SYSTEM AND METHOD FOR REMOTELY ACTIVATING A PIN-PAD TERMINAL

• US 20170154333A1
• Filed: 10/12/2016
• Published: 06/01/2017
• Est. Priority Date: 11/27/2015
• Status: Active Grant

• Current Assignee: Toronto-Dominion Bank
• Original Assignee: Toronto-Dominion Bank
• Inventors: Gleeson, Bryan Michael, Dunstan, John Henry
• Granted Patent: US 11,328,298 B2
• Time in Patent Office: Days
• CPC Class Codes: G06Q 20/027 involving a payment switch or gateway
• CPC Class Codes: G06Q 20/3829 involving key management
• CPC Class Codes: G06Q 20/4012 Verifying personal identification numbers [PIN]
• CPC Class Codes: G07F 7/1025 Identification of user by a PIN code
• CPC Class Codes: H04L 2463/102 applying security measure for e-commerce data processing systems or methods, specially adapted for e-commerce G06Q30/00
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234

Abstract

A network gateway includes a gateway authenticator, a first network interface for interfacing the network gateway with a first computer network, and a second network interface for interfacing the network gateway with a second computer network that is distinct from the first computer network. The gateway authenticator receives from a pin-pad terminal, via the first computer network, an activation credential request that includes a first administrator credential. The pin-pad terminal receives the first administrator credential from a hardware token that is interfaced with the pin-pad terminal. The gateway authenticator is configured to (i) verify that, before the pin-pad terminal received the first administrator credential from the hardware token, the first computer network associated the first administrator credential with the pin-pad terminal; and (ii) install in the pin-pad terminal a digital authentication certificate that facilitates authentication of the pin-pad terminal to the second computer network via the network gateway.

Claims

1. A network gateway, comprising:

a first network interface configured to interface the network gateway with a first computer network;

a second network interface configured to interface the network gateway with a second computer network distinct from the first computer network; and

a gateway authenticator in communication with the network interfaces and configured to;

(i) receive from a pin-pad terminal, via the first computer network, an activation credential request including a first administrator credential, the pin-pad terminal receiving the first administrator credential from a hardware token interfaced with the pin-pad terminal;

(ii) verify that, before the pin-pad terminal received the first administrator credential from the hardware token, the first computer network associated the first administrator credential with the pin-pad terminal; and

(iii) install a digital authentication certificate in the pin-pad terminal, the digital authentication certificate facilitating authentication of the pin-pad terminal to the second computer network via the network gateway.

2. The network gateway according to claim 1, wherein the activation credential request includes a first terminal credential uniquely associated with the pin-pad terminal, and wherein the gateway authenticator is configured to install the digital authentication certificate after verifying that, before the pin-pad terminal received the first administrator credential from the hardware token, the first computer network associated the first administrator credential with the first terminal credential.

3. The network gateway according to claim 1, wherein the network gateway is configured to receive a second administrator credential from an input device of the pin-pad terminal, and to install the digital authentication certificate after confirming that the second computer network validated the administrator credentials.

4. The network gateway according to claim 1, wherein the activation credential request includes a first terminal credential uniquely associated with the pin-pad terminal, and wherein the gateway authenticator is configured to:

provide the pin-pad terminal with a private cryptographic key, in response to the activation credential request, after verifying that, before the pin-pad terminal received the first administrator credential from the hardware token, the first computer network associated the first administrator credential with the pin-pad terminal; and

receive the digital authentication certificate from the first computer network after the first computer network verifies that the pin-pad terminal provided the first computer network with a terminal activation request and generated the terminal activation request from the private cryptographic key.

5. The network gateway according to claim 4, wherein the gateway authenticator is configured to provide the private cryptographic key after verifying that, before the pin-pad terminal received the first administrator credential from the hardware token, the first computer network associated the first administrator credential with the first terminal credential.

6. The network gateway according to claim 4, wherein the gateway authenticator is configured to provide the pin-pad terminal with the private cryptographic key and a second terminal credential, and to install the digital authentication certificate after the first computer network verifying that (i) the pin-pad terminal generated the terminal activation request from the private cryptographic key and the second terminal credential and (ii) before the network gateway provided the pin-pad terminal with the second terminal credential, the private cryptographic key and the second terminal credential were uniquely associated with the pin-pad terminal.

7. The network gateway according to claim 1, wherein the activation credential request includes a first terminal credential uniquely associated with the pin-pad terminal, and wherein the gateway authenticator is configured to:

receive a private cryptographic key from the first computer network after verifying that, before the pin-pad terminal received the first administrator credential from the hardware token, the first computer network associated the first administrator credential with the pin-pad terminal;

generate a terminal activation request from the private cryptographic key, and transmit the terminal activation request to the first computer network; and

receive the digital authentication certificate from the first computer network in response to the terminal activation request, after the first computer network verifies that the terminal activation request was generated from the private cryptographic key.

8. The network gateway according to claim 7, wherein the gateway authenticator is configured to the receive the digital authentication certificate from the first computer network after the first computer network verifying that, before the pin-pad terminal received the first administrator credential from the hardware token, the first computer network associated the first administrator credential with the first terminal credential.

9. The network gateway according to claim 7, wherein the gateway authenticator is configured to generate a second terminal credential, generate the terminal activation request from the private cryptographic key and the second terminal credential, and receive the digital authentication certificate from the first computer network after the first computer network verifies that (i) the terminal activation request was generated from the private cryptographic key and the second terminal credential and (ii) before the network gateway generated the terminal activation request, the private cryptographic key and the second terminal credential were associated with the pin-pad terminal.

10. A method of remotely activating a pin-pad terminal, the method comprising:

a network gateway receiving from the pin-pad terminal, via a first computer network, an activation credential request including a first administrator credential, the pin-pad terminal receiving the first administrator credential from a hardware token interfaced with the pin-pad terminal; and

the network gateway verifying that, before the pin-pad terminal received the first administrator credential from the hardware token, the first computer network associated the first administrator credential with the pin-pad terminal; and

the network gateway installing a digital authentication certificate in the pin-pad terminal, the digital authentication certificate facilitating authentication of the pin-pad terminal to a second computer network, via the network gateway, distinct from the first computer network.

11. The method according to claim 10, wherein the activation credential request includes a first terminal credential uniquely associated with the pin-pad terminal, the first terminal credential being stored in a memory of the pin-pad terminal prior to the network gateway receiving the activation credential request.

12. The method according to claim 11, wherein the installing a digital authentication certificate comprises the first computer network providing the pin-pad terminal with the digital authentication certificate after verifying that, before the pin-pad terminal received the first administrator credential from the hardware token, the first computer network associated the first administrator credential with the first terminal credential.

13. The method according to claim 10, wherein the installing a digital authentication certificate comprises the network gateway receiving a second administrator credential from the pin-pad terminal, and the pin-pad terminal installing the digital authentication certificate in a memory thereof after the network gateway confirming that the second computer network validated the administrator credentials.

14. The method according to claim 11, wherein the installing a digital authentication certificate comprises:

the network gateway providing the pin-pad terminal with a private cryptographic key in response to the activation credential request, the network gateway providing the private cryptographic key after verifying that, before the pin-pad terminal received the first administrator credential from the hardware token, the first computer network associated the first administrator credential with the pin-pad terminal;

the first computer network receiving a terminal activation request from the pin-pad terminal; and

the first computer network providing the pin-pad terminal with the digital authentication certificate in response to the terminal activation request, the first computer network providing the digital authentication certificate after verifying that the pin-pad terminal generated the terminal activation request from the private cryptographic key.

15. The method according to claim 14, wherein the providing a private cryptographic key comprises the network gateway providing the pin-pad terminal with the private cryptographic key after the network gateway verifying that, before the pin-pad terminal received the first administrator credential from the hardware token, the first computer network associated the first administrator credential with the first terminal credential.

16. The method according to claim 14, wherein the providing a private cryptographic key comprises the network gateway providing the pin-pad terminal with the private cryptographic key and a second terminal credential, and the installing a digital authentication certificate comprises the first computer network providing the pin-pad terminal with the digital authentication certificate after verifying that (i) the pin-pad terminal generated the terminal activation request from the private cryptographic key and the second terminal credential and (ii) before the network gateway provided the pin-pad terminal with the second terminal credential, the private cryptographic key and the second terminal credential were uniquely associated with the pin-pad terminal.

17. The method according to claim 11, wherein the providing a digital authentication certificate comprises:

the network gateway receiving a private cryptographic key from the first computer network after the network gateway verifying that, before the pin-pad terminal received the first administrator credential from the hardware token, the first computer network associated the first administrator credential with the pin-pad terminal;

the network gateway generating a terminal activation request from the private cryptographic key, and transmitting the terminal activation request to the first computer network; and

the network gateway receiving the digital authentication certificate from the first computer network in response to the terminal activation request, the network gateway receiving the digital authentication certificate after the first computer network verifying that the terminal activation request was generated from the private cryptographic key.

18. The method according to claim 17, wherein the receiving the digital authentication certificate comprises the network gateway receiving the digital authentication certificate from the first computer network after the first computer network verifying that, before the pin-pad terminal received the first administrator credential from the hardware token, the first computer network associated the first administrator credential with the first terminal credential.

19. The method according to claim 17, wherein the generating a terminal activation request comprises the network gateway generating a second terminal credential, and generating the terminal activation request from the private cryptographic key and the second terminal credential, and the receiving the digital authentication certificate comprises the network gateway receiving the digital authentication certificate from the first computer network after the first computer network verifying that (i) the terminal activation request was generated from the private cryptographic key and the second terminal credential and (ii) before the network gateway generated the terminal activation request, the private cryptographic key and the second terminal credential were associated with the pin-pad terminal.

20. A computer-readable medium comprising non-transitory computer processing instructions stored thereon for execution by a network gateway, the computer processing instructions, when executed by the network gateway causing the network gateway to:

receive from a pin-pad terminal, via a first computer network, an activation credential request including a first administrator credential, the pin-pad terminal receiving the first administrator credential from a hardware token interfaced with the pin-pad terminal;

verify that, before the pin-pad terminal received the first administrator credential from the hardware token, the first computer network associated the first administrator credential with the pin-pad terminal; and

install a digital authentication certificate in the pin-pad terminal, the digital authentication certificate facilitating authentication of the pin-pad terminal to a second computer network, via the network gateway, distinct from the first computer network.