SOFTWARE PIN ENTRY

• US 20130328801A1
• Filed: 03/13/2013
• Published: 12/12/2013
• Est. Priority Date: 06/12/2012
• Status: Active Grant

• Current Assignee: Block, Inc. (f/k/a Square, Inc.)
• Original Assignee: Square Inc (Block, Inc. (f/k/a Square, Inc.))
• Inventors: Lee, Bob, Quigley, Oliver S. C., McCauley, Nathan
• Granted Patent: US 9,367,842 B2
• Time in Patent Office: Days
• US Class Current: 345/173
• CPC Class Codes: G06F 21/35 communicating wirelessly
• CPC Class Codes: G06Q 20/322 Aspects of commerce using mobile devices [M-devices]
• CPC Class Codes: G06Q 20/3226 Use of secure elements separate from M-devices
• CPC Class Codes: G06Q 20/326 Payment applications installed on the mobile devices
• CPC Class Codes: G06Q 20/353 Payments by cards read by M-devices
• CPC Class Codes: G06Q 20/3674 involving authentication
• CPC Class Codes: G06Q 20/3829 involving key management
• CPC Class Codes: G06Q 20/4012 Verifying personal identification numbers [PIN]
• CPC Class Codes: G06Q 2220/00 Business processing using cryptography
• CPC Class Codes: G07F 19/211 Software architecture within ATMs or in relation to the ATM network
• CPC Class Codes: G07F 7/1041 PIN input keyboard gets new key allocation at each use
• CPC Class Codes: G07F 7/1091 Use of an encrypted form of the PIN
• CPC Class Codes: H04L 2209/805 Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3271 using challenge-response
• CPC Class Codes: H04W 12/065 Continuous authentication
• CPC Class Codes: H04W 12/068 using credential vaults, e.g. password manager applications or one time password [OTP] applications
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys

Abstract

A card reader configured to read a smart card can be detachably connected to a mobile computing device. When the card reader is attached to the mobile device, an application installed on the mobile computing device permits the mobile device to communicate with the card reader in order to process transactions.

Security measures can be used on the mobile device to prevent theft of a PIN during software PIN entry of a payment transaction. The mobile device can prevent the keypad or other input interface from displaying feedback. The mobile device can also prevent passcodes from being stolen by displaying media encoded with digital rights management (DRM) and by managing the media and user inputs at a secure server.

A mobile device can securely communicate with a card reader for a payment transaction using asymmetric or symmetric encryption.

Claims

1. A method for providing security during passcode entry on a mobile device, comprising:

displaying an interface for receiving a passcode, where the interface includes one or more objects;

receiving user input on a display of the mobile device;

not displaying feedback based on the user input, where the mobile device does not display feedback in one or more of the one or more objects;

determining the passcode based on the user input; and

submitting the passcode for authentication.

2. The method of claim 1, where the submitting comprises:

submitting the passcode to a card reader.

3. The method of claim 1, where the feedback takes form through one or more of the following:

visual, audio, or tactile.

4. The method of claim 1, where the one or more objects include a keypad and a passcode field, and where the mobile device displays, on the passcode field, a symbol for each user entry from the user, and where the mobile device does not display, on the keypad, feedback based on the user input.

5. The method of claim 1, where the one or more objects include a keypad and a passcode field, and where the mobile device does not display feedback in the keypad or the passcode field.

6. The method of claim 1, where the feedback is not displayed in any of the one or more objects.

7. The method of claim 1, where the feedback is displayed in some of the one or more objects.

8. The method of claim 1, further comprising:

disabling an ability of the one or more objects to change visual state.

9. The method of claim 1, where the determining is based on locations of the user input on the display.

10. A system comprising:

a processor; and

computer-readable medium coupled to the processor and having instructions stored thereon, which, when executed by the processor, cause the processor to perform operations comprising;

displaying an interface for receiving a passcode, where the interface includes one or more objects;

receiving user input on a display of the mobile device;

not displaying feedback based on the user input, where the mobile device does not display feedback in one or more of the one or more objects;

determining the passcode based on the user input; and

submitting the passcode for authentication.

11. The system of claim 10, where the submitting comprises:

submitting the passcode to a card reader.

12. The system of claim 10, where the feedback takes form through one or more of the following:

visual, audio, or tactile.

13. The system of claim 10, where the one or more objects include a keypad and a passcode field, and where the mobile device displays, on the passcode field, a symbol for each user entry from the user, and where the mobile device does not display, on the keypad, feedback based on the user input.

14. The system of claim 10, where the one or more objects include a keypad and a passcode field, and where the mobile device does not display feedback in the keypad or the passcode field.

15. The system of claim 10, where the feedback is not displayed in any of the one or more objects.

16. The system of claim 10, where the feedback is displayed in some of the one or more objects.

17. The system of claim 10, further comprising:

disabling an ability of the one or more objects to change visual state.

18. The system of claim 10, where the determining is based on locations of the user input on the display.

19. A computer-readable medium having instructions stored thereon, which, when executed by a processor, cause the processor to perform operations comprising:

displaying an interface for receiving a passcode, where the interface includes one or more objects;

receiving user input on a display of the mobile device;

not displaying feedback based on the user input, where the mobile device does not display feedback in one or more of the one or more objects;

determining the passcode based on the user input; and

submitting the passcode for authentication.

20. The computer-readable medium of claim 19, where the submitting comprises:

submitting the passcode to a card reader.

21. The computer-readable medium of claim 19, where the feedback takes form through one or more of the following:

visual, audio, or tactile.

22. The computer-readable medium of claim 19, where the one or more objects include a keypad and a passcode field, and where the mobile device displays, on the passcode field, a symbol for each user entry from the user, and where the mobile device does not display, on the keypad, feedback based on the user input.

23. The computer-readable medium of claim 19, where the one or more objects include a keypad and a passcode field, and where the mobile device does not display feedback in the keypad or the passcode field.

24. The computer-readable medium of claim 19, where the feedback is not displayed in any of the one or more objects.

25. The computer-readable medium of claim 19, where the feedback is displayed in some of the one or more objects.

26. The computer-readable medium of claim 19, further comprising:

disabling an ability of the one or more objects to change visual state.

27. The computer-readable medium of claim 19, where the determining is based on locations of the user input on the display.