FIELD OF THE INVENTIONThe present invention relates to electronic devices containing sensitive data generally and more particularly to tamper-protected point of sale terminals.
BACKGROUND OF THE INVENTIONThe following U.S. Patent documents are believed to represent the current state of the art: U.S. Pat. Nos. 6,646,565; 6,917,299 and 6,853,093. The disclosures of these patent documents are hereby incorporated herein by reference.
SUMMARY OF THE INVENTIONThe present invention seeks to provide an improved security system for electronic devices, especially tamper-protected point of sale terminals and other devices containing sensitive information, such as personal data. For the purposes of the present description and claims, the term “point of sale terminals” includes, inter alia, PIN pads, electronic cash registers, ATMs, card payment terminals and the like.
There is thus provided in accordance with a preferred embodiment of the present invention a device for containing sensitive data including a housing, an anti-tamper protected enclosure located within the housing and being adapted to contain the sensitive data, anti-tamper protection circuitry located within the anti-tamper protected enclosure and at least one ball grid array device arranged within the housing, mounted on an outer surface of the anti-tamper protected enclosure and electrically coupled to the anti-tamper protection circuitry for protecting against unauthorized access to the interior of the anti-tamper protected enclosure.
The term “ball grid array device” refers to an electrical circuit device enclosed in a ball grid array package.
Preferably, the device also includes a confidential data storage element located within the anti-tamper protected enclosure. Additionally or alternatively, the device also includes a data entry element mounted in the housing. The ball grid array device preferably includes wire-bonded circuitry.
Preferably, the anti-tamper protection circuitry is operative, in the event of physical tampering with at least one of the at least one ball grid array device, to perform at least one of the following actions: generate an alarm indication, disable the device and erase the sensitive data.
In accordance with a preferred embodiment the device is a point of sale terminal.
There is also provided in accordance with another preferred embodiment of the present invention an anti-tamper protected enclosure including anti-tamper protection circuitry located within the anti-tamper protected enclosure and at least one ball grid array device mounted on an outer surface of the anti-tamper protected enclosure and electrically coupled to the anti-tamper protection circuitry for protecting against unauthorized access to the interior of the anti-tamper protected enclosure. Preferably, the ball grid array device comprises wire-bonded circuitry.
Preferably, the anti-tamper protected enclosure includes at least one grid which is electrically coupled to the anti-tamper protection circuitry. Additionally, the anti-tamper protection circuitry is coupled to the at least one conductor network via the at least one ball grid array device. Additionally, the anti-tamper protection circuitry is coupled to the at least one conductor network by electrical connections extending through vias which are physically protected by the at least one ball grid array device.
Preferably, the physical location of the at least one ball grid array device is selected to provide physical protection to at least one electrical connection within the anti-tamper protected enclosure. Additionally or alternatively, the at least one ball grid array device includes balls which are not electrically connected to the anti-tamper protection circuitry.
Preferably, the anti-tamper protected enclosure includes at least one flexible printed circuit board. Additionally or alternatively, the anti-tamper protected enclosure includes at least one rigid printed circuit board.
Preferably, the anti-tamper protected enclosure also has a confidential data storage element located within.
Preferably, the anti-tamper protected circuitry includes a comparison circuit. Additionally or alternatively, the anti-tamper protection circuitry is operative, in the event of physical tampering with at least one of the at least one ball grid array device, to generate an alarm indication.
BRIEF DESCRIPTION OF THE DRAWINGSThe present invention will be understood and appreciated more fully from the following detailed description taken in conjunction with the drawings in which:
FIG. 1 is a simplified pictorial illustration of a point of sale terminal constructed and operative in accordance with a preferred embodiment of the present invention;
FIG. 2 is a partially cut-away simplified pictorial illustration of an anti-tamper protected enclosure forming part of the point of sale terminal ofFIG. 1;
FIG. 3 is a simplified circuit diagram of electrical connections to anti-tamper protection circuitry employed in the point of sale terminal ofFIGS. 1 & 2; and
FIG. 4 is a simplified, generalized illustration of part of the circuitry ofFIG. 3.
DETAILED DESCRIPTION OF PREFERRED EMBODIMENTSReference is now made toFIGS. 1 & 2, which are a simplified pictorial illustration of a point ofsale terminal100 and a partially cut-away simplified pictorial illustration of an anti-tamper protected enclosure forming part of the point ofsale terminal100 constructed and operative in accordance with a preferred embodiment of the present invention. The point of sale terminal ofFIG. 1 preferably includes ahousing110 and a data entry element, such as akeyboard112, mounted in the housing. Preferably an anti-tamper protectedenclosure114 is located within thehousing110 and includes one or more conductor networks, such asnetworks116 and117, of embeddedelectrical conductors118 which are electrically connected toanti-tamper protection circuitry120, typically in the form of an integrated circuit located within the anti-tamper protectedenclosure114.
Anti-tamper protectedenclosure114 may be formed of any suitable material. For example, it may be formed of a plurality of printed circuit boards wherein the conductor networks are defined byconductors118 formed on one or more layers thereof, preferably including embedded layers. As an alternative, a rigid or non-rigid enclosure may be provided and wrapped in one or more layers of flexible circuit boards having formed thereon or imbedded therein one or more conductor networks.
In accordance with a preferred embodiment of the present invention, at least one ballgrid array device124, which includes encapsulation which provides enhanced physical protection, is arranged within thehousing110 and mounted on anouter surface126 of the anti-tamper protectedenclosure114. The ballgrid array device124 preferably is electrically coupled to the anti-tamper protection circuitry and to conductor network orconductor networks116 and117 for protecting against unauthorized access to the anti-tamper protectedenclosure114 and more specifically against access to critical circuit elements, such asdata storage elements128,anti-tamper protection circuitry120 and electrical connections, such asvias130 thereto. It is appreciated that were such critical circuit elements accessible to an unauthorized person, highly confidential information, such as encryption keys and personal identification information, could be compromised.
In the illustrated embodiment ofFIGS. 1 & 2, two ballgrid array devices124 are provided on two oppositely facing outside surfaces of protectedenclosure114. It is appreciated that a greater or lesser number of ballgrid array devices124 may be employed on any suitable surface of theenclosure114, in accordance with the circuit layout therein. Preferably, the placement of the ballgrid array devices124 is such that they physically overlie critical circuit elements mounted or otherwise located at generally the same location.
Reference is now made toFIGS. 3 and 4, which illustrate a preferred arrangement of electrical connections toanti-tamper protection circuitry120. It is seen that preferably there is provided a pair of electrically parallel conductive pathways, each providing a connection extending between a voltage source across one ormore conductor networks117 of embedded electrical conductors, across various conductive paths at least partially defined by the ball grid array device and by one ormore conductor networks116, including selected resistances, to inputs ofanti-tamper protection circuitry120.Anti-tamper protection circuitry120 preferably includes a comparison circuit which compares the impedance along the parallel pathways such that any physical tampering with the ball grid array device will result in an alarm indication being produced byanti-tamper protection circuitry120.Anti-tamper protection circuitry120 may take protective steps, such as disabling the point of sale terminal, erasure of all data ondata storage elements128 and sending a tamper alert message.
It is appreciated that the arrangement of the various conductive paths defined by the ballgrid array device124 may be arbitrary but preferably includes conductive paths interconnecting balls which do not lie at the periphery of the ball grid array device. It is appreciated that not all balls necessarily form part of the connections.
In the illustrated example ofFIG. 3, a DCvoltage source VSRAM200 is provided, typically at a voltage of 3.3 Volts, and is coupled in series via aresistor202 and via afirst conductor network117 to a ball A forming part of ballgrid array device124. Aground connection204 is coupled in series via aresistor206 and via anotherconductor network117 to a ball B of ballgrid array device124.
Ball A is electrically connected within the ballgrid array device124, preferably by wire bonding, to a ball C of the ballgrid array device124. Ball C is connected in series via aresistor208 and via a portion of aconductor element116 to a ball D of ballgrid array device124. Ball D is electrically connected, preferably by wire bonding, to a ball E of the ballgrid array device124. Ball E is connected via a portion ofconductor network116 in series via aresistor210 and aresistor212 to afirst input terminal214 ofanti-tamper protection circuitry120.
Ball C is connected via a portion ofconductor network116 in series via aresistor216 to a ball F of the ballgrid array device124. Ball F is electrically connected, preferably by wire bonding, to a ball G of the ballgrid array device124. Ball G is connected via a portion ofconductor network116 in series via aresistor218 and viaresistor212 to thefirst input terminal214 ofanti-tamper protection circuitry120.
Circuitry which is similar or identical to that described hereinabove may be connected between ball B and asecond input terminal219 ofanti-tamper protection circuitry120.
Aportion220 forming part of one of the parallel pathways in the above-described circuitry is shown in detail inFIG. 4.FIG. 4 illustrates, in somewhat expanded form, for the sake of clarity, a four layer PCB, which typically forms a wall of the enclosure114 (FIGS. 1 & 2) onto which ball grid array device124 (FIGS. 1 & 2) is mounted.
It is seen inFIG. 4 that a series connection betweenresistor208 and ball C passes along a plated through hole (PTH) via221. A series connection betweenresistor216 and ball C passes along a PTH via222 and via a portion ofconductor network116. A series connection betweenresistor208 and ball D passes along a PTH via224, via a portion ofconductor network116 and along a PTH via226. A series connection betweenresistor216 and ball F passes along a PTH via228. A series connection between ball E andresistor210 passes along a PTH via230, along a portion ofconductor network116 and along a blind via232. A series connection betweenresistor218 and ball G passes along a blind via234, along a portion ofconductor network116 and along a PTH via236. A series connection between ball A andresistor202 passes along a PTH via238 and along aconductor network117. A series connection is also provided betweenresistor212 andparallel resistors210 and218.
Ball A is connected to ball C within the ballgrid array device124, preferably by wire bonding, via analuminum conductor240. Ball G is connected to ball F within the ballgrid array device124, preferably by wire bonding. Ball E is connected to ball D within the ballgrid array device124, preferably by wire bonding.
Preferably, the ballgrid array device124 is placed at a location overlying the various vias, as shown, which substantially inhibits unauthorized access to those vias.
It is appreciated that multiple circuits similar to the circuitry described hereinabove may be provided. It is also appreciated that the printed circuit boards may be of any suitable number of layers, preferably two layers or more. It is additionally appreciated that the ball grid array device may be employed to provide protection to various types of vias carrying sensitive signals, such as through vias, blind vias and buried vias.
According to an alternative embodiment, the conductor network may be obviated and the ball grid array device is connected directly to the tamper-detection circuitry. According to another alternative embodiment, various conductor networks may be connected to various voltage sources, each of a different voltage.
It will be appreciated by persons skilled in the art that the present invention is not limited by what has been particularly shown and described hereinabove. Rather the scope of the present invention includes both combinations and sub-combinations of various feature of the invention and modifications thereof which may occur to persons skilled in the art upon reading the foregoing description and which are not in the prior art.