System and method to protect privacy of personal-identification-number entry on consumer mobile device and computing apparatus

Abstract

A system for accepting the input of a PIN comprises a first device receiving a randomized PIN layout derived on a fourth device. The randomized PIN layout is displayed on a display of the first device. A second device comprises an input for accepting a series of key presses to produce a PIN token. The PIN token indicating each of the series of key presses. A third device is in communication with the second device. The third device derives the randomized PIN layout and receives the PIN token from the second device without the PIN token being present on the first device. The third device combines the PIN layout and the PIN token to produce a PIN. The PIN is used to authenticate a transaction. The fourth and third devices each store a shared secret used to independently derive the randomized PIN layout on the fourth and third devices.

Claims

1. A system comprising: a plurality of devices to enable a user to enter a personal identification number (PIN) to authenticate a transaction, the plurality of devices comprises a first device, a second device, and a third device, wherein the first device is communicatively coupled to the third device, and the second device communicatively coupled to the third device; the first device determines a randomized PIN layout, and displays the randomized PIN layout on a first display of the first device; the second device accepts a series of key presses from the user to produce a PIN token comprising data indicative of each of the series of key presses; and the third device determines the randomized PIN layout, receives the PIN token from the second device without transmission of the PIN token to the first device, and produces the PIN based on the randomized PIN layout determined by the third device and the PIN token.

2. The system of claim 1, wherein the first device and the third device store a shared secret, and the system further comprises: the first device determines the randomized PIN layout based on the shared secret; the third device determines the randomized PIN layout based on the shared secret; and wherein the randomized PIN layout is not transmitted between the first device and the third device.

3. The system of claim 1, wherein the system further comprises: the first device and the third device each determine a new randomized PIN layout: for each new transaction or after each keypress of the user at the second device.

4. The system of claim 3, wherein the new randomized PIN layout is a PIN layout selected from a set of predefined PIN layouts.

5. The system of 3, wherein the new randomized PIN layout is a pseudo-random PIN layout generated using a shared secret as a seed for the generation of the pseudorandom PIN layout.

6. The system of claim 1, further comprising: the third device determines the randomized PIN layout by generating the randomized PIN layout at the third device, and transmitting the randomized PIN layout to the first device; and the first device determines the randomized PIN layout by receiving the randomized PIN layout generated by the third device.

7. The system of claim 6, further comprising: the third device encrypts the randomized PIN layout prior to transmission of an encrypted version of the randomized PIN layout to the first device, and the first device decrypts the encrypted version of the randomized PIN layout received from the third device.

8. The system of claim 1, wherein the system further comprises: the first device determines the randomized PIN layout by generating the randomized PIN layout at the first device; and the third device determines the randomized PIN layout by receiving the randomized PIN layout generated by the first device.

9. The system of claim 8, wherein the system further comprises: the first device encrypts the randomized PIN layout prior to transmission of an encrypted version of the randomized PIN layout to the third device; and the third device decrypts the encrypted version of the randomized PIN layout received from the first device.

10. The system of claim 1, wherein the first device and the second device are coupled via a local wired or wireless communications link, and wherein the third device is remote to the first device and the second device.

11. The system of claim 1, wherein the system further comprises: the second device encrypts the PIN token, and sends an encrypted version of the PIN token to the third device; and the third device receives the encrypted version of the PIN token, and decrypts the encrypted version of the PIN token to obtain an unencrypted version of the PIN token.

12. The system of claim 1, wherein the second device produces the PIN token based on positions of a PIN layout corresponding to the series of key presses.

13. The system of claim 1, wherein the transaction is authenticated based at least in part on the PIN produced by the third device.

14. A method for authenticating a transaction using a plurality of devices comprising a first device, a second device, and a third device, the method comprising: determining, by the first device, a randomized PIN layout; displaying the randomized PIN layout on a first display of the first device to enable a user to enter a series of key presses at the second device; receiving, at an input of the second device, the series of key presses from the user; generating, by the second device, a PIN token based on the received series of key of presses, the PIN token indicating each of the series of key presses; transmitting, by the second device to the third device, the PIN token; receiving, by the third device, the PIN token from the second device without the PIN token being present on the first device; determining, by the third device, the randomized PIN layout; and producing, by the third device, the PIN based on the randomized PIN layout determined by the third device and the PIN token.

15. The method of claim 14, wherein the first device and the third device store a shared secret, and the method further comprises: determining, by the first device, the randomized PIN layout based on the shared secret; determining, by the third device, the randomized PIN layout based on the shared secret; and wherein the randomized PIN layout is not transmitted between the first device and the third device.

16. The method of claim 14, wherein the method further comprises: determining, by each of the first device and the third device, a new randomized PIN layout: for each new transaction or after each keypress of the user at the second device.

17. The method of claim 14, further comprising: determining, by the third device, the randomized PIN layout by generating the randomized PIN layout at the third device, and transmitting the randomized PIN layout to the first device; and determining, by the first device, the randomized PIN layout by receiving the randomized PIN layout generated by the third device.

18. The method of claim 17, further comprising: encrypting, by the third device, the randomized PIN layout prior to transmission of an encrypted version of the randomized PIN layout to the first device; decrypting, by the first device, the encrypted version of the randomized PIN layout received from the third device.

19. The method of claim 14, further comprising: determining, by the first device, the randomized PIN layout by generating the randomized PIN layout at the first device; and determining, by the third device, the randomized PIN layout by receiving the randomized PIN layout generated by the first device.

20. The method of claim 14, wherein the second device produces the PIN token based on positions of a PIN layout corresponding to the series of key presses.

Description

BRIEF DESCRIPTION OF THE DRAWINGS

(1) The foregoing and other advantages of the disclosure will become apparent upon reading the following detailed description and upon reference to the drawings.

(2) FIG. 1 shows a randomized PIN layout display on a first device and another keypad without the digits shown on a second device.

(3) FIG. 2 illustrates the sequence of positions pressed on the second device grid to enter the PIN sequence “1243” using the randomized PIN keypad in the first device.

(4) FIG. 3 illustrates the entry of a PIN in a system with a first, second, and third device where the first and third device have a shared secret.

(5) FIG. 4 illustrates the entry of a PIN in a system with a first, second, third and fourth device where the third and fourth device have a shared secret.

(6) FIG. 5 illustrates the entry of a PIN in a system with a first, second, third and fourth device where the fourth device generates the PIN pad layout for the first and third devices.

(7) FIG. 6 illustrates the entry of a PIN in a system with a first, second, and third device where the third device generates the PIN pad layout for the first device.

(8) FIG. 7 illustrates the entry of a PIN in a system with a first, second, and third device where the first device generates the PIN pad layout for the third device.

(9) FIG. 8 illustrates the process where the system is initialized.

(10) FIG. 9 illustrates the process where the system is used to process a payment transaction.

(11) While the present disclosure is susceptible to various modifications and alternative forms, specific embodiments or implementations have been shown by way of example in the drawings and will be described in detail herein. It should be understood, however, that the disclosure is not intended to be limited to the particular forms disclosed. Rather, the disclosure is to cover all modifications, equivalents, and alternatives falling within the spirit and scope of an invention as defined by the appended claims.

DETAILED DESCRIPTION

(12) In an exemplary embodiment of the invention comprises a system and a method to display a randomized PIN layout on a first device and accepts input, the PIN token, from the card holder or account holder on a second device in a way that the PIN layout and PIN token never exist on the same device. Embodiments of the invention may be used by a merchant authenticating their card reader device with a financial service provider or by a customer to approve a financial transaction.

(13) FIG. 1 illustrates the use of a separate PIN layout and a PIN token. A first device 100 contains a display 101 that displays a PIN layout 102. The first device may be a dedicated device for displaying PIN layout, or a card reader which can display the PIN layout, or any devices including mobile device with suitable methods such as a special application to display the PIN layout. The first device may belong to the merchant or the account holder. The second device 200 may be a smart phone or mobile device belonging to the merchant or the account holder.

(14) In some embodiments of the invention, the first device 100 and the second device 200 may be coupled together by a wired or wireless connection and communicate with each other over the connection in order to synchronize states between devices. For example, if the PIN keypad layout changed for every key press, then the first device and the second device must be synchronized to ensure the PIN keypad is fixed for each input. In other embodiments of the invention, the first device and second device are not required to communicate directly with each other. The first device 100 displays a PIN layout 101 on a screen as a traditional numeric entry keypad. The placement of the digits 0-9 102 may be fixed but are preferably randomly generated for each transaction or after each key press. The first device 100 may also have a number of predefined layouts with one chosen for each transaction. The first device may also generate pseudo-random layouts based on a secret value, or receive a layout from another device in the system. The second device 200 displays a grid 201 of blank keys 202, and may also display other non-numeric characters in order to control the PIN input such as an OK and Cancel button 203. In use, the user observes the PIN layout 102 of the first device in able to know which squares 202 on the second device to press to enter their PIN. The first device 100 displays the PIN layout and the second device 200 accepts the PIN token. The user may press the OK button when the PIN input is complete or press the Cancel button to abort the PIN input as is conventionally done. In embodiments of the invention, the PIN layout and the PIN token never exist on the same device. This separation adds another layer of security to the PIN input process and helps reduce the complexity of the design of both the application on the mobile second device 200 and the peripheral first device 100.

(15) FIG. 2 illustrates the step by step process of entering a PIN token on the second device 200 based on the PIN layout displayed on the first device 100. In this example, the PIN 1234 is entered. In this example, the PIN layout 102 does not shuffle after each key press. However, in other examples PIN layout 102 randomizes the position of the displayed digits after every key press. It can be seen that the PIN token input on the second device 200 represents a position, key, or virtual key. For each number, character, or symbol in the PIN, it indicates which key was pressed. The PIN layout as displayed on the first device 100 represents the value of each position, key, or virtual key at that point in time. By combining the PIN layout and PIN token the PIN can be determined.

(16) FIG. 3 illustrated a first embodiment of the invention for securely receiving a PIN input. The system comprises a first device 100 for generating and displaying the PIN layout, a second device 200 for capturing the PIN token 302 from a user, and a third device 300 for receiving the PIN token and reconstructing the PIN 303 required to authenticate the transaction.

(17) The first device 100 may be associated with a merchant, bank, or financial institution or the card holder, and may be card reader, cash register, self-checkout counter, or mobile device such as a smart phone, or a dedicated device for such purpose. If the first device is a smart phone device it will run a payment application that may be supplied by the smart phone manufacturer, a financial institution, a financial card company, or another third party. The first device may also have dedicated hardware or software to support encryption and decryption of sensitive data such as PIN layout mapping 101. The first device may also have a dongle or card reading interface that allows it to read secure or non-secure data from a card. The first device generates a PIN layout that may be randomized or may include a finite number of layouts that it chooses from. A new PIN layout 101 is commonly generated for each new transaction. The first device has a display on which it displays the PIN layout for the transaction. The first device may include wired or wireless communication interfaces in order to communicate with the second or a third device 300. The first device stores a shared secret 301 that is also stored by the third device. It uses this shared secret as a seed to generate the PIN layout 101. The shared secret need not be shared during transactions. It can be defined during initial setup of the devices, or be exchanged periodically. It may be manually input and may also be loaded or hard coded into devices during manufacture.

(18) The second device 200 may also associated with a merchant, bank, or financial institution involved with a financial transaction. It is commonly a mobile or handheld electronic device such as a smartphone or tablet with an LCD display that accepts touch input, or a point of sale (POS) terminal, or computer system with a display and a hardware to accepts the PIN input. The second device runs a payment application that may be supplied by the smartphone manufacturer, a financial institution, a financial card company, or another third party. The second device may also have dedicated hardware or software to support encryption and decryption of sensitive data such as PIN Token 302. The second device may also have a dongle that allows it to read data from a card. The second device displays a keypad 201 that the user may input their PIN number on. The keypad 201 may be blank, have unmarked rectangles, contain an image, contain a false keypad, or any other display that allows the user to press buttons 202 or areas on the screen. The user refers to the PIN display 101 on the first device to determine where to press the keys, buttons, or screen 201 of the second device to input their PIN. The key presses are used to generate the PIN token 302 which indicates which keys or which areas of the screen 201 were pressed. The second device also includes wired or wireless communication interfaces in order to communicate with the third device. The second device sends the PIN Token, in either plaintext or cryptographically protected form, to the third device 300 without passing through the first device 100. As well, the randomized PIN layout 101 never exists in second device 200 and is never transferred to or through the second device, in any form, plaintext or encrypted. Therefore, the randomized PIN layout 101 and the PIN token 302 only exist in two separate devices, without being present in the other device. Compromising either one of the device does not compromise the privacy of the PIN.

(19) The third device 300 is a secure device or a device in a secure location, for example, a backend server that is located in a secure location or off site. The third device 300 may be a dedicated device or a computer server running a payment application that may be supplied by the smartphone manufacturer, a financial institution, a financial card company, or another third party. The third device 300 stores the same shared secret 301 as the first device 100 and uses it as a seed to generate the same PIN layout 101 as the first device. In this way, the PIN layout 101 is never transmitted between devices. The third device receives the PIN token 302 from the second device 200 and combines it with the PIN layout 101, that it generates using the shared secret 301, to obtain the PIN 303. The PIN is obtained by using the PIN token to determine which key was pressed based on the position, key, or virtual key encoded in the PIN token. This is matched to the PIN layout to determine the value for the key. This is repeated for each digit or character in the PIN 303. The PIN 303 may then be encrypted. The PIN or the encrypted PIN is then used to authenticate the transaction.

(20) In some embodiments of the invention, the first device 100 may be the cardholder's device and the second device 200 may be the merchant's smart phone, terminal, or device. In this case the PIN layout 101 is displayed on the cardholder's device 100 and the PIN token 302 is input to the merchant's device 200. In other embodiments of the invention, the first device 100 may be the merchant's device and the second device 200 may be the card holder or account holder's device. In further embodiments of the invention, both the first device 100 and the second device 200 are the card holder's devices. In other embodiments of the invention both the first device 100 and the second device 200 are owned by the merchant. These embodiments replace present day payment systems where the PIN will exist or be stored within a terminal that combines functionality of both the first and second devices.

(21) In embodiments of the invention, the first device 100 that displays the PIN layout, and the second device 200 where the PIN is input must be in proximity to each other so that the person inputting the PIN may manipulate the second device while viewing the first device. There are no restrictions on the location of the third device 300 and a fourth device 400. Either or both of them may be located in the same location as the first and second device, in a separate room, or in a remote location.

(22) FIG. 4 illustrated a second embodiment of the invention for securely receiving a PIN input. In this embodiment, the first device 100 has a simplified function to display the PIN layout 101 that it received over a communications interface from a fourth device 400. The randomized PIN layout 101 is generated on by the fourth device 400 using the shared secret 301 that it has in common with the third device 300. This allows the third and fourth devices to generate or derive the same pseudo-random keypad layout 101 without transmitting the PIN layout between them. The second device is the same as the one mentioned in the first embodiment. As before, the PIN token from the second device never passes through the first device, in plaintext or encrypted form.

(23) FIG. 5 illustrated a third embodiment the invention for securely receiving a PIN input. This embodiment is similar to the second embodiment as shown in FIG. 4 however, there is no shared secret 301 associated with generating the PIN layout 101 shared between the third device 300 and the fourth device 400. Instead the fourth device is responsible for the generation of the randomized PIN layout 101 and generates it on its own. It then transmits the PIN layout to the third device 300 over a wired or wireless communications interface. The PIN layout may be encrypted before transmission by the fourth device. The third device receives the encrypted PIN pad layout from the fourth device and decrypts it. It also receives the PIN token 302 from the second device and uses them to construct the PIN 303.

(24) FIG. 6 illustrated a fourth embodiment of the invention for securely receiving a PIN input. This embodiment is a variation on the first embodiment as shown in FIG. 3. In this embodiment, the first device 100 and third device 300 do not have a shared secret. Instead, the third device is responsible for the generation of the randomized PIN layout 101 and generates it independently. It then transmits the PIN layout to the first device 100 over a wired or wireless communications interface. The PIN layout may be encrypted before transmission by the third device 300. The first device receives the encrypted PIN pad layout 101 from the third device and decrypts it.

(25) FIG. 7 illustrated a fifth embodiment of the invention for securely receiving a PIN input. This embodiment is another variation on the first embodiment as shown in FIG. 3. In this embodiment, the first device 100 and third device 300 do not have a shared secret. Instead, the first device is responsible for the generation of the randomized PIN layout 101 and generates it independently. It then transmits the PIN layout to the third device 100 over a wired or wireless communications interface. The PIN layout may be encrypted before transmission by the first device 300. The third device receives the encrypted PIN pad layout 101 from the first device and decrypts it.

(26) There are many variations possible for embodiments of the invention which are not being listed exhaustively. However, in embodiments of the invention, the PIN layout 101 is not displayed on the device on which the PIN token 302 is input. Furthermore, the PIN layout 101 and the PIN token 302 are never present together on either the first 100 or the second device 200, which are generally the devices used at the location where the transaction happens. Both the PIN layout 101 and the PIN token 302 are only present on the third device 300 which is a remote or secure server or device. In this way, compromising the device displaying the PIN layout or the PIN token alone will not allow an intruder to determine the PIN 303 for the smart card, or mobile device of the card holder or account holder.

(27) FIG. 8 illustrates an exemplary process of initializing a system according to an embodiment of the invention. To initialize the system 700, devices must have any proprietary software installed, user accounts set up, configuration done, and to be authenticated with a payment processor, financial institution, corporate server, or any other authoritative or security device. For embodiments that require a shared secret 702, either a secret to derive the PIN layout, or a secret for encryption and decryption of other data, this must be configured. The merchant will then authenticate 703 their card reader device with a payment processor, financial institution, or a corporate server as required to ensure that the device is not compromised and being used in a non-fraudulent manner. The merchant may use embodiments of this invention to enter a PIN on their device to generate a separate PIN layout 702 and PIN token 704 on separate devices. The PIN is generated on the third device 707 and used to enable the card reader or point of sale terminal to allow it to process financial transactions 708.

(28) In FIG. 9 a transaction is initiated 800 when a customer chooses a set of products or services and wished to pay for it. The merchant will calculate the price of the products and enters the amount 801 in a cash register or similar device. The customer indicates that they would like to pay using electronic payment methods such as bank cards or mobile wallets. The merchant then initiates the generation of the PIN layout on the first device. The first device uses the shared secret to generate and display the PIN layout on its display 802. The PIN layout will be randomized for each transaction. The customer's physical card, virtual card or wallets will then be swiped, tapped or inserted 803, and then the PIN input process will be initiated on the second device. This will cause a blank keypad to be displayed on the second device together with control keys such as OK, Cancel, and backspace. The customer will then observe the display on the first device to know the values of the blank keys of the keypad on the second device and enter the PIN by pressing the correct blank keys on the second device 804. The second device will take the positions of the pressed keys to produce the PIN token 805. Once the PIN has been input the second device will transmit the PIN token to the third device, optionally encrypting it before transmission. The third device with is a dedicated hardware appliance or a server in a secure or off site location receives the PIN token and decrypts it if necessary. The third device also uses the shared secret to generate a local copy of the PIN layout 806. It then combines the local PIN layout with the PIN token to produce the PIN 807. The PIN token supplies the location of the presses to indicate which keys were pressed. The PIN layout is used to determine the values of the PIN. The PIN is then used to authenticate the transaction 808.

(29) While particular implementations and applications of the present disclosure have been illustrated and described, it is to be understood that the present disclosure is not limited to the specific examples of electronic payments and point of sale terminal authentication. Many other applications involving the secure input of a PIN, or other input involving positional information, the token, and layouts involving numbers, characters, symbols, pictures or other similar indicators may benefit from the improved security embodiments of this invention provide.