Method and system for securing data from a non-point of sale device over an external network

• US 8,966,610 B2
• Filed: 11/05/2008
• Issued: 02/24/2015
• Est. Priority Date: 11/05/2008
• Status: Active Grant

• Current Assignee: Apriva, LLC (APPSware Holdings, Inc.)
• Original Assignee: Apriva, LLC (APPSware Holdings, Inc.)
• Inventors: Coppinger, Paul D.
• Primary Examiner(s): Eskandarnia, Arvin
• Assistant Examiner(s): DESAI, MARGISHI V
• Application Number:
  US12/265,550
• Publication Number:
  US 20100115603A1
• Time in Patent Office: 2,302 Days
• Field of Search: 705/67, 705/17, 726/14
• US Class Current: 726/14
• CPC Class Codes: G06Q 20/20 Point-of-sale [POS] network systems
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: G06Q 30/0238 at point-of-sale [POS]
• CPC Class Codes: H04L 12/2859 Point-to-point connection between the data network and the subscribers encapsulation H04L12/4633; virtual LANs H04L12/4641; routing of packets H04L45/00
• CPC Class Codes: H04L 2463/102 applying security measure for e-commerce data processing systems or methods, specially adapted for e-commerce G06Q30/00
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/0272 Virtual private networks

Abstract

A data control system prevents non-point of sale devices (135, 155) from sending data over an external network (160) via a secure connection reserved for point of sale devices (125, 145), but allows non-point of sale devices (135, 155) to send data over the external network (160) other than via the secure connection. The secure connection is, for example, a virtual private network connection. The data control system may allow the data from non-point of sale devices (135, 155) to be sent only if it is not destined for a restricted destination. The restricted destination may be, for example, a payment host (170) or secure host (180) on the external network (160).

Claims

1. A method, performed by a data control system, for securing data on a local area network in communication with an external network, the local area network having one or more point of sale hardware devices and one or more non-point of sale hardware devices, the method comprising the steps of:

(a) determining whether data destined for the external network is from a point of sale hardware device or from a non-point of sale hardware device;

(b) allowing data from a point of sale hardware device to be sent to the external network via a secure connection; and

(c) allowing data from a non-point of sale hardware device to be sent to the external network other than via the secure connection.

2. The method of claim 1 wherein the secure connection is a virtual private network connection.

3. The method of claim 1 wherein step (a) comprises determining whether the data is from a point of sale network.

4. The method of claim 1 wherein step (a) comprises determining whether the data is from a non-point of sale network.

5. The method of claim 1 wherein step (c) comprises allowing the data from the non-point of sale network to be sent to the external network unless the data is destined for a restricted destination.

6. A method, performed by a data control system, for securing data on a local area network in communication with an external network, the local area network having one or more point of sale hardware devices and one or more non-point of sale hardware devices, the method comprising the steps of:

(a) determining the data is from a non-point of sale hardware device on the local area network;

(b) allowing the data from the non-point of sale hardware device to be sent to the external network other than via a secure connection reserved for point of sale hardware devices; and

(c) preventing the data from the non-point of sale hardware device from being sent to the external network via the secure connection.

7. The method of claim 6 wherein the secure connection is a virtual private network connection.

8. The method of claim 6 wherein step (b) comprises allowing the data from the non-point of sale network to be sent to the external network unless the data is destined for a restricted destination.

9. The method of claim 8 wherein the restricted destination is a secure host.

10. The method of claim 8 wherein the restricted destination is a payment host.

11. A data control system for securing data on a local area network in communication with an external network, the local area network having one or more point of sale hardware devices and one or more non-point of sale hardware devices, the data control system comprising:

a router configured for determining whether data destined for the external network is from a point of sale hardware device or from a non-point of sale hardware device;

the router further configured for allowing data from a point of sale hardware device to be sent to the external network via a secure connection; and

the router further configured for allowing data from a non-point of sale hardware device to be sent to the external network other than via the secure connection.

12. The data control system of claim 11 wherein the secure connection is a virtual private network connection.

13. The data control system of claim 11 wherein the router for determining whether data destined for the external network is from a point of sale hardware device or from a non-point of sale hardware device is further configured for determining whether the data is from a point of sale network.

14. The data control system of claim 11 wherein the router for determining whether data destined for the external network is from a point of sale hardware device or from a non-point of sale hardware device is further configured for determining whether the data is from a non-point of sale network.

15. The data control system of claim 11 wherein the router for allowing data from the non-point of sale device to be sent to the external network is further configured for allowing the data from the non-point of sale network to be sent to the external network unless the data is destined for a restricted destination.

16. A data control system for securing data on a local area network in communication with an external network, the local area network having one or more point of sale hardware devices and one or more non-point of sale hardware devices, the data control system comprising:

a router configured for determining the data is from a non-point of sale hardware device on the local area network;

wherein the router is further configured for allowing the data from the non-point of sale hardware device to be sent to the external network other than via a secure connection reserved for point of sale hardware devices; and

wherein the router is further configured for preventing the data from the non-point of sale hardware device from being sent to the external network via the secure connection.

17. The data control system of claim 16 wherein the secure connection is a virtual private network connection.

18. The data control system of claim 16 wherein the router for allowing the data from the non-point of sale hardware device to be sent to the external network is further configured for allowing the data from the non-point of sale network to be sent to the external network unless the data is destined for a restricted destination.

19. The data control system of claim 18 wherein the restricted destination is a secure host.

20. The data control system of claim 18 wherein the restricted destination is a payment host.