Systems and methods for fuel dispenser security

• US 9,580,295 B2
• Filed: 08/21/2015
• Issued: 02/28/2017
• Est. Priority Date: 11/18/2013
• Status: Active Grant

• Current Assignee: Dover Fueling Solutions UK Ltd. (Dover Corporation)
• Original Assignee: Wayne Fueling Systems Sweden AB (Dover Corporation)
• Inventors: Bergqvist, Anders
• Primary Examiner(s): Smithers, Matthew
• Application Number:
  US14/832,361
• Publication Number:
  US 20150360932A1
• Time in Patent Office: 557 Days
• US Class Current: 1/1
• CPC Class Codes: B67D 7/04 for transferring fuels, lubricants or mixed fuels and lubricants
• CPC Class Codes: B67D 7/06 Details or accessories
• CPC Class Codes: B67D 7/348 by interrogating an information transmitter, e.g. a transponder B67D7/145 takes precedence
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06Q 10/10 Office automation; Time management
• CPC Class Codes: G06Q 50/06 Energy or water supply
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint

Abstract

Systems and methods for fuel dispenser security are disclosed herein. In some embodiments, a user seeking access to a protected function of the fuel dispenser is presented with a challenge that is encrypted using a secret key that is unique to the fuel dispenser. To access the secured function, the user must obtain a session password from a server which authenticates the user, decrypts the challenge using a counterpart of the secret key, determines whether the user is authorized to access the secured function, and returns the session password extracted from the challenge only when the user is authorized. The server can thus control access to certain fuel dispenser functions according to a set of user access privileges. The challenge can also include additional information which can be used by the fuel dispenser and/or by the server to store a log of access activity.

Claims

1. A security system, comprising:

at least one database storing, for each of a plurality of users, a unique user identification that identifies the user, authentication information associated with the user, and one or more access privileges defined for the user; and

a server including a network interface configured to communicate with a user device over a network, the server being configured to;

receive at the network interface from the user device encrypted data and a unique identifier of a secure device for which a user of the user device seeks access;

query the at least one database to determine whether the user of the user device is an authorized user of the server;

in response to determining that the user of the user device is an authorized user of the server, query the at least one database to obtain a secret key associated with the unique identifier received from the user device;

decrypt the encrypted data using the obtained secret key;

extract a function code and a session password from the decrypted data;

query the at least one database to determine whether the user of the user device is authorized to access a function represented by the function code; and

in response to determining that the user is authorized to access the function represented by the function code, transmit the session password to the user device via the network interface.

2. The system of claim 1, wherein the server is configured to receive at the network interface from the user device authentication data associated with the user of the user device, and determining whether the user of the user device is an authorized user of the server includes comparing the received authentication data with the authentication information stored in the at least one database.

3. The system of claim 1, wherein the server is configured to receive at the network interface from the user device access privilege data associated with the user of the user device, and determining whether the user of the user device is authorized to access a function represented by the function code includes comparing the received access privilege data with the one or more access privileges stored in the at least one database.

4. The system of claim 1, wherein the encrypted data is generated by the secure device and is transmitted from the secure device to the user device.

5. The system of claim 1, wherein the function includes installing software on the secure device, authenticating the secure device, and accessing a log of activity of the secure device.

6. The system of claim 1, wherein the secure device includes a fuel dispenser.

7. The system of claim 6, wherein the function includes at least one of verifying a calibration procedure of the fuel dispenser, installing software on the fuel dispenser, authenticating the fuel dispenser, and accessing a log of activity of the fuel dispenser.

8. A fuel dispenser security system, comprising:

a server configured to authorize a user device to electronically access a secured function of a select one of a plurality of fuel dispensers in response to the server

receiving from the user device an identifier uniquely identifying the select one of the fuel dispensers,

authenticating a user of the user device as being among one or more users predetermined to have authorized access to the server, and

determining that the user of the user device has been pre-authorized to access the secured function;

wherein each of the plurality of fuel dispensers has associated therewith a predetermined identifier that uniquely identifies the fuel dispenser.

9. The system of claim 8, wherein the secured function includes at least one of verifying a calibration procedure of the fuel dispenser, installing software on the fuel dispenser, authenticating the fuel dispenser, and accessing a log of activity of the fuel dispenser.

10. The system of claim 8, wherein the server is configured to receive authentication information from the user device, and authenticating the user of the user device includes

comparing the received authentication information with user access data stored in at least one database indicating authorized server access for each of a plurality of users, and

determining that the received authentication information corresponds to the user access data for one of the plurality of users.

11. The system of claim 8, wherein the server is configured to receive an encrypted challenge from the user device, and determining that the user of the user device has been pre-authorized to access the secured function includes

retrieving from at least one database a secret key associated with the select one of the fuel dispensers, the at least one database storing the secret key therein as being uniquely associated with the identifier, and

decrypting the encrypted challenge using the retrieved secret key.

12. The system of claim 8, wherein receiving from the user device the identifier includes a network interface of the server receiving the identifier from the user device over a network.

13. The system of claim 8, wherein the server being configured to authorize the user device to electronically access the secured function includes the server being configured to transmit a password to the user device after the receiving, the authenticating, and the determining.

14. The system of claim 8, wherein the server is configured to deny the user device electronic access to the secured function of the select one of the plurality of fuel dispensers in response to any one or more of the server not receiving from the user device the identifier uniquely identifying the select one of the fuel dispensers, not authenticating the user of the user device as being among one or more users predetermined to have authorized access to the server, and not determining that the user of the user device has been pre-authorized to access the secured function.

15. The system of claim 8, further comprising the plurality of fuel dispensers, each of the fuel dispensers storing in a memory thereof the predetermined identifier uniquely identifying the fuel dispenser.

16. A fuel dispenser security method, comprising:

receiving over a network a request from a user device to access a function of a fuel dispenser;

generating data that includes a session password and a function code corresponding to the requested function;

encrypting the generated data using a secret key stored at the fuel dispenser;

transmitting the encrypted data to the user device;

prompting the user device for the session password;

receive from the user device a password in response to the prompting; and

allowing the user device to electronically access the requested function in response to the received password matching the session password, and denying the user device electronic access to the requested function in response to the received password not matching the session password.

17. The method of claim 16, wherein the function includes at least one of verifying a calibration procedure of the fuel dispenser, installing software on the fuel dispenser, authenticating the fuel dispenser, and accessing a log of activity of the fuel dispenser.

18. The method of claim 16, further comprising transmitting to the user device a unique identifier that identifies the fuel dispenser.

19. The method of claim 18, wherein the unique identifier is publically available, and the secret key is not publically available.

20. The method of claim 16, wherein allowing the user device to electronically access the requested function in response to the received password matching the session password only allows the user device to electronically access the requested function and not any other functions of the fuel dispenser.