Patent Application
20140289129
1. Field of the Invention
The invention relates to a a smart card Point of Sale system which is based on a Public Key Infrastructure (PKI), and where the payment card is a smart card and the PoS terminal can communicate with the smart card and process payment transactions.
2. Description of the Related Art
Current smart card payment solutions based on Europay, Mastercard, and Visa (EMV) specification can be based on either contact or contactless communication between the smart card and the card reader, such as a Point of Sale (PoS) terminal. The EMV standard does not contain any data encryption for the communication between a smart card and a reader. In other words, the communication between an EMV smart card and an EMV card reader is clear text and containing all sensitive information including the card type, the card holder's name and the card account number.
When using contactless cards, this is causing a serious security problem. A person skilled in the art can easily build a card reader system which can using a contactless communication protocol, like Near Field Communication (NFC), to read someone else's NFC capable payment card information from a near proximity (1-20 cm), i.e. without touching or even seeing the card. This information can be used for online payments and for making ‘fake’ payment cards by copying the card information into an empty or used magnetic stripe card. This card could be used for fraudulent transactions.
The embodiment(s) describes a smart card Point-of-Sale (PoS) system which is based on a Public Key Infrastructure (PKI), and where the payment card is a smart card and the PoS terminal can communicate with the smart card and process payment transactions. The PoS terminal can be implemented as software residing in another or in the same smart card as the payment card. The software is configured to be used with and cause a processor or processing device to execute operations. This invention is not limited to contactless payment cards or EMV payment cards.
In one or more embodiments, a method of securely communicating between a Point-of-Sale (PoS) terminal and a payment card is provided. The method includes signing, at the PoS terminal, payment data with a private key of the PoS terminal to create a signature. The method also includes encrypting the payment data and the signature at the PoS terminal using a public key certificate of the payment card,. The payment card public key certificate is encrypted and signed by a certificate authority using a private key of the certificate authority and is received at the PoS terminal from the payment card after a public key certificate of the PoS terminal is received from the PoS terminal and validated at the payment card. The PoS terminal public key certificate is encrypted and signed by the certificate authority using the private key of the certificate authority. The method additionally includes transmitting the encrypted payment data and the encrypted signature to the payment card for decryption of the payment data and the signature at the payment card using a private key of the payment card corresponding to the payment card public key certificate.
In one or more embodiments, a method of securely communicating between a Point-of-Sale (PoS) terminal and a payment card is provided. The method includes signing, at the payment card, payment data with a private key of the payment card to create a signature. The method also includes encrypting the payment data and the signature at the payment card using a public key certificate of the PoS terminal. The PoS terminal public key certificate is encrypted and signed by a certificate authority using a private key of the certificate authority and is received at the payment card from the PoS terminal card after a public key certificate of the payment card is received from the payment card and validated at the PoS terminal. The PoS terminal public key certificate is encrypted and signed by the certificate authority using the private key of the certificate authority. The method additionally includes transmitting the encrypted payment data and the encrypted signature to the PoS terminal for decryption of the payment data and the signature at the PoS terminal using a private key of the PoS terminal corresponding to the PoS terminal public key certificate.
In one or more embodiments, a method of securely communicating between a Point-of-Sale (PoS) terminal and a payment card is provided. The method includes transmitting first data including a public key certificate of the PoS terminal from the PoS terminal to the payment card. The PoS terminal public key certificate is encrypted and signed by a certificate authority using a private key of the certificate authority. The first data is associated with a payment application for payment data. The method also includes receiving the first data from the PoS terminal at the payment card, and decrypting and validating the first data at the payment card using a public key certificate of the certificate authority. The method further includes transmitting second data including a public key certificate of the payment card from the payment card to the PoS terminal. The second data is transmitted after the first data is decrypted and validated by the payment card. The payment card public key certificate is encrypted and signed by the certificate authority using the private key of the certificate authority. The method also includes receiving the second data at the PoS terminal from the payment card, and decrypting and validating the second data received from the payment card at the PoS terminal using the public key certificate of the certificate authority. The method includes signing, at the PoS terminal, payment data with a private key of the PoS terminal to create a signature. The payment data is associated with the payment application. The method additionally includes encrypting the payment data and the signature at the PoS terminal with the payment card public key certificate, transmitting the encrypted payment data and the encrypted signature to the payment card, and decrypting the payment data and the signature at the payment card using a private key of the payment card corresponding to the payment card public key certificate.
In one or more embodiments, a method of securely communicating between a Point-of-Sale (PoS) terminal and a payment card is provided. The method includes transmitting first data including a public key certificate of the payment card from the payment card to the PoS terminal. The payment card public key certificate is encrypted and signed by a certificate authority using a private key of the certificate authority. The first data is associated with a payment application for payment data. The method also includes receiving the first data from the payment card at the PoS terminal, and decrypting and validating the first data at the PoS terminal using a public key certificate of the certificate authority. The method additionally includes transmitting second data including a public key certificate of the PoS terminal from the PoS terminal to the payment card. The second data is transmitted after the first data is decrypted and validated by the PoS terminal. The PoS terminal public key certificate is encrypted and signed by the certificate authority using the private key of the certificate authority. The method further includes receiving the second data at the payment card from the PoS terminal, and decrypting and validating the second data received from the PoS terminal at the payment card using the public key certificate of the certificate authority. The method includes signing, at the payment card, payment data with a private key of the payment card to create a signature. The payment data is associated with the payment application. The method also includes encrypting the payment data and the signature at the payment card with the PoS terminal public key certificate, transmitting the encrypted payment data and the encrypted signature to the PoS terminal, and decrypting the payment data and the signature at the PoS terminal using a private key of the PoS terminal corresponding to the PoS terminal public key certificate.
Other objects and advantages of the present embodiments will become apparent from a study of the following specification when viewed in the light of the accompanying drawings, in which:
Reference will now be made in detail to the preferred embodiments of the present invention, examples of which are illustrated in the accompanying drawings, wherein like reference numerals refer to like elements throughout.
Turning now to
The CA will enable and ensure a chain of trust using strong security methods and security certificates as described in typical PKI solution well known to a person skilled in the art.
The system consists on a PoS terminal which has at least one processor and program memory with at least one application program and the program can process at least one type of payment card transactions. The PoS terminal and the smart payment card will communicate between each other to determine which payment card application shall be used.
The PoS terminal has secure memory storage where it holds its secret or private encryption key and a public encryption key and a security certificate containing its public key which is signed and encrypted by the CA using its private key. These security keys can be generated by the PoS terminal or a smart card with a PoS terminal software, and secured certificates can be delivered to the PoS terminal memory and at the smart card memory at the time of manufacturing or at a later time if there is a secure method available to do so.
This list can be in clear text format or in a binary format without any specific encryption, because it does not contain any sensitive information about the payment card or its owner, but only a list of numbers corresponding to the payment applications the payment card supports. The application numbers can be for example 1 for VISA card, 2 for MasterCard and so on for each payment card scheme.
When the PoS terminal receives such list, it will compare the list with the payment applications it supports and then selects the highest priority payment application both parties are supporting.
The PoS terminal will send a security certificate related to the selected payment application (Visa, Mastercard, etc.) to the payment card. The certificate contains the PoS terminal's public key which has been encrypted and signed by the corresponding CA using the CA's private key (SCA). The PoS terminal can also send a non-predictable or a random number to the payment card.
The payment card will decrypt the data using the CA's Public Key certificate (PCA) in its memory and validate the decrypted data using the CA's Public Key (PCA).
The payment card will then send its own Public Key certificate (PIC) encrypted and signed by the CA using a Private Key (SCA), to the PoS terminal together with the non predictable or random number which is signs and encrypts using the card's own Private Key (SIC).
The PoS terminal will use the CA's Public Key (PCA) to decrypt and validate the data received from the payment card. The PoS terminal can decrypt the non-predictable number using the Cards Public Key (PIC) it has received for validating the integrity of the communication and data received.
Once this operation has been completed successfully, both parties have securely received and are holding in addition to their own Private and Public Keys, also the other party's Public Key certificate.
While the secure key exchange has been shown and described as a transaction from the PoS terminal to the payment card, one of ordinary skill in the art would recognize that the secure key exchange can also be effected with the payment card as the transmitting party and the PoS terminal as the receiving party.
The secure transaction may consist of one or several messages sent between the parties. The secure messaging can be either one directional or bi-directional. The principle of securing the information is using PKI method. In other words, the sending party will first sign the content with its own private key and then encrypt the content and the signature with the receiving party's public key. This ensure the content remains confidential and that only the recipient with its private key corresponding to the public key which was used to encrypt the data can decrypt it. Furthermore, the recipient can use the public key of the sender to verify that the message has not been altered after the sender signed it. This method is well known to a person skilled in the art.
One of ordinary skill in the art would recognize that the secure transaction can be effected with the payment card as the transmitting party and the PoS terminal as the receiving party or the PoS terminal as the transmitting party and the payment card as the receiving party.
This method can be enhanced to cover the transaction also from the PoS terminal to the CA or Acquiring bank. The PoS terminal can sign the payment data with its own Private Key and encrypt it with the CA's Public Key (PCA). In that case, the whole transaction could be secured flawlessly from end to end; from the payment card to the PoS terminal and to the Acquiring bank.
This invention is in particular suitable for a PoS terminal which are implemented fully or partially in a smart card, UICC card, a SIM card or in a mobile device, such as a mobile phone, a smart phone, a tablet computer, a laptop computer or a mobile PoS terminal, however it can be used in conjunction with any computing device with a secure element capable of storing security certificates and keys and to process cryptography operations.
Although the distance between a contactless card and a contactless reader can be only a few centimeters, the authentication of both parties, confidentiality and reliability are important factors especially when it comes to financial transactions used by hundreds of millions if not billions of people around the world, and it has a major effect on the trust of such system.
This method enables improved transaction security without any remarkable increase in cost.
Aspects of the present embodiment(s) can also be embodied as software configured to be used with a processor to cause the processor to perform operations, or can be embodied as hardware on one or more connected or unconnected devices.
While in accordance with the provisions of the Patent Statutes the preferred forms and embodiments of the invention have been illustrated and described, it will be apparent to those skilled in the art that various changes may be made without deviating from the inventive concepts set forth above.
This application is based on and claims priority to U.S. Provisional Patent App. No. 61/804,774, filed on Mar. 25, 2013 with the U.S. Patent Office, the contents of which priority application are hereby incorporated by reference in their entity.
| Number | Date | Country | |
|---|---|---|---|
| 61804774 | Mar 2013 | US |
