Key loading systems and methods

• US 20060294378A1
• Filed: 06/23/2005
• Published: 12/28/2006
• Est. Priority Date: 06/23/2005
• Status: Active Grant

• Current Assignee: Fidelity Information Services, LLC (Fidelity National Information Services Incorporated)
• Original Assignee: Efunds Corporation (Fidelity National Information Services Incorporated)
• Inventors: Brittain, John R., Statland, Scott R., Palmer, Sandra A., Lumsden, Ian A.
• Granted Patent: US 7,627,125 B2
• Time in Patent Office: Days
• US Class Current: 713/171
• CPC Class Codes: G06Q 20/02 involving a neutral party, e.g. certification authority, notary or trusted third party [TTP]
• CPC Class Codes: G06Q 20/20 Point-of-sale [POS] network systems
• CPC Class Codes: G06Q 20/3829 involving key management
• CPC Class Codes: G07F 7/1016 Devices or methods for securing the PIN and other transaction-data, e.g. by encryption arrangements for secret communication, see H04L9/00

Abstract

Systems and methods for loading a key to a terminal. The system can include a terminal manager system including a terminal handler that receives terminal information from a terminal, generates an authentication request including at least a portion of the terminal information, and generates a key request. The system can also include a server that sends the authentication request to a key manager system and sends the key request to the key manager system.

Claims

1. A terminal manager system comprising:

a terminal handler that receives terminal information from a terminal, generates an authentication request including at least a portion of the terminal information, and generates a key request; and

a server that sends the authentication request to a key manager system and sends the key request to the key manager system.

2. The system of claim 1 wherein the terminal handler receives the terminal information in a plurality of messages.

3. The system of claim 1 wherein the terminal handler sends the authentication request to the server.

4. The system of claim 1 wherein the terminal handler sends the key request to the server.

5. The system of claim 1 wherein the terminal handler verifies a key entry mode of the terminal.

6. The system of claim 5 wherein the terminal handler generates a change key entry mode message and sends the change key entry mode message to the terminal.

7. The system of claim 1 wherein the key manager system generates an authentication response, sends the authentication response to the server, generates a key, generates a key response including the key, and sends the key response to the server.

8. The system of claim 7 wherein the server sends the authentication response to the terminal handler.

9. The system of claim 8 wherein the server uses a terminal identifier included in the authentication response to determine how to send the authentication response to the terminal handler.

10. The system of claim 7 wherein the server sends the key response to the terminal handler.

11. The system of claim 10 wherein the server uses a terminal identifier included in the key response to determine how to send the key response to the terminal handler.

12. The system of claim 1 wherein the server formats the authentication request before sending the authentication request to the key manager system.

13. The system of claim 12 wherein the server formats the authentication request into an extensible markup language formatted request.

14. The system of claim 1 wherein the server formats the key request before sending the key request to the key manager system.

15. The system of claim 14 wherein the server formats the key request into an extensible markup language formatted request.

16. The system of claim 1 wherein the terminal initiates a key loading message dialog with the terminal handler.

17. The system of claim 1 wherein the terminal manager system allows an operator to initiate a key loading message dialog with the terminal handler.

18. The system of claim 1 wherein the terminal manager system executes an extraction program to create a terminal table and provides a key manager system access to the terminal table, the terminal table including information about a plurality of terminals managed with the terminal manager system.

19. A method of loading a key to a terminal, the method comprising:

sending terminal information from the terminal to a terminal handler;

generating an authentication request with the terminal handler, the authentication request including at least a portion of the terminal information;

sending the authentication request to a server and a key manager system;

generating an authentication response with the key manager system;

sending the authentication response to the terminal handler and the terminal;

generating a key request with the terminal handler;

sending the key request to the server and the key manager system;

generating a key response with the key manager system, the key response including a key; and

sending the key response to the terminal handler and the terminal.

20. The method of claim 19 further comprising sending the authentication response to the server.

21. The method of claim 20 further comprising determining with the server how to send the authentication response to the terminal handler using a terminal identifier included in the authentication response.

22. The method of claim 19 further comprising sending the key response to the server.

23. The method of claim 22 further comprising determining with the server how to send the key response to the terminal handler using a terminal identifier included in the key response.

24. The method of claim 19 wherein sending terminal information to a terminal handler includes sending terminal information in a plurality of messages.

25. The method of claim 19 further comprising verifying a key entry mode of the terminal with the terminal handler.

26. The method of claim 25 further comprising generating a change key entry mode message with the terminal handler and sending the change key entry mode message to the terminal.

27. The method of claim 19 further comprising determining how to send the authentication response to the terminal handler using a terminal identifier included in the authentication response.

28. The method of claim 19 further comprising determining how to send the key response to the terminal handler using a terminal identifier included in the key response.

29. The method of claim 19 further comprising formatting the authentication request with the server before sending the authentication request to the key manager system.

30. The method of claim 29 wherein formatting the authentication request includes formatting the authentication request into an extensible markup language formatted request.

31. The method of claim 19 further comprising formatting the key request with the server before sending the key request to the key manager system.

32. The method of claim 31 wherein formatting the key request includes formatting the key request into an extensible markup language formatted request.

33. The method of claim 19 further comprising initiating a key loading message dialog with the terminal handler.

34. The method of claim 33 wherein initiating a key loading message dialog with the terminal handler includes sending a key loading message dialog to the terminal handler from the terminal.

35. The method of claim 33 wherein initiating a key loading message dialog with the terminal handler includes sending a key loading message dialog to the terminal handler from a console.

36. The method of claim 19 further comprising executing an extraction program configured to create a terminal table and providing the key manager system access to the terminal table, the terminal table including information about a plurality of terminals managed with a terminal manager system.

37. A method of exchanging cryptographic information used for loading keys from a key manager system to a plurality of terminals included in a financial transaction system, the method comprising:

encrypting, with a key manager system, a key manager public key encrypted with a key manager private key;

sending the key manager public key encrypted with the key manager private key to an authority system;

sending an authority public key encrypted with an authority private key to the terminal manager system; and

verifying the authority public key encrypted with the authority private key.

38. The method of claim 37 further comprising generating a hash, the hash including a hash of at least one of the key manager public key encrypted with the key manager private key and the key manager public key, with the key manager system and sending the hash to the authority system.

39. The method of claim 37 further comprising storing the key manager public key encrypted with the key manager private key to a key database.

40. The method of claim 37 further comprising sending a first hash to the terminal manager system, the first hash including a hash of at least one of the authority public key encrypted with the authority private key and the authority public key.

41. The method of claim 40 further comprising requesting a second hash.

42. The method of claim 41 further comprising generating the second hash of at least one of the authority public key encrypted with the authority private key and the authority public key with the key manager system and sending the second hash to the terminal manager.

43. The method of claim 42 further comprising comparing the first hash and the second hash.

44. The method of claim 37 further comprising storing the authority public key to a key database.

45. The method of claim 37 further comprising sending a key manager public key encrypted with an authority private key to the terminal manager system.

46. The method of claim 45 further comprising verifying the key manager public key encrypted with the authority private key.

47. The method of claim 45 further comprising storing the key manager public key encrypted with the authority private key to a key database.

48. The method of claim 37 wherein verifying the authority public key encrypted with the authority private key includes comparing the authority public key to the authority public key encrypted with the authority private key decrypted with the authority public key.

49. The method of claim 46 wherein verifying the key manager public key encrypted with the authority private key includes comparing the key manager public key to the key manager public key encrypted with the authority private key decrypted with the authority public key.