device and the role of the Biometric Security Module (BSM): The EFT switch or host or any other system receives the message /data from the proposed device and separates the biometric information along with the card data from the transaction part of the message. It sends this authentication and card information to the BSM. The BSM uses this information to compare the biometric information it has just received to the biometric information it has stored in its database associated with that card data. The result is conveyed to the EFT switch or any other controlling software. The rest of the transaction processings may not be changed.

Hardware Description of the Proposed Device:

Computer Processing Unit: Appropriate processor

Volatile Memory: 2MB or appropriate

Non-volatile Memory: 8MB or appropriate

Screen: Color or Monochrome, Graphics, Character

Biometric Sensor Type: Optical, Capacitive, Thermal, Ultrasound

Card Reader Type: Magnetic, Chip, Proximity

Keypad: Numeric, Alphanumeric. If Encryption of the Biometric

Information is required than a TDES PIN pad can be used

Mouse: If required

Operating System: Linux, Windows, Unix, OS2

BIOMETRIC SECURITY MODULE {BSM1:

The BSM is used for giving online service to the EFT switch or any other ATM or self-service terminal controlling system, the BRM or even the proposed device. The BSM is always in the listening mode for the request messages from the EFT switch or any other ATM controlling system, the BRM or the proposed device. Several different data channels can be used for the purpose of communication. Sample Hardware Description of the BSM:

Computer Processing Unit: Appropriate processor

Volatile Memory: 2MB or appropriate

Non-volatile Memory: 8MB or appropriate

Screen: Color or Monochrome, Graphics, Character

Biometric Sensor Type: Optical, Capacitive, Thermal, Ultrasound

Card Reader Type: Magnetic, Chip, Proximity

Keypad: Numeric, Alphanumeric. If Encryption of the Biometric

Information is required than a TDES PIN pad can be used

Mouse: If required

Operating System: Linux, Windows, Unix, OS2

BIOMETRIC REGISTRATION MODULE (BRM): a. BRM helps register a Customer using his/her biometric against his/her account number and card or token number. This biometric data can be stored in a separate database like the BSM, on the proposed device itself, on the ATM or self-service terminal or even on a card or token. The proposed device can also be used for the purpose of registration of users.

Sample Process Flow of a BRM

Customer Registration

• The unique identification information is fed into the BRM.

• Customer provides biometric data as required

• After scanning and acquiring the required biometric data the registration process can include other relevant information of the user.

Data transmission

• The BRM converts the images acquired above to Biometric Templates

• A volatile or non-volatile memory capable of temporarily saving up to a certain number of customer registrations (based on the security levels required by the service provider) can be provided in the BRM. At the end of those specific registrations, data is transmitted to the BSM and the temporary storage may be deleted. The BRM can also run in live mode continuously uploading data if the connectivity bandwidth is broad enough.

Sample Hardware Description:

Computer Processing Unit: Appropriate

Volatile Memory: 2MB or appropriate

Non-volatile Memory: 8MB or appropriate

Screen: Color or Monochrome, Graphics or Character

Biometric Sensor Type: Optical, Capacitive, Thermal, Ultrasound etc.

Card Reader Type: Magnetic, Chip, Proximity Keypad: Numeric, Alphanumeric Mouse: If required Operating System: Linux, Windows, Unix, OS2

SAMPLE OF KEY MANAGEMENT AND DATA EXCHANGE PROCESSES BETWEEN THE VARIOUS COMPONENTS OF THE ATM OR SELF-SERVICE TERMINAL AND PROPOSED DEVICE (WITHOUT ENCRYPTION):

THE REGISTRATION PROCESS:

• Acquisition of the image from the biometric data scanner

• Make Template

• Send for storage, either to the BSM or to some other device

BIOMETRIC STORAGE PROCESS

• Acquire Template from the Biometric Registration Device

• Check for data integrity and save into the Database. BIOMETRIC MATCHING

• The Biometric Matching engine matches the received Biometric Template either with a corresponding stored Template, with the entire stored Template database or a portion of the stored Template database

• The result is utilized appropriately

• If the BSM is used, it does the matching as described above and communicates the result to the EFT switch or host or any- controlling software

PROPOSED DEVICE OPERATIONS

• The user on initiating the transaction either by the use of a card or token selects amongst the options of PIN or Biometric

• If Biometric is selected as an authentication option then the ATM or self-service terminal collects all transaction information from customer and sends the information to the proposed device

• The proposed device accepts the information from the ATM or self- service terminal and verifies that the information is for Biometric authentication by ascertaining that the PIN portion of the information received from the ATM or self-service terminal is empty.

• The Proposed device acquires the image from the Biometric Data Scanner

• Makes Template

• Appends the Field Separator and the Biometric Template at the end of the Transaction information and sends the Transaction Request Message to the EFT switch or host or any controlling software.

• If the user chooses PIN authentication then the proposed device directly sends the information it receives from the ATM or self- service terminal to the EFT switch or host or any controlling software. • On receipt of response from Switch the Proposed device transfers the reply to the ATM or self-service terminal

EFT SWITCH, HOST OR ANY ROUTING/ CONTROLLING SYSTEM OPERATION

• Receive the Transaction Request message from the proposed device

• Separate the Template Data from the Transaction Request Message

• Send the Template Data with Customer Information to BSM or match it within itself

• Get the Result and send appropriate response to ATM or any other self-service terminal or to the service provider host.

SAMPLE OF KEY MANAGEMENT AND DATA EXCHANGE PROCESSES BETWEEN THE VARIOUS COMPONENTS OF AN ATM OR ANY SELF- SERVICE TERMINAL SYSTEM (WITH ENCRYPTION):

Using appropriate encryption decryption devices like an Encrypting PIN pad or an HSM or even by any appropriate hardware or software, encryption and decryption of the Biometric data can be achieved. The rest of the processes remain the same as described in the earlier section.

PROPOSED DEVICE COMPRISING ATM or SELF-SERVICE TERMINAL LAYOUTS: As Shown in Figure 3 and Figure 4 Sample Changes To The Transaction Request Message for the NDC protocol:

The regular NDC message will have a field- separator at the end following which will be the Biometric Template. In case the user Biometric option while transacting, then the PIN buffer has just space characters. If the user is using PIN for authentication, then the PIN buffer does not have any spaces.

In case the authentication is Biometric, the switch will extract the Template and send it to the BSM along with the information as specified in the message format as below. The BSM will perform the authentication and provide the result in the format as specified below.

Sample Message Format:

Request:

Following is the message format for the communication from the

SWITCH to BAS for the verification. Each field is separated by field separating character (chr(lC)).

Response:

Following is the message format of reply from the BAS to SWITCH for the verification. Each field is separated by field separating character (ChT(IC)).

Claims

I CLAIM:

1. A biometrics based device for converting regular ndc, ddc or proprietary communication protocol based automated teller machines, kiosks, self service terminals or full service terminals with pin (personal identification number) authentication to biometric based authentication.

2. A device as claimed in claim 1 above, comprising of data input, output, processing, software, firmware, hardware with a fingerprint or biometric information acquirer, that forwards this data to the sender or another receiver for further processing.

3. A device as claimed in claims 1 85 2 above, comprising of data input, output, processing, software, firmware, hardware with a fingerprint or biometric information acquirer, an input device like a keypad, that forwards this data in an appropriate format to the sender or another receiver for further processing.

4. A device as claimed in claims 1, 2 & 3 above, comprising of data input, output, processing, software, firmware, hardware with a fingerprint or biometric information acquirer, an input device like a keypad, a LCD graphics or character display, that forwards this data in an appropriate format to the sender or another receiver for further processing.

5. A device as claimed in claims 1, 2, 3 & 4 above, comprising of data input, output, processing, software, firmware, hardware with a fingerprint or biometric information acquirer, an input device like a keypad, a LCD graphics or character display, a card reader, that forwards this data in an appropriate format to the sender or another receiver for further processing.

6. A device as claimed in claims 1, 2, 3, 4 & 5 above, comprising of data input, output, processing, software, firmware, hardware with a fingerprint or biometric information acquirer, that compares this so acquired data with data stored in this device or obtained from a source either internal or external and sends the result in an appropriate format to the sender or another receiver for further processing or processes it itself.

7. A device as claimed in claims 1, 2, 3, 4, 5 & 6 above, comprising of data input, output, processing, software, firmware, hardware with an acquisition device like a fingerprint or biometric information acquirer, an input device like a keypad, that compares this so acquired data with data stored in this device or obtained from a source either internal or external and sends the result in an appropriate format to the sender or another receiver for further processing or processes it itself.

8. A device comprising: data input, output, processing, software, firmware, hardware with an acquisition device like a fingerprint or biometric information acquirer, an input device like a keypad, a LCD graphics or character display, that compares this so acquired data with data stored in this device or obtained from a source either internal or external and sends the result in an appropriate format to the sender or another receiver for further processing or processes it itself.

9. A device as claimed in claims 1, 2, 3, 4, 5 SB 6 above, comprising of data input, output, processing, software, firmware, hardware with an acquisition device like a fingerprint or biometric information acquirer, an input device like a keypad, a LCD graphics or character display, a card reader, that compares this so acquired data with data stored in this device or obtained from a source either internal or external and sends the result in an appropriate format to the sender or another receiver for further processing or processes it itself.