SECURITY MODULE AND METHOD OF SECURING PAYMENT INFORMATION

• US 20140067689A1
• Filed: 09/12/2012
• Published: 03/06/2014
• Est. Priority Date: 08/31/2012
• Status: Abandoned Application

• Current Assignee: NCR Corporation
• Original Assignee: NCR Corporation
• Inventors: Rogers, Ron William
• Application Number:
  US13/612,305
• Publication Number:
  US 20140067689A1
• Time in Patent Office: Days
• US Class Current: 705/71
• CPC Class Codes: G06F 21/72 in cryptographic circuits
• CPC Class Codes: G06F 21/83 input devices, e.g. keyboards, mice or controllers thereof
• CPC Class Codes: G06Q 20/3567 Software being in the reader
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: G07F 7/0873 Details of the card reader
• CPC Class Codes: G07F 7/1033 Details of the PIN pad

Abstract

A security module of a computer which is invisible to an operating system executed by a processor of the computer and which establishes an encrypted session for receiving payment data from a payment peripheral.

Claims

1. A security module of a computer which is invisible to an operating system executed by a processor of the computer and which establishes an encrypted session for receiving payment data from a payment peripheral.

2. A computer comprising:

a processor which executes an operating system; and

a security module which is invisible to the operating system which establishes an encrypted session for receiving payment data from a payment peripheral.

3. The computer of claim 2, wherein the computer further comprises an enclosure containing both the processor and the security module.

4. The computer of claim 2, wherein the computer further comprises a first enclosure containing the processor and a second enclosure outside the first enclosure containing the security module.

5. A method of securing payment information comprising:

sending a key to a peripheral by a security module of a computer; and

establishing with the peripheral using the key an encrypted session which is invisible to an operating system executed by a processor of the computer by the security module.

6. The method of claim 5, further comprising:

polling the peripheral with an unencrypted message including a request for a peripheral identifier of the peripheral by the security module;

receiving an unencrypted reply message containing the peripheral identifier; and

determining that the peripheral identifier is in a list of peripherals capable of communicating over an encrypted connection.

7. The method of claim 5, wherein polling comprises:

polling the peripheral during startup of the computer.

8. The method of claim 5, wherein polling comprises:

polling the peripheral after connection of the peripheral to the computer.

9. The method of claim 6, wherein the key comprises a complimentary key to a seed key stored within the peripheral;

wherein sending further comprises sending the complimentary key to the peripheral; and

wherein the peripheral combines the complimentary key with the seed key to form the session key.

10. The method of claim 9, wherein a copy of the seed key is also stored within the security module and wherein establishing comprises:

combining the complimentary key with the copy of the seed key to form a copy of the session key by the security module.

11. The method of claim 10, wherein establishing further comprises:

sending a test message to the peripheral and a command to encrypt and return an encrypted test message;

receiving a reply message from the peripheral;

beginning the encrypted session when the reply message is decryptable and a decrypted reply message matches the test message.

12. The method of claim 5, further comprising:

sending a different key to another peripheral by the security module; and

establishing using the different key another encrypted session with the other peripheral by the security module.

13. The method of claim 5, wherein the key is different than a previous key from a previous encrypted session with the peripheral.

14. The method of claim 5, further comprising:

determining that the encrypted session has ended;

sending a different key to the peripheral by the security module; and

establishing using the different key another encrypted session with the peripheral by the security module.

15. The method of claim 6, further comprising:

polling the peripheral during the encrypted session by the security module;

receiving a response from the peripheral during the encrypted session by the security module; and

sending a different key to the peripheral to continue the encrypted session by the security module.

16. The method of claim 5, further comprising:

monitoring the encrypted session for a session ending condition by the security module; and

terminating the encrypted session upon detection of the session ending condition.

17. The method of claim 6, further comprising:

monitoring the encrypted session for a session ending condition by the security module; and

terminating the encrypted session upon detection of the session ending condition;

wherein the session ending condition comprises a failure of the peripheral to respond to a message from the security module.

18. The method of claim 6, further comprising:

monitoring the encrypted session for a session ending condition by the security module; and

terminating the encrypted session upon detection of the session ending condition;

wherein the session ending condition comprises receiving a response from the peripheral without the peripheral identifier in the list.

19. The method of claim 6, further comprising:

polling another peripheral with another unencrypted message including a request for another peripheral identifier of the other peripheral by the security module; and

determining that the other peripheral identifier is not in the list of peripherals.

20. The method of claim 19, wherein the other peripheral includes another payment peripheral with its own security module.

21. The method of claim 19, wherein the other peripheral is not a payment peripheral.

22. A method of securing payment information comprising:

polling a peripheral with a message including a request for a peripheral identifier of the peripheral by a security module of a computer; and

establishing an encrypted session with the peripheral by the security module when the peripheral responds with a reply message containing the peripheral identifier and the peripheral identifier is in a list of peripherals capable of communicating over an encrypted connection;

wherein the encrypted session is invisible to an operating system executed by a processor of the computer.