Ncr Corporation

Ncr Atleos Corporation

Ncr Alleos Corporation

Anthony Edward Roper

Graham Flett

Kerry Elissa Archibald

Weston Lee Hecker

Colin Herkes

Tomasz Kruczek

Shelley Jackson

Kerry E Archibald

Curtis Charles Menmuir

Gameelah Ghafoor

Boot firmware of a terminal sets a lock password on a hard disk drive of the terminal to lock the hard disk drive from access. The password is obfuscated in boot variables or stored separately on a server independently of the terminal. During subsequent boots of the terminal, the firmware de-obfuscates the password from the boot variables or obtains the password from the server and provides the password to the hard disk drive, which causes the hard disk drive to unlock for operation with the terminal following the subsequent boots.

Hard drive anti-theft protection

A system and method for operating a terminal such as an automated teller machine or other type of self-service terminal having a primary partition of a hard disk encrypted with a disk encryption key (DEK). At the initial installation and after every boot, a pre-boot manager encrypts the DEK with a new key encryption key (KEK) and then splits the encrypted DEK into a plurality of encrypted DEK parts. The pre-boot manager next stores the plurality of encrypted DEK parts in randomized storage locations on an unallocated portion of a hard disk and encrypts a list of the randomized storage locations of the plurality of encrypted DEK parts with the KEK and storing the encrypted list in a location on the unallocated portion of the hard disk. Finally, the pre-boot manager stores the KEK, optionally in an obfuscated format, in a location on the unallocated portion of the hard disk.

System and method for providing a secure locally-based boot disk encryption key

Various embodiments herein each include at least one of systems, methods, and software for SST secure boot device order modification. One such embodiment, in the form of a method performed by a server, includes, receiving a request from a mobile device app to modify a boot order of a computer controlling operation of an SST. The method proceeds by authenticating the request. When the request is authenticated, the server performing the method then sends a command to the SST to modify the boot order of the SST.

Self-service terminal secure boot device order modification

Two-factor authentication is processed on a transaction terminal before access is provided to a secure resource of the transaction terminal. A first factor authentication is performed to authenticate an identifier and a credential of a user. A unique challenge is sent, in response to a successful first factor authentication, to a secure device interfaced to the transaction terminal. A one-time unique signed response is received from the secure device in response to the unique challenge and a user action that depresses a button on the secure device. The one-time unique signed response is compared against what is expected from the secure device. When the comparison is successful, a user identity for the user is set, a security role is set for the user identity, and the user is granted access to the secure resource with the set security role.

Terminal authenticated access

An address for a protected resource of a device is randomized at configurable intervals of time as a randomized address. The randomized address is pushed to the Operation System (OS) for mapping the randomized address to an OS identifier for the protected resource. Other devices of a network produce a same randomized address for the protected resource based on a time-based synchronization.

Polymorphic network interface

An input peripheral agent intercepts input commands on a host machine and enforces policy conditions and whitelist conditions before deciding whether to permit the commands to be processed by an operating system of the host or whether to ignore the commands on the host machine. In an embodiment, the policy conditions and whitelist conditions can be dynamically changed by a remote network manager without changing, stopping, and/or restarting the input peripheral agent and/or the host machine.

Input peripheral device security

A whitelist of hash values for applications is signed and encrypted by a remote device and the encrypted whitelist is securely delivered over a network connection to a second device as an encrypted whitelist. The second device decrypts the whitelist and validates the signature of the remote device for the decrypted whitelist. Hash values in the decrypted version of the encrypted whitelist are compared against dynamically computed hash values for the applications. Applications with matching hash values are permitted to execute on the second device.

Growing community of inventors

Dundee, United Kingdom

Anthony Edward Roper