SCANNER ENABLED WITH A SECURE INPUT/OUTPUT (I/O) MODULE (SIOM)

• US 20160182448A1
• Filed: 12/17/2014
• Published: 06/23/2016
• Est. Priority Date: 12/17/2014
• Status: Active Grant

• Current Assignee: NCR Voyix Corporation
• Original Assignee: NCR Corporation
• Inventors: Kobres, Erick, Antonakakis, Stavros
• Granted Patent: US 10,154,008 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 2463/102 applying security measure for e-commerce data processing systems or methods, specially adapted for e-commerce G06Q30/00
• CPC Class Codes: H04L 63/0209 Architectural arrangements, e.g. perimeter networks or demilitarized zones
• CPC Class Codes: H04L 63/164 at the network layer

Abstract

A scanner is enabled for communication with a Secure Input/Output (I/O) Module (SIOM) using a secure communication protocol. The SIOM is provisioned with a manifest, and the manifest defines encryption for use over the secure communication protocol. Communication to and from the scanner occurs over secure communication sessions with the SIOM using the secure communication protocol.

Claims

1. A method, comprising:

receiving a pairing request from a Secure Input/Output Module (SIOM) executing on one or more hardware processors of a device; and

configuring a scanner to use a secure protocol for communicating with the SIOM in a secure session in response to the pairing request, wherein configuring further includes controlline device interaction to and from the scanner through the SIOM during the secure session.

2. The method of claim 1, wherein receiving further includes obtaining, by the SIOM, a manifest provisioned from an enterprise server when the scanner is powered up, wherein the manifest includes details for using the secure protocol to establish the secure session with the scanner, and the SIOM is embedded within the scanner.

3. The method of claim 1, wherein receiving further includes obtaining, by the SIOM, a manifest provisioned from an enterprise server in response to a manually initiated provisioning request, wherein the manifest includes details for using the secure protocol to establish the secure session with the scanner, and the SIOM is embedded within the scanner.

4. The method of claim 1, wherein receiving further includes obtaining, by the SIOM, a manifest provisioned from an enterprise server, wherein the manifest includes details for the SIOM for using the secure protocol to establish the secure session with the scanner, and the SIOM is integrated within a Point-Of-Sale (POS) terminal, and the scanner is a network scanner and interfaced to the POS terminal over a network connection.

5. The method of claim 1, wherein receiving further includes obtaining, by the SIOM, a manifest provisioned from a server or cloud-based environment, the SIOM is remotely located from a retail processing environment having the scanner over a Wide-Area Network (WAN) connection, wherein the manifest includes details for using the secure protocol to establish the secure session with the scanner.

6. The method of claim 1, wherein receiving further includes obtaining, by the SIOM, a manifest provisioned from an enterprise server, the SIOM is local to a retail processing environment having the scanner and is accessible to the scanner over a Local-Area Network (LAN) connection, and wherein the manifest includes details for the SIOM for using the secure protocol to establish the secure session with the scanner.

7. The method of claim 1, wherein configuring further includes identifying a security profile for use during the secure session using the secure protocol, wherein the security profile is selected by the SIOM for the scanner based on available security profiles accessible to the scanner.

8. The method of claim 7, wherein identifying further includes identifying encryption and encryption keys for use during the secure session from the security profile.

9. The method of claim 1 further comprising, engaging in the secure session to communicate an image taken by the scanner, wherein the image is associated with confidential information for a customer engaged in a transaction at a Point-Of-Sale (POS) device.

10. A method, comprising:

obtaining, by a Secure Input/Output Module (SIOM) integrated within a scanner and executing on one or more processors of the scanner, a manifest provisioned from an enterprise server, the manifest defining interactions between the SIOM and the scanner; and

configuring the scanner to use a secure protocol to engage in secure sessions with the SIOM, wherein configuring further includes controlling device interaction to and from the scanner through the SIOM during the secure sessions.

11. The method of claim 10, wherein obtaining further includes providing communications from the enterprise server to the SIOM through an interface to a tamper resistant secure module integrated into the scanner.

12. The method of claim 10, wherein obtaining further includes receiving, by the SIOM, the manifest when the scanner is powered up from the enterprise server.

13. The method of claim 10, wherein obtaining further includes identifying, by the SIOM, a list of available security profiles that the scanner is equipped to handle during the secure sessions.

14. The method of claim 13, wherein identifying further includes selecting, by the SIOM, a particular security profile for a particular secure session and instructing the scanner to configure for using encryption and encryption keys relevant to that particular security profile for communication over that particular secure session when communicating with the SIOM.

15. The method of claim 10 further comprising, managing, by the scanner, within a secure storage dynamic session keys for each of the secure sessions.

16. The method of claim 10 further comprising, engaging, by the scanner, in at least one secure session using a wireless connection.

17. The method of claim 10 further comprising, engaging, by the scanner, in at least one secure session using a wired connection.

18. A system comprising:

a scanner;

a secure input/output module (SIOM) integrated within the scanner, the SIOM configured and adapted to;

i) execute on one or more hardware processors of the scanner, ii) be provisioned with a manifest from an enterprise server, iii) pair with the scanner using at least a portion of the provisioned manifest, and ii) establish a secure session for the scanner to communicate with the SIOM using a security profile defined by the portion of the manifest and control other secure sessions between the scanner and other devices.

19. The system of claim 18, wherein the SIOM is further configured and adapted to:

iv) establish a different secure session with a peripheral that is external to the scanner using a different portion of the provisioned manifest.

20. The system of claim 18, wherein the scanner is one of:

integrated into a Point-Of-Sale (POS) terminal and operated as an independent network-based scanner independent of any particular terminal of a network.