Remote monitoring and management of an instant issuance system

• US 10,284,528 B2
• Filed: 06/24/2016
• Issued: 05/07/2019
• Est. Priority Date: 06/25/2015
• Status: Active Grant

• Current Assignee: Entrust Corp.
• Original Assignee: Entrust Datacard Corporation (Entrust Corp.)
• Inventors: Arora, Vishal, Kullman, Scott, Landerholm, Kent, Zurn, Tim, Wittmayer, Jon, Lemercier, Benoit, Davison, Jeffrey, Sanden, Daniel A.
• Primary Examiner(s): Kanaan, Simon P
• Application Number:
  US15/192,332
• Publication Number:
  US 20160380981A1
• Time in Patent Office: 1,047 Days
• CPC Class Codes: G06F 8/65 Updates security arrangements therefor G06F21/57
• CPC Class Codes: G06Q 20/34 using cards, e.g. integrated circuit [IC] cards or magnetic cards
• CPC Class Codes: G06Q 20/355 Personalisation of cards for use
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273
• CPC Class Codes: H04L 63/166 at the transport layer

Abstract

A system and method for remote monitoring and management of an instant issuance system is provided. The embodiments provide secure communication between different entities within the instant issuance system. Security can be established via mutual authentication between the communicating entities of the instant issuance system prior and/or concurrent with a communication taking place.

Claims

1. An instant issuance system for issuing a customized personalization card, the system comprising:

an instant issuance server component configured to process received customized issuance information and generate printer information to be placed on the customized personalization card;

a customized personalization card printer configured to place printer information received from the instant issuance server component on the customized personalization card; and

a remote management and monitoring (RMM) server component configured to request operational data from at least one of the instant issuance server component and the customized personalization card printer, configured to analyze the requested operational data, configured to determine an operational action, and configured to perform the operational action,

wherein the instant issuance system is configured to provide mutual authentication for communication between the RMM server component and the customized personalization card printer, and between the instant issuance server component and the customized personalization card printer,

wherein the RMM server component is configured to manage a plurality of certificates for each of the instant issuance server component, the RMM server component, and the customized personalization card printer, and

wherein the mutual authentication is performed using two or more of the plurality of certificates.

2. The instant issuance system of claim 1, wherein the instant issuance system is configured to provide encryption for application specific data communicated between two or more of the instant issuance server component, the customized personalization card printer and the RMM sever component.

3. The instant issuance system of claim 1, wherein the mutual authentication is provided at a transport layer.

4. The instant issuance system of claim 1, wherein the operational data includes information regarding a certificate status and at least one of a ribbon supply level, a cardstock supply, a printer type, a printer status, and a printer location, and

wherein the RMM server component is configured to determine the operational action based on at least one of the ribbon supply level, the cardstock supply, the printer type, the printer status, and the printer location.

5. The instant issuance system of claim 1, wherein communication between the customized personalization card printer and at least one of the RMM server component and the instant issuance server component includes a first communicating entity that is at least one of the instant issuance server component and the RMM server component sending a first authentication key to the customized personalization card printer, and includes the customized personalization card printer sending a second authentication key to the first communicating entity.

6. The instant issuance system of claim 1, wherein the instant issuance server component and the RMM server component are part of a single server machine.

7. The instant issuance system of claim 1, wherein the operational action includes sending at least one of a dashboard update instruction, an alarm instruction, a cease operation instruction and a begin operation instruction to at least one of a terminal, the instant issuance server component and the customized personalization card printer.

8. The instant issuance system of claim 1, wherein the operational action includes sending a firmware update to the customized personalization card printer.

9. The instant issuance system of claim 1, further comprising a terminal configured to prompt an account holder to select customized issuance information for a customized financial personalization card,

wherein the RMM server component is configured to request operational data from at least one of the terminal, the instant issuance server component, and the card printer, and

wherein the financial instant issuance system is configured to provide mutual authentication for communication between two or more of the terminal, the instant issuance server component, the customized personalization card printer and the RMM server component.

10. The instant issuance system of claim 1, wherein the customized personalization card is one or more of a customized financial personalization card, a driver'"'"'s license, a government issued card, a government issued badge, and a passport.

11. The instant issuance system of claim 1, wherein the instant issuance system is configured to provide mutual authentication for communication between the RMM server component and the instant issuance server component.

21. The instant issuance system of claim 1, wherein the mutual authentication for communication between the RMM server component and the customized personalization card printer includes the RMM server component authenticating itself to the customized personalization card printer using a RMM server certificate of the plurality of certificates and the customized personalization card printer authenticating itself to the RMM server using a customized personalization card printer certificate of the plurality of certificates, and

wherein the mutual authentication for communication between the instant issuance server component and the customized personalization card printer includes the instant issuance server component authenticating itself to the customized personalization card printer using an instant issuance server certificate of the plurality of certificates and the customized personalization card printer authenticating itself to the instant issuance server component using the customized personalization card printer certificate.

22. The instant issuance system of claim 1, upon mutual authentication verification between the RMM server component and at least one of the instant issuance server component and the customized personalization card printer, the RMM server component is configured to request operational data from the at least one of the instant issuance server component and the customized personalization card printer.

23. The instant issuance system of claim 1, wherein the RMM server component is configured to monitor an expiration date for each of the plurality of certificates, automatically distribute a new certificate prior to expiration of any of the plurality of certificates, and distribute the new certificate within the instant issuance system.

24. The instant issuance system of claim 1, wherein the RMM server component is configured to log activity of the RMM server component, the instant issuance server component and the customized personalization card printer.

25. The instant issuance system of claim 1, wherein the RMM server component is configured to provide a firmware update to the customized personalization card printer based on a geographic location of the customized personalization card printer.

26. The instant issuance system of claim 1, wherein the RMM server component is configured to activate the customized personalization card printer upon notification that the customized personalization card printer has received a print request.

12. A method for remote monitoring and management of an instant issuance system that includes a customized personalization card printer, an instant issuance server component and a remote monitoring and management (RMM) server component, the method comprising:

the RMM server component managing a plurality of certificates for each of the instant issuance server component, the RMM server component, and the customized personalization card printer;

performing mutual authentication between the RMM server component and a first entity using two or more of the plurality of certificates, the first entity being at least one of the customized personalization card printer and the instant issuance server component;

the RMM server component sending a status request to the first entity;

the first entity gathering requested status information, encrypting the status information, and sending the encrypted status information to the RMM server component;

the RMM server component analyzing the encrypted status information and determining an operational action; and

the RMM server component performing the operational action.

13. The method of claim 12, wherein performing mutual authentication between the RMM server component and the first entity includes:

the RMM server component sending a communication request and a RMM authentication key to the first entity prior to sending the status request;

the first entity sending a first entity authentication key to the RMM server component;

the RMM server component verifying authentication of the first entity by the first entity authentication key; and

the first entity component verifying authentication of the RMM server component by the RMM server component authentication key.

14. The method of claim 12, wherein the authentication key is a digital certificate.

15. The method of claim 12, wherein the encrypted status information includes operational information regarding a certificate status and at least one of a ribbon supply level, a cardstock supply, a printer type, a printer status, and a printer location, and

wherein the RMM server component determining the operational action based on at least one of the ribbon supply level, the cardstock supply, the printer type, the printer status, and the printer location.

16. The method of claim 12, wherein the instant issuance server component and the RMM server component are part of a single server machine.

17. The method of claim 12, wherein the RMM server component performing the operational action includes the RMM server component sending at least one of an alarm instruction, a cease operation instruction and a begin operation instruction to at least one of the instant issuance server component and the customized personalization card printer.

18. The method of claim 12, wherein the RMM server component performing the operational action includes the RMM server component sending a firmware update to at least one of the instant issuance server component, and the customized personalization card printer.

19. The method of claim 12, wherein the first entity is at least one of a terminal, the customized personalization card printer and the instant issuance server component.

20. The method of claim 12, wherein the customized personalization card is one or more of a customized financial personalization card, a driver'"'"'s license, a government issued card, a government issued badge, and a passport.

27. An instant issuance system for issuing a customized personalization card, the system comprising:

an instant issuance server component configured to process received customized issuance information and generate printer information to be placed on the customized personalization card;

a customized personalization card printer configured to place printer information received from the instant issuance server component on the customized personalization card; and

a remote management and monitoring (RMM) server component configured to request operational data from at least one of the instant issuance server component and the customized personalization card printer, configured to analyze the requested operational data, configured to determine an operational action, and configured to perform the operational action,

wherein the instant issuance system is configured to provide encryption for application specific data communicated between two or more of the instant issuance server component, the customized personalization card printer and the RMM sever component,

wherein the RMM server component is configured to manage a plurality of certificates for each of the instant issuance server component, the RMM server component, and the customized personalization card printer, and

wherein mutual authentication is performed using two or more of the plurality of certificates.