System for structured encryption of payment card track data

• US 9,811,831 B2
• Filed: 02/21/2014
• Issued: 11/07/2017
• Est. Priority Date: 04/05/2010
• Status: Active Grant

• Current Assignee: Micro Focus LLC (Open Text Corporation)
• Original Assignee: entIT Software LLC (Open Text Corporation)
• Inventors: Spies, Terence, Pauker, Matthew J., Green, Jacob, Leong, Michael S., Minner, Richard T.
• Primary Examiner(s): Yu, Ariel
• Application Number:
  US14/186,410
• Publication Number:
  US 20140172597A1
• Time in Patent Office: 1,355 Days
• Field of Search: None
• CPC Class Codes: G06Q 20/20 Point-of-sale [POS] network systems
• CPC Class Codes: G06Q 20/3823 combining multiple encryption tools for a transaction
• CPC Class Codes: G06Q 20/409 Device specific authentication in transaction processing
• CPC Class Codes: G07F 7/1016 Devices or methods for securing the PIN and other transaction-data, e.g. by encryption arrangements for secret communication, see H04L9/00
• CPC Class Codes: G07F 7/1091 Use of an encrypted form of the PIN

Abstract

A system may include a point-of-sale system that gathers payment card track data from a payment card and a payment card gateway that processes the track data to authorize purchase transactions. The point-of-sale system may remove sensitive data such as a portion of a primary account number from the track data and may compress the removed data. The compressed version of the data may be appended to a discretionary field in the track data. The discretionary field may be encrypted following insertion of the compressed data. Track data that has been modified in this way may be conveyed to the payment gateway for processing.

Claims

1. A method for securing data conveyed over a communications network between a point-of-sale system that receives track data from payment cards and a payment gateway that performs payment card authorization operations, comprising:

with processing circuitry at the point-of-sale system, obtaining track data from a payment card;

with the processing circuitry at the point-of-sale system, removing selected primary account number digits from a primary account number in the track data;

with the processing circuitry at the point-of sale system, compressing the removed primary account number digits to form compressed primary account number data;

with the processing circuitry at the point-of sale system, inserting the compressed primary account number data into a field of the track data to create a modified track data portion; and

inserting information into the primary account number digits in the track data that represents how many of the selected primary account number digits were removed.

2. The method defined in claim 1 further comprising:

following insertion of the compressed primary account number data into the track data field to create the modified track data portion, encrypting the modified track data portion.

3. The method defined in claim 2 further comprising:

transmitting the track data with the encrypted modified track data portion to the payment gateway from the point-of-sale system through at least one interposed system; and

with processing circuitry at the payment gateway, receiving the track data with the encrypted modified track data portion from the interposed system and decrypting the encrypted modified track data portion.

4. The method defined in claim 3 further comprising:

with processing circuitry at the payment gateway, extracting the compressed primary account number data from the modified track data portion following decryption of the encrypted modified track data portion.

5. The method defined in claim 1, wherein the primary account number has four trailing digits and wherein removing the selected primary account number digits comprises removing digits from the primary account number other than the four trailing digits.

6. The method defined in claim 5, wherein the primary account number has six leading digits and wherein removing the selected primary account number digits comprises removing all digits from the primary account number between the six leading digits and the four trailing digits.

7. The method defined in claim 1 further comprising:

inserting a checksum adjustment value into the primary account number digits.

8. The method defined in claim 7 wherein inserting the information into the primary account number digits comprises inserting at least a first digit and wherein inserting the checksum adjustment value into the primary account number digits comprises inserting a second digit.

9. The method defined in claim 8 wherein the first and second digits are inserted adjacent to one another within the primary account number digits and wherein the checksum adjustment value is selected by the processing circuitry to make a checksum of the primary account number digits that includes the first and second digits valid.

10. The method defined in claim 8 wherein the first and second digits are inserted adjacent to one another within the primary account number digits, and wherein the checksum adjustment value comprises an offset checksum value that is selected by the processing circuitry to make a checksum of the primary account number digits including the first and second digits invalid and offset by a predetermined amount from a valid checksum value for the primary account number digits.

11. The method defined in claim 1, wherein the field of the track data comprises a discretionary field in the track data.

12. A method for securing data conveyed over a communications network between a point-of-sale system that receives track data from payment cards and a payment gateway that performs payment card authorization operations, wherein the track data includes personal account number data, the method comprising:

with processing circuitry at the point-of-sale system, compressing selected track data to produce compressed track data, wherein the selected track data has a first length wherein the compressed track data has a second length that is shorter than the first length, and wherein compressing the selected track data comprises removing a number of digits from the track data;

with the processing circuitry, inserting the compressed track data into a given field of the track data,

with the processing circuitry, determining the number of digits that was removed from the track data; and

with the processing circuitry, inserting information into the track data that represents the number of digits that was removed from the track data.

13. The method defined in claim 12 wherein the selected track data comprises part of the primary account number and wherein compressing the selected track data comprises encoding the part of the primary account number using a character space that includes at least some non-digit characters.

14. The method defined in claim 12, wherein the selected track data is represented in a first character space, wherein compressing the selected track data to produce the compressed track data comprises:

encoding the selected track data into an expanded character space that is larger than the first character space to produce the compressed track data.

15. The method defined in claim 14, wherein encoding the selected track data into the expanded character space comprises:

encrypting the selected track data into the expanded character space.

16. The method defined in claim 12 further comprising:

with the processing circuitry at the point-of-sale system, encrypting the given field using format preserving encryption.

17. The method defined in claim 12 further comprising:

encrypting the selected field of payment card track data after the compressed part of the payment card track data has been inserted into the selected field of payment card track data.

18. A method for processing payment card track data, comprising:

losslessly compressing a part of the payment card track data at a location in the payment card track data so that the payment card track data shrinks from a first length to a second length that is shorter than the first length;

inserting the compressed part of the payment card track data into a selected field of the payment card track data; and

inserting information at the location in the payment card track data to increase the payment card track data to a third length greater than the second length, wherein the information identifies a length of the compressed part of the payment card track data.

19. The method defined in claim 18 further comprising:

removing the part of the payment card track data from a primary account number portion of the payment card track data; and

transmitting the payment card track data from which the part of the payment card track data has been removed and in which the selected field has been encrypted through a network.