Method for secure pin entry on touch screen display

• US 6,549,194 B1
• Filed: 10/01/1999
• Issued: 04/15/2003
• Est. Priority Date: 10/01/1999
• Status: Expired due to Fees

• Current Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Original Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Inventors: Faoro, Dave, Sheets, John Foxe, Morlang, Keven Paul, McIntyre, Keith Eric, Watson, Curtis W., Gougeon, Dominique Andre Jean
• Primary Examiner(s): Saras, Steven
• Assistant Examiner(s): Anyaso, Uchendu O.
• Application Number:
  US09/410,397
• Time in Patent Office: 1,292 Days
• Field of Search: 345/173, 345/177, 713/194, 713/183, 705/73, 705/18, 705/16, 705/25, 340/5.4, 340/5.26, 340/5.27, 340/5.54
• US Class Current: 345/173
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G07C 9/33 by means of a password
• CPC Class Codes: G07F 7/1041 PIN input keyboard gets new key allocation at each use

Abstract

A method for operating a combination touch pad and display screen device as a PINpad for entering a A plurality of numerical keypad layouts for the display screen are defined. Each keypad layout has a unique arrangement of decimal number locations differing from one layout to all others. For each PIN entry event a random one of the numerical keypad layouts is selected and displayed on the display screen.

Claims

1. A method for operating a combination touch pad and display screen device as a PINpad for entering a confidential personal identification number, said touch pad being controlled by a touch pad controller and having an associated security processor, said display being controlled by an application processor in communication with said touch pad controller and said display screen, said method comprising the steps of:

a. defining a plurality of numerical keypad layouts for said display screen, each having a unique arrangement of decimal number locations differing from one layout to all others, and each having an ENTER key at a location differing from said decimal number locations;

b. storing in association with said touch pad controller a set of touch pad hot spot arrangements corresponding to said plurality of numerical keypad layouts;

c. storing in association with said application processor a set of display layouts corresponding to said plurality of numerical keypad layouts;

d. said touch pad controller selecting for each PIN entry event a random number in the number range corresponding to said plurality of numerical keypad layouts said touch pad controller responding to said PIN data entry command by executing the steps of;

selecting a random number in the number range corresponding to said plurality of numerical keypad layouts wherein the touch pad controller sends a keypad layout message to said application processor corresponding to said random number;

e. said application processor displaying on said display screen a data entry screen having a set of discretely labeled data entry buttons corresponding to the one of said set of display layouts associated with said random number; and

f. said touch pad controller carrying out the steps of;

f.1 setting a corresponding one of said touch pad hot spot arrangements associated with said random number;

f.2 responding to a sequence of touch events corresponding to active data entry buttons in said touch pad hot spot arrangement by storing each of the associated PIN numerals; and

f.3 responding to a touch event corresponding to said “

ENTER”

command button by encrypting said stored PIN numerals using said security processor and sending the encrypted PIN data to said application processor.

2. A method for operating a combination touch pad and display screen device as a secured data entry device in a point-of-sale transaction environment in which secret PIN entries are required, said touch pad being controlled by a touch pad controller with an associated security processor and being located within a security module for protection against intrusion, said display being controlled by an application processor in communication with said touch pad controller and said display screen, said method comprising the steps of:

defining a plurality of numerical keypad layouts for said display screen, each having a unique arrangement of decimal number locations differing from one layout to all others of said layouts and having at least an “

ENTER”

command button;

storing in memory associated with said application processor indicia of each of said plurality of numerical keypad layouts;

storing in memory associated with said touch pad controller indicia of a hot spot layout corresponding to each of said plurality of numerical keypad layouts;

said application processor sending to said touch pad controller a PIN data entry command requesting execution of a PIN entry touch event routine and, upon receipt of a keypad layout message from said touch pad controller, displaying on said display screen device one of said numerical keypad layouts corresponding to said keypad layout message;

said touch pad controller responding to said FIN data entry command by executing the steps of;

selecting a random number in the number range corresponding to said plurality of numerical keypad layouts;

sending a keypad layout message to said application processor corresponding to said random number;

setting a corresponding one of said touch pad hot spot arrangements associated with said random number;

responding to a sequence of touch events on hot spots corresponding to active data entry buttons by storing each of the associated PIN numerals; and

responding to a touch event corresponding to said “

ENTER”

command button by encrypting said stored PIN numerals using said security processor and sending the encrypted PIN data to said application processor.

3. A method for operating a device including a touch pad, a display screen, and a touch pad controller, as a device for entering confidential personal information, said touch pad controller being connected to an application processor external to said device, said application processor executing application programs to control said display screen, and said touch pad controller arranged to receive signals from said touch pad indicative of the locations of touches, said method comprising the steps of:

a. storing in association with said touch pad controller a plurality of numerical keypad layouts;

b. storing in association with said application processor a set of display layouts corresponding to said plurality of numerical keypad layouts;

c. when an application program executed by said application processor requires entry of confidential information through said touch pad, causing the application processor to inform the touch pad controller of the information entry requirement;

d. causing the touch pad controller to generate a random number, retrieve one of said plurality of numerical keypad layouts associated with said random number, and send a keypad layout message to the application processor;

e. causing the application processor to display one of said display layouts corresponding to said one of said plurality of numerical keypad layouts associated with said random number;

f. causing the touch pad controller to correlate locations of touches with said confidential information based on the retrieved keypad layout data; and

g. sending the confidential information from the touch pad controller to the application processor.

4. A method as claimed in claim 3, wherein said confidential information is a PIN.

5. A method as claimed in claim 4, wherein said PIN is encrypted by said touch pad controller before the PIN is sent to the application processor.

6. A method as claimed in claim 3, wherein said confidential information is encrypted by said touch pad controller before the touch pad controller sends said confidential information to said application processor.