The present invention relates generally to fuel dispensers having the ability to accept payment at the dispenser. More particularly, the present invention relates to encryption techniques utilized in a fuel dispenser environment to protect sensitive information such as a user's personal identification number (PIN).
Credit card companies (such as VISA® and MASTERCARD®) have been very successful in persuading consumers that credit cards should be used to complete commercial transactions in place of cash. As a result of the success of the credit card, almost every retail establishment now has a magnetic card stripe reader. Concurrent with the proliferation of the magnetic stripe card readers used to process credit cards, many financial institutions have authorized the issuance of debit cards that are interoperable with the magnetic card readers.
Typically, a credit card is swiped through the magnetic card reader, and the credit card owner does not have to take further steps to complete the authorization of the transaction, although some establishments require a signature to complete the transaction. In contrast, a debit card typically requires the card owner to enter, via a keypad, a PIN to complete customer authorization of the transaction since funds are transferred directly from the customer's bank account. The PIN (when present) is typically encrypted at the point of entry and then sent in an encrypted format over open communications links, such as a telephone line, to a host computer for transaction authorization. The encryption is used to protect the PIN from disclosure so that unauthorized persons may not eavesdrop and obtain the PIN in clear form and thus be able to use the PIN in conjunction with the card number to defraud the legitimate card holder, the vendor, or an authorizing institution or card issuer.
Commonly-owned U.S. Pat. No. 5,228,084, incorporated by reference in its entirety, describes the encryption process and teaches a fueling environment where a plurality of fuel dispensers can accept debit cards and PIN entry. The fueling environment is divided into two zones. The first zone is a local zone within the fueling environment. The local zone extends from the data entry point to a security module associated with a site controller. The second zone is the host zone and extends from the security module to the host computer that authorizes the transaction. The PIN is encrypted by the data entry point device (a keypad, a card reader, or the like) using a local encryption algorithm, and is sent to the security module. The security module decrypts the information from the data entry point device using the local encryption scheme and re-encrypts the information according to a host encryption algorithm used by the host computer. After re-encryption, the information is sent to the host computer for transaction authorization.
Card Issuers have recently announced new requirements for encryption of data entered at the keypad. These new requirements mandate encryption of data, including PIN data for debit cards, at the keypad, with a triple Data Encryption Standard (Triple-DES) derived unique key per transaction (DUKPT). It is expected that this change will require substantial modifications and/or upgrades to the equipment deployed at retail establishments.
The present invention recognizes and addresses various considerations of the prior art.
One aspect of the present invention provides a system used in a retail environment for providing secure communication of payment information to a host computer. The system comprises at least one keypad device configured to receive personal information. The keypad device is operative to encrypt the personal information according to a first encryption scheme (e.g., encrypted under the debit acquirer, triple-DES DUKPT key) to produce encrypted personal data. The keypad device is further operative to generate a local zone emulated message in a message format of a second encryption scheme, the local zone emulated message containing the encrypted personal data.
The system further includes a site controller in communication with the keypad device to receive the local zone emulated message. The site controller is configured to provide a message in the second encryption scheme to a security module for decryption and re-encryption according to the first encryption scheme. An emulator is associated with the site controller to emulate the security module. In this regard, the emulator is operative to receive the local zone emulated message and return the encrypted personal data without decryption. The site controller provides the encrypted personal data to the host computer according to the first encryption scheme.
Another aspect of the invention provides a system used in a retail environment for providing secure communication of payment information to a host computer. The system comprises at least one keypad device configured to receive personal information. The keypad device is operative to encrypt the personal information according to a host encryption scheme to produce encrypted personal data. A site controller is in communication with the keypad device via a local area network on which the keypad device has a network address. As a result, site controller is operative to receive the encrypted personal data and provide it to the host computer.
Other objects, features and aspects of the present invention are discussed in greater detail below.
A full and enabling disclosure of the present invention, including the best mode thereof, directed to one of ordinary skill in the art, is set forth in the specification, which makes reference to the appended drawings, in which:
Repeat use of reference characters in the present specification and drawings is intended to represent same or analogous features or elements of the invention.
Reference will now be made in detail to presently preferred embodiments of the invention, one or more examples of which are illustrated in the accompanying drawings. Each example is provided by way of explanation of the invention, not limitation of the invention. In fact, it will be apparent to those skilled in the art that modifications and variations can be made in the present invention without departing from the scope and spirit thereof. For instance, features illustrated or described as part of one embodiment may be used on another embodiment to yield a still further embodiment. Thus, it is intended that the present invention covers such modifications and variations as come within the scope of the appended claims and their equivalents.
The present invention allows triple-DES encryption of personal information such as a PIN or an account number using the acquirer debit or “host key,” at the fuel dispenser or other data entry location. In order to interoperate with existing dual-zone encryption methodology, the host key encrypted data block is included within a message format supported by the local zone security protocol. This local zone emulated message is thus passed to local zone components for emulated processing pursuant to a host encryption scheme. The host key encrypted data is then extracted from the local zone emulated message and passed to the host computer. This may be accomplished by emulation of an encryption security module that is connected to a site controller. As a result, components of the traditional dual-zone methodology can be employed in a system utilizing a host key encryption data entry device. The present invention may be utilized in a number of different retail establishments, such as a retail fueling environment.
Before explaining further aspects of the present invention, it is helpful to review certain aspects of the prior art. In this regard,
As shown, fuel dispensers 12 may each have at least one user interface 16. Referring now also to
In use, the customer may swipe her debit card in card reader 22 and enter her personal identification number (PIN) at smart pad 20. Collectively, display 18 (if equipped with a touch pad), smart pad 20, card reader 22 and any optional keypad are referred to as data entry point devices. The user interface 16 encrypts the card number and the PIN according to a local encryption scheme. Further details about such encryption can be found in the previously incorporated '084 and '313 patents. Encryption of the information reduces concerns about sending the information over communication media on which the information may be intercepted.
The encrypted information is sent to a security module 28 through site controller 14. Security module 28 decrypts the encrypted information using the local zone's encryption scheme and then re-encrypts it using a host encryption scheme. The re-encrypted information is passed back to site controller 14, which sends the re-encrypted information to a host computer 30 (
The purchaser of a prior art site controller specified which encryption scheme to use in the local zone and which encryption scheme to use in the host zone. Exemplary encryption schemes included, but were not limited to pretty good privacy (PGP), Rivest-Shamir-Adelman (RSA), Data Encryption Standard (DES), and Diffie-Hellman (DH) algorithms. More information about the RSA and DH algorithms can be found in U.S. Pat. Nos. 4,405,829; 4,200,770; and 4,797,920, all of which are hereby incorporated by reference. The specification of a particular encryption scheme was dictated in large part by encryption schemes used by the data entry point devices and the host network. In the illustrated system, smart pad 20 utilizes a single-DES local zone DUKPT encryption. During the manufacturing process, the security module was programmed or configured to support the specific encryption scheme.
Recent requirements imposed by the payment card industry (PCI) will mandate the use of data entry devices utilizing certain host encryption protocols. For example, it is expected that many new fuel dispensers installed in the future will utilize keypads having triple-DES DUKPT encryption. Thus, most encryption will occur at the keypad itself rather than in the security module as described above. Because the data entry device will provide host encryption, there is no need for the dual zone encryption methodology utilized in the past. This eliminates the need for the security module, but it also requires extensive changes (and/or replacement) of the site controller and the user interface CPU. In addition, many retail establishments are already equipped with equipment intended to operate in two zones. As presently configured, this equipment would be incompatible with the new encrypting PIN pads (EPPs).
Referring now to
Unlike pad 20, pad 120 holds host keys and therefore directly encrypts the user PIN according to the host encryption scheme. In order to allow continued use of existing dual zone components, pad 120 is configured to include the host encrypted data in a local zone emulated message. In other words, the message is formatted so that the block of host encrypted information will be contained in a format that the dual zone equipment expects to see. As a result, the hardware and software of CPU 26 can remain the same. Similarly, the hardware and software of site controller 14 can remain unchanged (except for the possible addition of an emulation software component as described below).
The software running on site controller 14 will attempt to send the local zone emulated message to the security module for decryption and re-encryption as discussed above. Because the data is already encrypted according to the host encryption scheme, however, there is no need for decryption and subsequent re-encryption. Instead, the host encrypted data simply needs to be extracted from the local zone emulated message and provided to the host. This can be accomplished by an update to the security module software. Alternatively, the security module can be eliminated and replaced with a low cost security module emulator.
In this regard,
For PC-based systems, an additional application could be provided that intercepts data from the COM port and pretends to be the security module. In particular, the emulated security module can execute on a Windows PC as an application that listens to the COM port and returns the expected data. Port assignments may be changed within low level software drivers to emulate the transmission and receipt of information to and from a security module. This approach would require no changes to the site controller software itself and results in a virtually “zero cost” emulator since no hardware is required to perform this function.
Either a hardware or software emulator would function in essentially the same way. That is, when the site controller sends the message to the emulator, it simply echoes back the key serial number (KSNR) and PIN block because it is already property encrypted. In particular, the keypad holds the triple-DES network key and also implements full smart pad protocols. It sets up a dummy “local encryption zone” along with the emulator so that site controller 14 and CPU 26 observe no changes with local zone messages. When user PINs are encrypted, the PINs are encrypted with the payment network key. In setting up the “local encryption zone,” the emulator implements the full protocol of the security module. The dummy “local encryption zone” is created so that site controller 14 observes no changes when “local zone messages” are sent between the emulator and the dispensers.
In an especially preferred embodiment, pad 120 functions to fake Diffie-Hellman (DH) key exchange with site controller 14. Because pad 120 holds the triple-DES DUKPT, it sends PIN block encrypted under acquirer DUKPT rather than the DH key of pad 20. In such embodiments, the emulator exchanges “fake” DH keys with user interface 116.
The overall process can be more easily explained with reference to
Referring now to
An additional modification to the embodiment of
In the embodiments of
It can thus be seen that the present invention allows use of a pad that encrypts according to a host encryption scheme in an existing dual zone encryption environment. In particular, the present invention provides emulation of a first encryption protocol and allows a passthrough operation of data encrypted with a second encryption protocol. The emulation of the first encryption protocol may be accomplished with either hardware or software.
For example, an existing single-DES smart pad may be replaced with a triple-DES PIN entry device and a security module emulator (either hardware or software) to allow transmission of the triple-DES DUKPT in blocks directly to the payment network. This can be accomplished with little or no changes to the existing dual zone components.
While one or more preferred embodiments of the invention have been described above, it should be understood that any and all equivalent realizations of the present invention are included within the spirit and scope thereof. The embodiments depicted are presented by way of example and are not intended as limitations upon the present invention. Thus, those of ordinary skill in the art should understand that the present invention is not limited to these embodiments since modifications can be made. Therefore, it is contemplated that any and all such embodiments are included in the present invention as may fall within the scope and spirit thereof.
This application claims the benefit of provisional application Ser. No. 60/985,514, filed Nov. 5, 2007, which is hereby relied upon and incorporated herein by reference.
Number | Date | Country | |
---|---|---|---|
60985514 | Nov 2007 | US |