System and method for secure transaction

• US 8,595,490 B2
• Filed: 12/10/2007
• Issued: 11/26/2013
• Est. Priority Date: 10/17/2006
• Status: Active Grant

• Current Assignee: Verifone, Inc. (Verifone Systems, Inc.)
• Original Assignee: Verifone, Inc. (Verifone Systems, Inc.)
• Inventors: von Mueller, Clay, Yale, Scott R., Hazel, Patrick K., Catinella, Paul
• Primary Examiner(s): Orgad, Edan
• Assistant Examiner(s): Kabir, Jahangir
• Application Number:
  US11/953,253
• Publication Number:
  US 20090070583A1
• Time in Patent Office: 2,178 Days
• Field of Search: 713/150, 713/155, 713/159, 713/168, 713/172, 380/210, 380/227, 380/228, 380/277, 380/278, 705/35, 705/39, 705/40, 705/42, 705/44, 705 64- 79
• US Class Current: 713/168
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06Q 20/085 involving remote charge determination or related payment systems
• CPC Class Codes: G06Q 20/12 specially adapted for electronic shopping systems
• CPC Class Codes: G06Q 20/367 involving electronic purses or money safes
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: G06Q 20/3823 combining multiple encryption tools for a transaction
• CPC Class Codes: G06Q 20/3829 involving key management
• CPC Class Codes: G06Q 20/401 Transaction verification
• CPC Class Codes: G06Q 20/4012 Verifying personal identification numbers [PIN]
• CPC Class Codes: G06Q 2220/00 Business processing using cryptography postage metering system using cryptography G06Q2250/05
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853

Abstract

Systems and methods for performing a secure transaction provided. In one embodiment, the method includes: reading data on a command token, reading data on a token; encrypting the token data with a key; encrypting an authentication data with a clear text token data; and transmitting the encrypted authentication data with the encrypted token data to a remote device.

Claims

1. A method for encrypting token data for a transaction comprising:

reading clear text token data from a token;

encrypting the clear text token data using a key, the encrypting comprising;

defining a first portion and a second portion of the clear text token data, encrypting the second portion using the key, and

encrypting the first portion using the encrypted second portion using while preserving the second portion as unencrypted to generate an encrypted token data, the encrypted token data comprising an encrypted first portion and an unencrypted second portion and having the same format as the clear text token data;

encrypting authentication data using the encrypted first portion; and

transmitting the encrypted authentication data and the encrypted token data to a remote device.

2. The method of claim 1, wherein the token is a magnetic stripe card.

3. The method of claim 1, further comprising:

receiving a confirmation from the remote device that the encrypted token data is correct.

4. The method of claim 1, wherein the first portion comprises an account number.

5. The method of claim 1, wherein the step of encrypting the first portion using the encrypted second portion comprises applying the encrypted second portion to the first portion using mod 10 addition.

6. The method of claim 5, wherein the clear text token data comprises a mod 10 check digit.

7. The method of claim 5, the encrypting further comprising the operations of:

determining a digit that can be inserted into the encrypted token data to cause a modulo 10 arithmetic check of the encrypted token data to yield the same result as a modulo 10 arithmetic check would yield on the clear text token data; and

inserting the digit into the encrypted token data.

9. The transactional device of claim 7, wherein the token is a magnetic stripe card.

8. A transactional device comprising:

a first secure module configured to read clear text token data from a token and to encrypt the token data using a key, the encrypting comprising;

defining a first portion and a second portion of the clear text token data;

encrypting the second portion using the key, and encrypting the first portion using the encrypted second portion while preserving the second portion as unencrypted to generate, an encrypted token data, the encrypted token data comprising an encrypted first portion and an unencrypted second portion and having the same format as the clear text token data; and

a second secure module configured to receive the encrypted token data from the first secure module, to encrypt authentication data using the encrypted first portion, and to transmit transmitting the encrypted authentication data and the encrypted token data to a remote device.

10. The transactional device of claim 8, wherein the first portion comprises an account number.

11. The transactional device of claim 8, wherein the step of encrypting the first portion using the encrypted second portion comprises applying the encrypted second portion to the first portion using mod 10 addition.

12. The transactional device of claim 11, wherein the clear text token data comprises a mod 10 check digit.

13. The transactional device of claim 11, wherein the first secure module encrypts the clear text token data by further performing:

determining a digit that can be inserted into the encrypted token data to cause a modulo 10 arithmetic check of the encrypted token data to yield the same result as a modulo 10 arithmetic check would yield on the clear text token data; and

inserting the digit into the encrypted token data.

14. A computer program product comprising a non-transitory computer useable medium having computer program code embodied therein for enabling a computing device to perform a method for encrypting token data for a transaction, the method comprising:

reading clear text token data from a token;

encrypting the clear text token data using a key, the encrypting comprising;

defining a first portion and a second portion of the clear text token data, encrypting the second portion using the key, and

encrypting the first portion using the encrypted second portion while preserving the second portion as unencrypted to generate an encrypted token data, the encrypted token data comprising an encrypted first portion and an unencrypted second portion, wherein the encrypted token data and having the same format as the clear text token data; and

encrypting authentication data using the encrypted first portion; and

transmitting the encrypted authentication data and the encrypted token data to a remote device.

15. The computer program product of claim 14, wherein the token is a magnetic stripe card.

16. The computer program product of claim 14, wherein the first portion comprises an account number.

17. The computer program product of claim 14, wherein the step of encrypting the first portion using the encrypted second portion comprises applying the encrypted second portion to the first portion using mod 10 addition.

18. The computer program product of claim 17, wherein the clear text token data comprises a mod 10 check digit.

19. The computer program product of claim 18, the encrypting further comprising the operations of:

determining a digit that can be inserted into the encrypted token data to cause a modulo 10 arithmetic check of the encrypted token data to yield the same result as a modulo 10 arithmetic check would yield on the clear text token data; and

inserting the digit into the encrypted token data.