Card reader for use with web based transactions

• US 20080179401A1
• Filed: 01/25/2008
• Published: 07/31/2008
• Est. Priority Date: 01/26/2007
• Status: Active Grant

• Current Assignee: Magtek Incorporated
• Original Assignee: Magtek Incorporated
• Inventors: Meyers, Lawrence R., Benson, Terrence R., Hart, Annmarie D.
• Granted Patent: US 7,673,799 B2
• Time in Patent Office: Days
• US Class Current: 235/449
• CPC Class Codes: G06Q 20/341 Active cards, i.e. cards including their own processing means, e.g. including an IC or chip
• CPC Class Codes: G06Q 20/3567 Software being in the reader
• CPC Class Codes: G06Q 20/40975 using encryption therefor
• CPC Class Codes: G07C 9/257 electronically G07C9/26 takes precedence
• CPC Class Codes: G07F 7/08 by coded identity card or credit card or other personal identification means without personal verification means G07F7/02
• CPC Class Codes: G07F 7/0813 Specific details related to card security
• CPC Class Codes: G07F 7/084 Additional components relating to data transfer and storing, e.g. error detection, self-diagnosis
• CPC Class Codes: G07F 7/0893 the card reader reading the card in a contactless manner
• CPC Class Codes: G07F 7/1008 Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system
• CPC Class Codes: G07F 7/122 Online card verification
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/805 Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
• CPC Class Codes: H04L 9/3273 for mutual authentication network architectures or network communication protocols for achieving mutual authentication in a packet data network H04L63/0869

Abstract

A card reader for use in web based transactions is provided. In one embodiment, the invention relates to a method for establishing a secure connection between a card reader and a server, the method including receiving a first challenge request, generating a response to the first challenge request using a first encryption key, sending the response to the first challenge request, sending a second challenge request, receiving an encrypted response to the second challenge request, verifying the encrypted response to the second challenge request; and, if the encrypted response is verified, reading data card information from a data card, the data card information including an intrinsic magnetic characteristic and recorded data on the data card, generating a magnetic fingerprint based on the intrinsic magnetic characteristic, and sending the magnetic fingerprint to authenticate the data card.

Claims

1. A method for establishing a secure connection between a card reader and a server, the method comprising:

receiving a first challenge request;

generating a response to the first challenge request using a first encryption key;

sending the response to the first challenge request;

sending a second challenge request;

receiving an encrypted response to the second challenge request;

verifying the encrypted response to the second challenge request; and

if the encrypted response is verified;

reading data card information from a data card, the data card information comprising an intrinsic magnetic characteristic and recorded data on the data card;

generating a magnetic fingerprint based on the intrinsic magnetic characteristic; and

sending the magnetic fingerprint to authenticate the data card.

2. The method of claim 1, further comprising:

generating the first challenge request;

sending the first challenge request;

receiving the response to the first challenge request;

verifying the response to the first challenge request using the first encryption key; and

if the response to the first challenge request is verified;

receiving the second challenge request;

generating the response to the second challenge request using a second encryption key; and

sending the response to the second challenge request.

3. The method of claim 2, further comprising:

if the response to the second challenge is verified;

receiving the magnetic fingerprint;

generating a score indicative of a degree of correlation between the magnetic fingerprint and a reference magnetic fingerprint; and

determining the authenticity of the data card based upon the score.

4. The method of claim 1, further comprising:

generating, at a website server, the first challenge request;

sending, at the website server, the first challenge request;

receiving, at the website server, the response to the first challenge request;

verifying, at the website server, the response to the first challenge request using the first encryption key; and

if the response to the first challenge request is verified;

receiving, at an authentication server, the second challenge request;

generating, at the authentication server, the response to the second challenge request using a second encryption key; and

sending, at the authentication server, the response to the second challenge request.

5. The method of claim 4, further comprising:

if the response to the first challenge request is verified;

receiving, at the authorization server, the magnetic fingerprint;

generating, at the authorization server, a score indicative of a degree of correlation between the magnetic fingerprint and a reference magnetic fingerprint; and

determining, at the website server, the authenticity of the data card based upon the score.

6. The method of claim 4, further comprising:

if the response to the first challenge request is verified;

receiving, at the authorization server, the magnetic fingerprint;

generating, at the authorization server, a score indicative of a degree of correlation between the magnetic fingerprint and a reference magnetic fingerprint; and

determining, at the card reader, the authenticity of the data card based upon the score.

7. The method of claim 1:

wherein the generation of a response to the first challenge request using a first encryption key comprises encrypting the first challenge request using the first encryption key;

wherein the verification of the encrypted response to the second challenge request comprises;

decrypting the encrypted response to the second challenge request using a second encryption key; and

comparing the decrypted response to the second challenge request with the second challenge request.

8. The method of claim 1, further comprising:

if the encrypted response is verified;

encrypting at least a portion of the recorded data;

encrypting the magnetic fingerprint;

receiving data associated with a data card transaction;

encrypting at least a portion of the transaction data;

sending the encrypted portion of the recorded data; and

sending the transaction data;

wherein the sending the magnetic fingerprint to authenticate the data card comprises sending the encrypted magnetic fingerprint.

9. The method of claim 8, further comprising:

masking a portion of the recorded data where at least one masking character is determined using a “

mod 10”

algorithm; and

sending the masked portion and an unmasked portion of the recorded data.

10. The method of claim 8, further comprising:

receiving a score indicative of a degree of correlation between the magnetic fingerprint and a reference magnetic fingerprint; and

determining the authenticity of the data card based upon the score.

11. The method of claim 1, wherein the card reader comprises a sensor at least partially enclosed within a housing, the sensor coupled to a processor, the processor located within the housing, for:

receiving a first challenge request;

generating a response to the first challenge request using a first encryption key;

sending the response to the first challenge request;

sending a second challenge request;

receiving an encrypted response to the second challenge request;

verifying the encrypted response to the second challenge request; and

if the encrypted response is verified;

reading data card information from a data card, the data card information comprising an intrinsic magnetic characteristic and recorded data on the data card;

generating a magnetic fingerprint based on the intrinsic magnetic characteristic; and

sending the magnetic fingerprint to authenticate the data card.

12. The method of claim 1, further comprising, if the response to the second challenge is verified, providing an indicator indicative of verification of the response to the second challenge.

13. The method of claim 12, wherein the indicator is any of a light emitting diode, a sound generator and a tactile device.

14. The method of claim 1, wherein the intrinsic magnetic characteristic is a remanent noise characteristic.

15. The method of claim 1, further comprising:

receiving input from an input device;

transmitting information indicative of the input received from the input device;

receiving an instruction to encrypt the information received from the input device; and

transmitting information indicative of the encrypted information.

16. The method of claim 1, further comprising enabling encryption key loading from a remote device.

17. The method of claim 16, wherein the enabling encryption key loading from a remote device comprises using a manufacturing encryption key known to both the card reader and the remote device to load at least one encryption key.

18. A system for establishing a secure connection between a card reader and a server, the system comprising:

the card reader comprising;

a read head configured to read data card information from a data card, the data card information comprising an intrinsic magnetic characteristic and recorded data on the data card; and

a processor coupled to the read head, the processor configured to;

receive a first challenge request;

generate a response to the first challenge request using a first encryption key;

send the response to the first challenge request;

send a second challenge request;

receive an encrypted response to the second challenge request;

verify the encrypted response to the second challenge request;

generate a magnetic fingerprint based on the intrinsic magnetic characteristic; and

send the magnetic fingerprint.

19. The system of claim 18, further comprising:

a website server configured to;

generate the first challenge request;

send the first challenge request to the card reader;

receive the response to the first challenge request; and

verify the response to the first challenge request using the first encryption key; and

an authentication server configured to;

receive the second challenge request from the card reader;

generate the response to the second challenge request using a second encryption key; and

send the response to the second challenge request.

20. The system of claim 19, wherein the authentication server is further configured to:

receive the magnetic fingerprint; and

generate a score indicative of a degree of correlation between the magnetic fingerprint and a reference magnetic fingerprint.

21. The system of claim 20, wherein the website server is configure to determine an authenticity of the data card based upon the score.

22. The system of claim 20, wherein the card reader is configure to determine an authenticity of the data card based upon the score.

23. The system of claim 18, wherein the processor is further configured to:

encrypt the first challenge request using the first encryption key;

decrypt the encrypted response to the second challenge request using a second encryption key; and

compare the decrypted response to the second challenge request with the second challenge request.

24. The system of claim 18, wherein the processor is further configure to:

encrypt at least a portion of the recorded data;

encrypt the magnetic fingerprint;

receive data associated with a data card transaction;

encrypt at least a portion of the transaction data;

send the encrypted at least a portion of the recorded data; and

send the transaction data.

25. The system of claim 24, wherein the processor is further configured to:

mask a portion of the recorded data where at least one masking character is determined using a “

mod 10”

algorithm; and

send the masked portion and an unmasked portion of the recorded data.

26. The system of claim 18:

wherein the read head includes a tamper resistant housing which, at least partially, encloses the read head; and

wherein the processor is located within the tamper resistant housing.

27. The system of claim 18, further comprising an indicator coupled to the processor, the indicator configured to indicate verification of the response to the second challenge.

28. The system of claim 27, wherein the indicator is any of a light emitting diode, a sound generator and a tactile device.

29. The system of claim 18, wherein the intrinsic magnetic characteristic is a remanent noise characteristic.

30. The system of claim 18, wherein card reader further comprises:

an input configured to receive information from an input device;

an input configured to receive instructions from an external device; and

an output configured to transmit information to the external device;

wherein the processor is configured to encrypt at least a portion of the information received from the input device and provide the encrypted information and at least a portion of any unencrypted information to the external device.

31. The system of claim 18, further comprising enabling encryption key loading from a remote device.

32. The system of claim 31, wherein the enabling encryption key loading from a remote device comprises using a manufacturing encryption key known to both the card reader and the remote device to load at least one encryption key.

33. A method for establishing a secure connection between a card reader and a server, the method comprising:

receiving a challenge request;

decrypting the challenge request using a first encryption key;

generating a response to the challenge request using a second encryption key;

sending the response to the challenge request;

receiving an encrypted magnetic fingerprint;

decrypting the encrypted magnetic fingerprint;

generating a score indicative of a degree of correlation between the magnetic fingerprint and a reference magnetic fingerprint; and

sending the score.