ATM. Beyond the Wire

In connection with the affected recently theme devices ATMs Habra desire to learn more about them, and just rolls over the amount of speculation from a seemingly technically savvy audience, I decided to write this post.

Unlike UserSide , which is mainly engaged in the physical maintenance of ATMs, and it seems to me, is very far from those who actually writes software for its management host, I will talk about "the other side". Naturally, the best of their knowledge, it is still too modest.

Since this is my first article on Habre, I apologize for perhaps unnecessary confusion.

The first thing I want to mention - everything said in the article, and almost all of the comments - the truth, but the truth is one-sided - it describes the particular cases. And while this particular cases, in a manner as to give information, the unprepared reader may get the impression that there is only so much as it was told. And although in the comments managed to appear somewhat opposite description of the situation, no one voiced the main - all particular cases.

1. Maps and accounts h4>
One of the members of the forum, citing his experience, insisted that the card can link any account (and in any currency) for 5 minutes, someone else doubted. It really is. The possibility of this procedure is determined only by the capabilities of the software processing system, enabled by its internet / mobile banking, banks' desire to provide such services to the population and its desire to pay for this extra coin system developer. In the system, the development of which I have the attitude, cards and accounts - they are two different entities.
Map in our terminology is a token - just as a token, such as a password, certificate, identity document and some others, not immediately remember. The token is used only to access the account. And, as to the account can be accessed through several tokens and token can serve multiple accounts. For example, one bank, where our system works, during a card transaction you may be asked to specify a specific account - if the card is tied them somewhat.

2. PIN contrary to scam h4>
This feature is called "false PIN» (iPIN). The fact that some bank offers to do it by default, as the primary PIN written on the contrary, only serves the purpose it easier memorization. Judging by the comments, I got the impression that not everyone understands this.
From what I've heard from colleagues, this feature is not very popular, because has its negative side (do not know what). The fact that it is used very rarely.

3. Card collectors / supervisors h4>
Again, this is not an immutable rule, this is done simply for ease of maintenance. In our system, it is done so, I suspect that all the others as well:
When you insert a card host, instead of the transaction, the ATM prompts the current counters (or ATM application itself can determine such a map, and send yourself immediately counters - about applications on). Further there is a physical collection terminal with entering into a new counter (this is done by hand, but I vaguely heard that it is possible and automatic entry on the poll tapes ... but I think now it is rare where available). After closing the door of the ATM presses a special button, the button called supervisor and ATM network reports in the least that has changed the state of the sensor "supervisor mode" as a maximum - its complete state, including new counters (and maybe even old - see . in the chapter on the application). If the report contains only information about the sensor, the host requests the counters themselves. At this point, the host can compare the new with the old counters and create a transaction collection. Again, I repeat, so it works for us, but it does not mean that it works everywhere. But as the scheme is very flexible and autonomous, it certainly used in almost any software product of this kind.

Instead card command on the initial survey meters (before transfer mode ATM supervisor for collection) can give and of the host. Collection can then look like this: collectors arrive at a place called in the processing center, the operator executes a command through the system, hereinafter referred to as the first scenario.

4. The application on the ATM h4>
Here it should be noted that all applications can be divided into 2 types:

• protocol rigidly defined, on the side of the ATM runs a program running on this protocol, and extend it does not. This, for example, NDC, DDC and Triton.
• protocol not only does not rigidly fixed, but on the contrary, an application on the ATM is an extensible plug-in to support the communication with a particular host. So arranged ATMs Kalignite - incidentally, the most flexible of those with whom I worked. Appendix Kalignite - this is a common .Net application displayed on the screen of the ATM screens - the usual HTML-pages that are displayed via a standard .Net component browser (which, in turn, is based on the core IE, ie, has all its vulnerability. However, the component greatly curtailed). Due to this design the visual part of the script may engage web designers and enjoy all the benefits - for example, jQuery, virtual keyboard and everything that your heart desires.
  Since working on the ATM code that is written by the developer of the system, the performance of all service functions can be greatly simplified - for example, a transaction collection can be formed at the ATM, and send it to the host as a normal transaction request (only will this administrative transactions).
  • terminal sends only adjusted parameters - in this case, the host must be stored somewhere the information sent by the ATM in the previous query - ATM stateless, host statefull - so behave all ATM programs with rigid protocol (NDC / DDC, Triton, etc.), as protocol does not provide a place to store these data;
  • terminal sends all past data plus the adjusted parameters - ATM statefull, host stateless. So better to do at work with Kalignite, because still need to (desirable) to write your extension for interaction in a convenient host protocol.

    5. Withdrawal cards and PINs false h4>
    Behavior when detecting not take the card is fully customizable - ATM may like to capture her, and leave the path. The same applies to the issuance of the card before / after the money at the beginning / end of work during a power failure (if the bank is not quite poor, in the ATM must be UPS). What if you enter the wrong PIN is entered a false PIN (if any), the counter is reset when an incorrect PIN is needed if the capture card - it is all about the host. If the host does not instruct the ATM capture card, he did not grab her, whether she is at least ten times a fake, stolen and lost.
    
    

    6. Chip cards h4>
    What to do with the chip card if you can not read the chip - it depends on the settings of the script. May offer a more narrow range of services, and may simply refuse to serve. Same with cards of other banks.
    
    

    7. A maximum of 40 notes for the issuance and the issuance algorithm h4>
    What algorithm to use the issue and where it finds ATM - again, depends entirely on the setting. Of course, now, in the era of indiscriminate Internet host advantageous to perform all the calculations, and the ATM only to issue commands. However, for example, Kaliginte-object management CashDispenser-ohm (cash dispensing device) is also able to calculate the amount of issue pokupyurnuyu using different algorithms. In our system, we do not use this feature. Again, allow the user to select an algorithm issue, or, as someone said in the comments, even the specific denomination banknotes - depends entirely on the willingness of the bank to create a script (well, and the capabilities of the software, of course).
    
    Limitation of 40 bills really comes from the physical constraints - a pack of 40 banknotes almost a centimeter thick. About the fact that the ATM will simply refuse to issue the amount that can not be physically issued at a time, with obscure error - Wine Developer script - which is not provided for a clear message about the reason. With Kalignite-om all generally simple, it is a regular HTML, as I have said above, is actually a local site, and for the NDC / DDC ATM host response may contain refresh text in which, again, determines host ... Triton-Protocol and poorer , and error codes, it has little, but Triton-s in Russia, it seems, is not very common.
    
    

    8. Operating System h4>
    On those on which I have tested, it is worth Windows XP. And I tested with Kalignite-ovsky scenario with NDC and DDC ATMs.
    
    
    Well. I hope it was interesting and chaos in the minds diminished. The main point I wanted to convey - everything is customizable. Naturally, somewhere less somewhere more, but it has more to do with the deeper nuances than those that are visible at a glance.
    
    Source: habrahabr.ru/post/217337/