Scrambling passcode entry interface

• US 9,558,491 B2
• Filed: 09/30/2013
• Issued: 01/31/2017
• Est. Priority Date: 09/30/2013
• Status: Active Grant

• Current Assignee: Block, Inc. (f/k/a Square, Inc.)
• Original Assignee: Block, Inc. (f/k/a Square, Inc.)
• Inventors: Edwards, Troy J.
• Primary Examiner(s): Subramanian, Narayanswamy
• Assistant Examiner(s): Bridges, Christopher
• Application Number:
  US14/041,863
• Publication Number:
  US 20150095241A1
• Time in Patent Office: 1,219 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/36 by graphic or iconic representation
• CPC Class Codes: G06F 2221/031 Protect user input by software means
• CPC Class Codes: G06Q 20/3226 Use of secure elements separate from M-devices
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: G06Q 20/4012 Verifying personal identification numbers [PIN]
• CPC Class Codes: G07F 7/10 together with a coded signal , e.g. in the form of personal identification information, like personal identification number [PIN] or biometric data
• CPC Class Codes: G07F 7/1033 Details of the PIN pad

Abstract

A method of secured passcode entry is disclosed. The method, in one embodiment, includes: receiving a request to authenticate a user; in response to receiving the request, generating a passcode entry interface that includes a plurality of buttons for the user to compose a passcode entry, each button representing a character of a set of characters, the set of characters having a natural sequence, wherein said generating includes displaying the buttons on a touchscreen of the electronic device in an arrangement that does not reflect the natural sequence of the set of characters; detecting a touch event, represented as a coordinate on the touchscreen, interacting with the touchscreen while the passcode entry interface is displayed, wherein the touch event is indicative of at least a portion of a passcode entry by the user; and verifying an authenticity of the passcode entry based at least partly on the touch event.

Claims

1. A method of operating a mobile device, the method comprising:

detecting a swipe of a payment card on a card reader coupled to the mobile device;

in response to detecting the swipe, initializing a financial transaction between a consumer and a merchant by;

generating a personal identification number (PIN) entry interface that includes a plurality of buttons for the consumer to compose a PIN entry, the plurality of buttons representing single numeric digits, wherein said generating includes displaying the buttons on a touchscreen of the mobile device in an arrangement that does not reflect a natural sequence of the numeric digits;

storing the arrangement of the buttons in the PIN entry interface in an interface configuration file;

transmitting the interface configuration file to an external server system;

detecting a sequence of touch events representing interactions by the consumer with the touchscreen while the PIN entry interface is displayed, wherein the sequence of touch events is indicative of a PIN entry corresponding to the payment card; and

transmitting the sequence of touch events to the external server system to authenticate the consumer; and

in response to receiving a message from the external server system authenticating the consumer, processing the financial transaction.

2. The method of claim 1, wherein the natural sequence of the numeric digits includes a count from “

0”

incrementally to “

9”

or a count from “

1”

incrementally to “

9” and

ending in “

0”

.

3. The method of claim 1, wherein the touch events are X and Y coordinates, each indicating where on the touch screen a touch has been detected.

4. The method of claim 1, wherein generating the PIN entry interface includes randomly arranging the buttons of the PIN entry interface.

5. A method of operating a server system, the method comprising:

receiving an interface configuration file from the electronic device;

determining a geometric arrangement of a plurality of buttons of a passcode entry interface for displaying on an electronic device, wherein the passcode entry interface includes the plurality of buttons for a user to compose a passcode entry, each button representing a character of a set of characters, the set of characters having a natural sequence, wherein the geometric arrangement of the plurality of buttons does not reflect the natural sequence of the set of characters, and wherein determining the geometric arrangement includes interpreting the interface configuration file to determine the geometric arrangement of the plurality of buttons;

receiving a sequence of touch events, represented as coordinates on the touchscreen, from the electronic device, wherein the sequence of touch events represents interactions by the user with the touchscreen, the sequence of touch events indicative of a passcode entry corresponding to a payment card;

composing the passcode entry by matching the sequence of touch events with the geometric arrangement; and

authenticating the passcode entry.

6. The method of claim 5, further comprising receiving a card identifier of the payment card from the electronic device;

wherein authenticating the passcode entry includes requesting an authentication from a financial system by transmitting the passcode entry and the card identifier to the financial system.

7. The method of claim 5, wherein authenticating the passcode entry includes transmitting the passcode entry to the electronic device to cause the electronic device to verify the passcode entry with the payment card through a card reader coupled to the electronic device.

8. The method of claim 5, further comprising:

randomizing the geometric arrangement for a user session of the electronic device; and

storing the randomized geometric arrangement;

wherein determining the geometric arrangement includes accessing the stored randomized geometric arrangement.

9. A method of operating an electronic device, the method comprising:

receiving a request to authenticate a user;

in response to receiving the request, generating a passcode entry interface that includes a plurality of buttons for the user to compose a passcode entry, each button representing a character of a set of characters, the set of characters having a natural sequence, wherein said generating includes displaying the buttons on a touchscreen of the electronic device in an arrangement that does not reflect the natural sequence of the set of characters;

storing the arrangement of the buttons in the PIN entry interface in an interface configuration file;

transmitting the interface configuration file to an external server system;

detecting a touch event, represented as a coordinate on the touchscreen, interacting with the touchscreen while the passcode entry interface is displayed, wherein the touch event is indicative of at least a portion of a passcode entry by the user; and

verifying an authenticity of the passcode entry based at least partly on the touch event.

10. The method of claim 9, wherein generating the passcode entry interface includes randomly arranging the buttons of the passcode entry interface.

11. The method of claim 9, wherein said displaying includes positioning the passcode entry interface toward a corner of the touchscreen.

12. The method of claim 9, further comprising detecting a fingerprint traffic area on the touchscreen;

wherein said displaying includes positioning the buttons based on the detected fingerprint traffic area on the touchscreen.

13. The method of claim 9, further comprising in response to detecting the touch event, rearranging the buttons on the passcode entry interface.

14. The method of claim 13, wherein an outline shape of the passcode entry interface remains constant during the rearranging.

15. The method of claim 13, wherein rearranging the buttons includes rearranging the buttons without changing relative positions between pairs of the buttons.

16. The method of claim 9, wherein verifying the authenticity of the passcode entry includes sending the touch event to the external server system to determine the passcode entry.

17. The method of claim 9, further comprising partially concealing the buttons by visually obstructing displaying of the buttons.

18. The method of claim 17, wherein partially concealing the passcode entry interface comprises:

covering the characters on the buttons with a first line moiré

pattern; and

sliding a shape in a second line moiré

pattern over the passcode entry interface to reveal individual characters covered by the second line moiré

pattern.

19. The method of claim 17, wherein partially concealing the passcode entry interface includes varying pixel densities within said displaying of the characters on the buttons.

20. The method of claim 17, wherein partially concealing the passcode entry interface includes overlaying a concealment layer of visual obstructions over the passcode entry interface.

21. The method of claim 20, wherein the visual obstructions are line segments.

22. An electronic device comprising:

a connector to receive a request to authenticate a user;

a processor configured to generate a passcode entry interface that includes a plurality of buttons for the user to compose a passcode entry, each button representing a character of a set of characters, the set of characters having a natural sequence;

a touchscreen to display the buttons in an arrangement that does not reflect the natural sequence of the set of characters and to detect a touch event, represented as a coordinate on the touchscreen, interacting with the touchscreen while the buttons are displayed, the touch event indicative of at least a portion of a passcode entry by the user; and

wherein the processor is configured to store the arrangement of the buttons in the PIN entry interface in an interface configuration file and to transmit the interface configuration file to an external server system; and

wherein the processor is configured to verify an authenticity of the passcode entry based at least partly on the touch event.

23. The electronic device of claim 22, further comprising a network interface;

wherein the processor is configured to verify the authenticity of the passcode entry by sending the touch event through the network interface to the external server system to cause the external server system to determine the passcode entry.

24. The electronic device of claim 22, further comprising a network interface;

wherein the processor is configured to verify the authenticity of the passcode entry by sending the touch event and the arrangement of the buttons to the external server system to cause the external server system to determine the passcode entry.