SECURE PAYMENT CARD TRANSACTIONS

• US 20130091028A1
• Filed: 09/12/2012
• Published: 04/11/2013
• Est. Priority Date: 05/17/2007
• Status: Active Grant

• Current Assignee: Shift4 Corporation (Shift4 Payments, Inc.)
• Original Assignee: Shift4 Corporation (Shift4 Payments, Inc.)
• Inventors: Oder, John David, Cronic, Kevin James, Sommers, Steven Mark, Warner, Dennis William, Oder ("J.D."), John David II
• Granted Patent: US 8,690,056 B2
• Time in Patent Office: Days
• US Class Current: 705/16
• CPC Class Codes: G06Q 20/20 Point-of-sale [POS] network systems
• CPC Class Codes: G06Q 20/202 Interconnection or interaction of plural electronic cash registers [ECR] or to host computer, e.g. network details, transfer of information from host to ECR or from ECR to ECR
• CPC Class Codes: G06Q 20/3278 RFID or NFC payments by means of M-devices
• CPC Class Codes: G06Q 20/34 using cards, e.g. integrated circuit [IC] cards or magnetic cards
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: G06Q 20/3821 Electronic credentials
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 20/401 Transaction verification
• CPC Class Codes: G06Q 20/409 Device specific authentication in transaction processing
• CPC Class Codes: G06Q 2220/00 Business processing using cryptography postage metering system using cryptography G06Q2250/05
• CPC Class Codes: G06Q 40/00 Finance; Insurance; Tax strategies; Processing of corporate or income taxes
• CPC Class Codes: G07F 7/088 the card reader being part of the point of sale [POS] terminal or electronic cash register [ECR] itself

Abstract

Payment card transactions at a point of sale (POS) are secured in certain embodiments by intercepting, with a POS security layer installed on a POS terminal, payment data from the POS terminal, transmitting the payment data from the POS security layer to a server security application installed on a POS server, and providing false payment data from the POS security layer to a POS terminal application installed on the POS terminal. The false payment data in various embodiments is processed as if it were the payment data, such that the POS terminal transmits an authorization request to the POS server using the false payment data. In addition, the authorization request may be transmitted from the POS server to a payment gateway.

Claims

1. Non-transitory computer storage having stored thereon computer-executable instructions that direct a computer-implemented payment system to perform a method for securing payment transactions, the method comprising:

capturing payment data, the payment data comprising card data from a payment card;

generating substitute payment data; and

providing the substitute payment data to a payment application, thereby causing the payment application to use the substitute payment data in place of the card data when sending an authorization request, said substitute payment data not being valid payment data, but being capable of being treated as actual payment data by the payment application.

2. The non-transitory computer storage of claim 1, wherein the method, by providing the substitute payment data to the payment application, prevents the captured payment data from being stored at a merchant location.

3. The non-transitory computer storage of claim 1, wherein capturing the payment data further comprises preventing the captured payment data from being provided to the payment application.

4. The non-transitory computer storage of claim 1, further comprising a server security application configured to receive the captured payment data and to generate the substitute payment data.

5. The non-transitory computer storage of claim 1, wherein the substitute payment data comprises a token.

6. The non-transitory computer storage of claim 5, wherein the method further comprises associating the token with the payment data thereby enabling the payment application to transmit multiple authorization requests using the substitute payment data in place of the card data.

7. The non-transitory computer storage of claim 1, wherein generating the substitute payment data further comprises generating the substitute payment data based, at least in part, on the payment data.

8. The non-transitory computer storage of claim 1, wherein the substitute payment data comprises format preserving data that enables the payment application to process the substitute payment data as if it were actual payment data.

9. The non-transitory computer storage of claim 1, wherein the substitute payment data is in a format that enables the substitute payment data to be treated by the payment application as actual payment data.

10. The non-transitory computer storage of claim 1, wherein the substitute payment data comprises false payment data.

11. The non-transitory computer storage of claim 1, wherein the substitute payment data comprises encrypted payment data.

12. The non-transitory computer storage of claim 1, wherein the substitute payment data comprises a combination of false payment data and encrypted payment data.

13. The non-transitory computer storage of claim 1, wherein the substitute payment data comprises at least a portion of the payment data.

14. The non-transitory computer storage of claim 1, wherein the method further comprises encrypting the substitute payment data.

15. The non-transitory computer storage of claim 1, wherein generating the substitute payment data further comprises generating unique substitute payment data.

16. The non-transitory computer storage of claim 1, wherein the substitute payment data has a card-swipe compatible format.

17. The non-transitory computer storage of claim 1, wherein at least a portion of the substitute payment data is derived from a range of invalid card numbers.

18. The non-transitory computer storage of claim 1, wherein generating the substitute payment data further comprises:

encrypting the payment data; and

processing the encrypted payment data to obtain the substitute payment data.

19. The non-transitory computer storage of claim 1, wherein the substitute payment data is formatted such that the payment application is unaware that the payment application is processing substitute data.

20. The non-transitory computer storage of claim 1, wherein the payment application comprises a POS application.

21. A method of generating false payment data, the method comprising:

detecting a payment data entry associated with a payment card;

in response to detecting the payment data entry, capturing payment data included in the payment data entry, the payment data comprising an account number; and

performing, by a computing device, a substitute payment data generation process on the payment data to obtain substitute payment data, said performing comprising;

obtaining false data;

replacing at least a first portion of the account number with the false data; and

preserving at least a second portion of the account number, wherein preserving the second portion of the account number enables a POS system to process the substitute payment data as if it were payment data.

22. The method of claim 21, wherein obtaining the false data comprises generating the false data.

23. The method of claim 22, wherein the false data is generated randomly.

24. The method of claim 21, wherein obtaining the false data comprises selecting a next successive number in a sequence.

25. The method of claim 21, wherein performing the format preserving encryption further comprises preserving at least a third portion of the account number.

26. The method of claim 25, wherein the first portion of the account number comprises a portion of the account number between the second portion and the third portion.

27. The method of claim 21, wherein the substitute payment data is in a card-swipe compatible format.

28. The method of claim 21, wherein the substitute data comprises an invalid card number.

29. The method of claim 21, wherein the payment data further comprises ancillary data.

30. The method of claim 29, wherein performing the format preserving encryption further comprises replacing at least a portion of the ancillary data with false ancillary data.

31. The method of claim 21, wherein the substitute payment data generation process is a format preserving encryption process.

32. Non-transitory computer storage having stored thereon computer-executable instructions that direct a computer-implemented payment system to perform a method for generating false payment data, the method comprising:

detecting a payment data entry associated with a payment card;

in response to detecting the payment data entry, capturing payment data included in the payment data entry, the payment data comprising an account number; and

performing, by a computing device, format preserving encryption on the payment data to obtain substitute payment data, said performing comprising;

obtaining false data;

replacing at least a first portion of the account number with the false data; and

preserving at least a second portion of the account number, wherein preserving the second portion of the account number enables a POS system to process the substitute payment data as if it were payment data.

33. The non-transitory computer storage of claim 32, wherein the payment data further comprises ancillary data, and wherein performing the format preserving encryption further comprises replacing at least a portion of the ancillary data with false ancillary data.

34. The non-transitory computer storage of claim 32, wherein the substitute payment data is in a card-swipe compatible format.

35. Non-transitory computer storage having stored thereon computer-executable instructions that direct a computer-implemented payment system to perform a method for securing payment transactions, the method comprising:

capturing payment data;

generating substitute payment data by replacing at least a portion of the payment data to obtain the substitute payment data; and

providing the substitute payment data to a payment application thereby enabling the payment application to transmit an authorization request using the substitute payment data in place of the captured payment data, wherein the substitute payment data is formatted to enable the payment application to process the substitute payment data as if it were actual payment data.