System and method for selective encryption of input data during a retail transaction

Abstract

A retail environment having retail terminals with data entry point devices selectively encrypts input received by the data entry point devices and passes the encrypted data to a security module. The selective encryption is based on whether or not sensitive or confidential information, such as a personal identification number (PIN) associated with a debit card, is being input. To prevent hacking of the software of the retail terminal, content destined for display on the retail terminal is authenticated prior to display. In this manner, the retail terminal may be assured that confidential information is input only when desired, and thus may be encrypted only as needed.

Claims

1. A fuel dispenser, comprising: a user interface comprising a display and one or more data entry point devices configured to receive information from a user; and a control system that executes an application comprising content to be presented on the display, said control system configured to: determine whether content to be presented on the display of the fuel dispenser requests confidential information by evaluating the application during execution thereof; authenticate the content to be presented on the display during execution of the application but before being displayed by comparing indicia associated with the content to a secure copy of the indicia; present the content on the display if the content is authenticated; and if the content requests confidential information, encrypt data received from one or more data entry point devices for transmission to a location separate from the fuel dispenser.

2. The fuel dispenser of claim 1, further comprising at least one fuel delivery component and wherein the control system is further configured to control a delivery of fuel to the user through the at least one fuel delivery component.

3. The fuel dispenser of claim 1, wherein the control system is configured to transmit the data received from the one or more data entry point devices as unencrypted if the information requested is not confidential information.

4. The fuel dispenser of claim 1, wherein the control system is configured to determine whether the content requests a personal identification number (PIN).

5. The fuel dispenser of claim 1, wherein the indicia associated with the content comprises a digital signature.

6. The fuel dispenser of claim 1, wherein the control system is configured to disable the one or more data entry point devices when the content cannot be authenticated.

7. The fuel dispenser of claim 1, wherein the control system enables at least one of the one or more data entry point devices when the content is authenticated.

Description

BRIEF DESCRIPTION OF THE DRAWINGS

(1) The accompanying drawing figures incorporated in and forming a part of this specification illustrate several aspects of the invention, and together with the description serve to explain the principles of the invention.

(2) FIG. 1 illustrates a fuel dispenser in a fueling environment;

(3) FIG. 2 illustrates schematically the elements of the fuel dispenser and the fueling environment connected to a host computer;

(4) FIG. 3 illustrates in a flow chart the steps of passing the encryption keys to the fuel dispenser for transactional use;

(5) FIG. 4 illustrates in a flow chart the steps of a first exemplary methodology of the present invention;

(6) FIGS. 5A and 5B illustrate in a flow chart the steps of a second exemplary methodology of the present invention; and

(7) FIGS. 6 and 7 illustrate in a flow chart the steps of authenticating content provided by a manufacturer.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

(8) The embodiments set forth below represent the necessary information to enable those skilled in the art to practice the invention and illustrate the best mode of practicing the invention. Upon reading the following description in light of the accompanying drawing figures, those skilled in the art will understand the concepts of the invention and will recognize applications of these concepts not particularly addressed herein. It should be understood that these concepts and applications fall within the scope of the disclosure and the accompanying claims.

(9) The present invention is directed to providing selective encryption of data at a retail terminal. In a particularly contemplated embodiment, the retail terminal is a fuel dispenser in a fueling environment. Sensitive or confidential information, such as a credit card account number or personal identification number (PIN), is solicited from a customer at predetermined times during the course of a transaction. The customer then enters the confidential information through a data entry point device such as a keypad. The fuel dispenser's controller knows that the data entry point device is receiving confidential information, and the controller causes the confidential information to be encrypted and passed to a security module. When non-confidential information is being entered by the customer, the fuel dispenser's controller knows that the data entry point device is receiving non-confidential information, and causes the input to be processed normally without encryption.

(10) In an improved embodiment, the content of the display associated with the retail terminal is verified so that fraudulent content that solicits confidential information when the controller is expecting non-confidential data cannot be displayed. Verification of the content of the display helps insure that someone has not reprogrammed the content in an unauthorized manner. Since the content of the display is known and verified, the fuel dispenser's control system knows when confidential information is being solicited, and thus knows when to encrypt information received at the data entry point devices. Likewise, the fuel dispenser's control system knows when the information being received at the data entry point devices is not confidential and thus does not need to be encrypted. While the present invention is optimized for use on a fuel dispenser in a fueling environment, the invention is not so limited and may be used with other retail terminals or kiosks in other retail settings.

(11) Because the present invention is optimized for use in a fueling environment, the present disclosure starts with an overview of a fueling environment 10 in FIG. 1 and its supporting hardware and software. The methodology of the present invention is illustrated in FIGS. 4-5B below, but the fueling environment 10 is explained initially so that the reader has a thorough understanding of the context of the present invention.

(12) The fueling environment 10 includes one or more fuel dispensers 12 (only one illustrated) in a forecourt of the fueling environment. The fuel dispensers 12 communicate with a site controller (SC) 14 in a central building of the fueling environment. Note that the central building is not necessarily central to the physical layout of the fueling environment 10, but typically serves as the central focus of the fueling environment 10 and may include a convenience store, a quick serve restaurant, a service bay, or the like as is well understood. The site controller 14 may be associated with a counter top retail terminal 12a if needed or desired.

(13) The connection between the fuel dispensers 12 and the site controller 14 may be facilitated through an optional translator 16. In an exemplary embodiment, the fuel dispensers 12 may be the ENCORE® or ECLIPSE® fuel dispensers sold by the assignee of the present invention, Gilbarco Inc., of 7300 W. Friendly Avenue, Greensboro, N.C. 22087. Other fuel dispensers could also be used if needed or desired. The site controller 14 may be the G-SITE® also sold by the assignee of the present invention, Gilbarco Inc. Other site controllers could also be used if needed or desired. Sometimes the site controller 14 may not be made by the same manufacturer as the fuel dispensers 12, in which case certain proprietary protocols may not be fully compatible. The optional translator 16 may be used to make the elements compatible, as is well known.

(14) Each fuel dispenser 12 may have a user interface 18 (illustrated schematically in FIG. 2). Each user interface 18 may include one or more displays 20, which may optionally be a touch screen display, a smart pad 22 (FIG. 2 only), a keypad 24 and a card reader 26. The smart pad 22 may be the Smart Pad™ sold by Gilbarco Inc. For more information about the Smart Pad™, the interested reader is referred to commonly owned U.S. Pat. No. 6,736,313, which is hereby incorporated by reference in its entirety. In use, the customer may swipe her debit card (or other payment mechanism) in the card reader 26 and enter her PIN through either the smart pad 22 or the keypad 24. Collectively, the display 20 (if equipped with a touch pad), smart pad 22, the keypad 24, and the card reader 26 are referred to as data entry point devices. The term “data entry point devices” is also herein defined to include contactless card readers and interrogators that interoperate with smart cards, transponders, and other contactless or wireless payment mechanisms that allow the transfer of information from an item controlled by a customer to the fuel dispenser 12 or other retail terminal.

(15) The user interface 18 and/or the data entry point devices (20, 22, 24) encrypts the card number and the PIN according to a local encryption scheme and sends the encrypted information to a security module (SM) 28 through the site controller 14. The previously incorporated '084 and '313 patents both discuss how the card number and PIN are encrypted, and the interested reader is referred to those disclosures for a better comprehension of this process. Encryption of the information reduces concerns about sending the information over communication media on which the information may be intercepted.

(16) The encrypted information is decrypted by the security module 28 using the local encryption scheme and re-encrypted using a host encryption scheme. The security module 28 then sends the re-encrypted information to a host computer 30. The transmission to the host computer 30 may be over a telephone line, a packet network, or the like as needed or desired. Even if the re-encrypted information is intercepted, the host encryption scheme reduces the likelihood of a malefactor gaining access to the card number or PIN. In an exemplary embodiment, the host computer 30 may be a front end merchant processor such as BUYPASS™, PAYMENTECHT™, VITAL™, HEARTLAND EXCHANGE™, or the like. Front end merchant processors act as an interface to companies such as SUN TRUST™, BANK OF AMERICA™, WELLS FARGO™, CONCORD EFS™, and the like. Such arrangements are well known in the industry.

(17) In practice, the fueling environment 10 purchases a security module 28 from a manufacturer such as Gilbarco Inc., and has the manufacturer's authorized representatives install the security module 28 at the fueling environment 10. Once the security module 28 is installed, cryptographic keys may be exchanged between the data entry point devices (20, 22, 24) and the security module 28 for local and host zone encryption.

(18) In an exemplary embodiment, the site controller 14 is in overall charge of the operation of the fueling environment 10, including the sequence of events between the security module 28 and the fuel dispensers 12. The site controller 14, which is in communication with the fuel dispensers 12, determines that one or more of the fuel dispensers 12 requires a cryptographic key. To initiate the process, the site controller 14 requests key generation for a specific fuel dispenser 12 from the security module 28. The following process is known as exponential key exchange, and is presented in a flow chart format in FIG. 3 as an example. The security module 28 and the fuel dispenser 12 (or other remote unit as needed or desired) are both initially loaded with several values in common, namely the values A, Q a test message, and a default master key (DMK) (blocks 100). The values A and Q are large prime numbers. None of these values need to be stored on a secure basis, since even knowledge of all four will not assist a malefactor in determining the actual encryption keys which will be used to encrypt the PINs.

(19) The security module 28 selects a large random number R and calculates the value X=Mod Q (A.sup.R) (block 102), where the Mod function returns the integer remainder after long division. That is, X=the remainder when A to the R power is divided by Q. The value of X is then encrypted by the security module 28 using the default master key (block 104). The encrypted value of X is then sent to the site controller 14 and the site controller 14 sends it to the correct fuel dispenser 12. The fuel dispenser 12 decrypts X with the default master key (block 106). Then the fuel dispenser 12 selects a random number S and calculates Y=(A.sup.S) Mod Q and KD=(X.sup.S) Mod Q (block 108).

(20) The fuel dispenser 12 then calculates a Key Exchange Key (KEK) from the value KD (block 110). This calculation may involve any desired suitable function f(KD) so as to produce KEK as a 64 bit DES key. Several methods can be used in f(KD), including truncation and exclusive ORing parts of KD together.

(21) The fuel dispenser 12 then encrypts Y with the default key (block 112), and encrypts the test message using the DES algorithm with KEK used as the encryption key (block 114). Both the encrypted Y and the encrypted test message are returned to the site controller 14, which in turn sends this data to the security module 28.

(22) The security module 28 decrypts Y with the default key (block 116) and then calculates KD=(Y.sup.R) Mod Q (block 118). The security module 28 then calculates KEK from the value KD, using the same function f(KD) previously used by the fuel dispenser 12 (block 120). Using the value KEK, the security module 28 then decrypts the test message which was encrypted by the fuel dispenser 12 with the KEK (block 122).

(23) The security module 28 compares the stored test message to the decrypted test message (block 124). If the test message does not match the stored value (block 126), the security module 28 selects a new random number R, and calculates a new X=(A.sup.R) Mod Q to start the process over again (block 102). If the decrypted test message matches the test message stored within the security module 28 (block 128), then the security module 28 continues with the setup process, because the fuel dispenser 12 and the security module 28 have calculated the same KEK. The KEK values in the fuel dispenser 12 and the security module 28 are equal, not only as confirmed by identity in the test messages, but also because the values of KEK calculated are mathematically equivalent.

(24) The security module 28 then selects a randomly or pseudorandomly generated working key, WK (block 130), encrypts it with the KEK (block 132), and sends it to the site controller 14, which then sends it to the correct fuel dispenser 12. The fuel dispenser 12 decrypts the working key with the KEK (block 134). Depending on the desired mode of operation, the dispenser may use WK as an encrypting key in any of the various encryption methods whenever a PIN or card number is to be encrypted (block 136).

(25) In a particularly contemplated embodiment, the fuel dispensers 12 use WK as a generating key for Unique Key Per Transaction (UKPT) (block 138). As long as the fuel dispenser 12 and the security module 28 retain the KEK, it is not changed, but the working keys between the security module 28 and the fuel dispensers 12 are preferably changed regularly in response to specific system events or on a timed basis. The KEKs may change for various reasons: cold starting a fuel dispenser 12 (clearing all its memory data storage); replacing a fuel dispenser 12 or a security module 28; or replacing a site controller 14 (either hardware or software). The generation of the KEKs may also be accomplished by algorithms other than exponential key exchange if needed or desired.

(26) As noted above, not every input received by the data entry point devices (20, 22, 24) contains confidential information. As further noted above, if every input received by the data entry point devices (20, 22, 24) is encrypted and sent to the security module 28, such activity unnecessarily taxes the security module 28, and may clutter the internal communication network of the fueling environment 10. The present invention solves this problem by providing software embodied on a computer readable medium (such as FLASH memory, EEPROM, a hard drive, or the like) that knows when confidential and non-confidential information is being solicited at the data entry point devices (20, 22, 24) and selectively encrypts only the confidential information. While software is preferred, it is possible that the present invention could also be implemented in hardware, such as an Application Specific Integrated Circuit (ASIC), that effectuates the same result. A flowchart of a first exemplary embodiment of the present invention is presented in FIG. 4.

(27) Initially, the content for presentation on the displays 20 is programmed (block 200). Programming of the content may be done through any conventional manner such as in a conventional programming language as C, C++, JAVA, or the like. Content can be divided into two sorts of content: the first type does not solicit information from the customer and the second type does solicit information from the customer. A determination is made as to whether the content solicits information (block 202). If the answer to block 202 is yes, then a first flag is set for the content to accept input from the data entry point devices (20, 22, 24) (block 204). If the answer to block 202 is no, the content does not solicit information, the process proceeds to block 210, explained below.

(28) A second determination is made as to whether the information that is solicited is confidential (block 206). If the answer to block 206 is no, the information is not confidential, the process proceeds to block 210, explained below. If the answer to block 206 is yes, then a second flag is set for the fuel dispenser 12 to encrypt input received at the data entry point devices (20, 22, 24) (block 208).

(29) The content is then installed on the fuel dispenser 12 (block 210). The content may be installed on the fuel dispenser 12 in any conventional manner such as through downloading from a remote source; uploading from a computer readable medium such as a floppy disk, compact disc, or optical disc; insertion of a memory device such as an EEPROM; programming the fuel dispenser 12 directly; or any other technique that allows the fuel dispenser 12 to have access to the content. After installation, the content runs on the fuel dispenser 12 (block 212). The content may provide advertising to the customers, instruct the customers on how to use the fuel dispenser 12, or provide responses to customer input, as is well understood. As the content is run on the fuel dispenser 12, the fuel dispenser control system (NP) 32 (see FIG. 2) checks to see if the first flag is present (block 214). If the answer to block 214 is yes, then the fuel dispenser control system 32 turns on the data entry point devices (20, 22, 24) such that they will accept input from the customer (block 216). The fuel dispenser control system 32 then checks to see if the second flag is present (block 218). If the answer to block 218 is yes, the second flag is present, the fuel dispenser control system 32 instructs the data entry point devices (20, 22, 24) to encrypt input received by the data entry point devices (20, 22, 24) (block 220). If the answer to either block 214 or 218 is no, or after block 220, then the process ends (block 222).

(30) While it is illustrated that the process ends at block 222, the more probable practical implementation is that the process will repeat as additional content is presented on the display 20 and the fuel dispenser control system 32 checks for the presence of the flags. Further, while the process described above presents the decision making as being within the fuel dispenser control system 32, it is possible that the decision making could be within the data entry point devices (20, 22, 24) or other processor that operates the data entry point devices (20, 22, 24). Still further, while the process describes a particular sequence of checking for flags and may potentially imply that there is an order in which the flags are checked, it should be appreciated that the flags can be checked concurrently or in reverse order. Even further, while the use of flags is a particularly contemplated way to implement the present invention, other programming techniques could be used to effectuate the same functionality without departing from the scope of the present invention.

(31) While the embodiment presented in FIG. 4 is helpful to reduce demands on the security module 28 and the internal communication network of the fueling environment 10 by only encrypting confidential solicited data, the embodiment of FIG. 4 is potentially vulnerable. In particular, the fuel dispenser control system 32 could be programmed to display unauthorized content on the display 20 that requests confidential information when such is not expected, or the content could be reprogrammed to remove the second flag or new content could be provided which does not have the second flag. The present invention's second and preferred embodiment addresses this vulnerability, and is presented with reference to FIGS. 5A and 5B.

(32) The second embodiment builds on the first embodiment and relies on the concept of authenticating the content before it is displayed on the retail device. If the content is not authenticated, then the data entry point devices (20, 22, 24) may remain inoperative or the fuel dispenser control system 32 may preclude the content from being presented on the display 20. The process of authentication is described in detail below with references to FIGS. 6 and 7, and in commonly owned U.S. patent application Ser. No. 09/798,411, filed Mar. 2, 2001, which is hereby incorporated by reference in its entirety and is now published as U.S. Patent Publication No. 2002/0124170. While the '411 application is a particularly contemplated method of performing an authentication process, any form or method of content authentication is within the scope of the present invention.

(33) The second embodiment begins much as the first embodiment, wherein content is programmed for presentation on the displays 20 of the fuel dispensers 12 (block 250, FIG. 5A). After the content is programmed, appropriate authentication indicia are appended to the content (block 252). A determination is made as to whether the content solicits information (block 254). If the answer to block 254 is yes, then a first flag is set for the content to accept input from the data entry point devices (block 256). If the answer to block 254 is no, the content does not solicit information, the process proceeds to block 262, explained below.

(34) A second determination is made as to whether the information that is solicited is confidential (block 258). If the answer to block 258 is no, the information is not confidential, the process proceeds to block 262, explained below. If the answer to block 258 is yes, then a second flag is set for the fuel dispenser 12 to encrypt input received at the data entry point devices (block 260).

(35) The content is then installed on the fuel dispenser 12 and the fuel dispenser 12 runs (block 262). The content may be installed on the fuel dispenser 12 in any conventional manner. After installation, the fuel dispenser control system 32 of the fuel dispenser 12 determines if the authentication indicia on the content is proper (block 264). As noted above, the process by which content is authenticated is explained in greater detail below. If the answer to block 264 is no, the authentication indicia is missing or otherwise improper, the fuel dispenser 12 may lock or otherwise disable the data entry point devices such that no input therefrom is accepted and end the process (block 266). The fuel dispenser comprises fuel delivery components wherein the control system is adapted to control delivery of fuel to the user through the fuel delivery components. Additionally (or alternatively), the fuel dispenser 12 may preclude the content from being presented on display or take other steps (such as generating an alarm) to prevent the customer from inputting data in response to the unauthenticated content.

(36) If the answer to block 264 is yes, the authentication indicia is proper, then the fuel dispenser 12 presents the content on the display 20 (block 268). The content may provide advertising to the customers, instruct the customers on how to use the fuel dispenser 12, or provide responses to customer input as is well understood. As the content is run on the fuel dispenser 12, the fuel dispenser control system 32 checks to see if the first flag is present (block 270, FIG. 5B). If the answer to block 270 is yes, then the fuel dispenser control system 32 turns on the data entry point devices such that they will accept input from the customer (block 272). The fuel dispenser control system 32 then checks to see if the second flag is present (block 274). If the answer to block 274 is yes, the second flag is present, the fuel dispenser control system 32 instructs the data entry point devices (20, 22, 24) to encrypt input received by the data entry point devices (20, 22, 24) (block 276). If the answer to either block 270 or 274 is no, or after block 276, then the process ends (block 278).

(37) As noted above, while it is illustrated that the process ends at block 278, the more probable practical implementation is that the process will repeat as additional content is presented on the display 20 and the fuel dispenser control system 32 checks for the presence of the flags. Further, while the process described above presents the decision making as being within the fuel dispenser control system 32, it is possible that the decision making could be within the data entry point devices (20, 22, 24) or other processor that operates the data entry point devices (20, 22, 24). Still further, while the process describes a particular sequence of checking for flags and may potentially imply that there is an order in which the flags are checked, it should be appreciated that the flags can be checked concurrently or in reverse order. Even further, while the use of flags is a particularly contemplated way to implement the present invention, other programming techniques could be used to effectuate the same functionality without departing from the scope of the present invention.

(38) The process of authenticating content is explored in the previously incorporated '411 application. Portions of that disclosure are set forth herein for convenience. In essence, a digital signature is appended to the file for authentication. In its basic definition, a digital signature says “I wrote this page and I signed it”, where “I” represents the person or entity that is able to create the digital signature. A digital signature is most usually appended to the end of the data being signed, but it could be embedded within the data in some circumstances. The digital signature scheme may use public and private keys akin to those described above. Where such a scheme is used, the “I” is the person or entity that owns the private key. With the private key, the key owner is able to create the digital signatures. The owner of the private key keeps the private key secret.

(39) The public key can either be published or stored in a non-secure manner since it does not have to be kept secret. The public key is used to verify that the digital signature is authentic. The public key cannot be used to generate a valid digital signature. An example of a digital signature system that uses private and public keys is the one defined in Federal Information Processing Standard (FIPS) publications 180 and 186. This version of a digital signature is referred to as the Digital Signature Standard (DSS).

(40) FIG. 6 illustrates a situation wherein the digital signature of the content is provided by the Original Equipment Manufacturer (OEM). That is, the content is created by the manufacturer of the fuel dispenser 12. This content file is transferred to the fuel dispenser 12 after operating software has been downloaded and is operational in the fuel dispenser 12.

(41) The process starts (block 300), and the OEM appends its signature, also known as DSS, to the content file, using the OEM's private key (block 302). The content file is delivered to the site controller 14 either by electronic communication or by a downloading device directly connected to site controller 14 (block 304). The content file is sent from site controller 14 to the fuel dispenser 12 when desired (block 308). The content file may be a particular web page application that is only to be presented on fuel dispenser 12 for a particular option selected by the customer. The application software or boot software, depending on the configuration of the system, uses the public key to authenticate the signature with the file contents (block 308), and the fuel dispenser 12 decides if the signature is authentic (decision 310). If the signature is not authentic, the fuel dispenser 12 performs alternative handling on the content file (block 312). If the content file is authenticated, the content file is executed by fuel dispenser control system 32 of the fuel dispenser 12 (block 314), and the process ends (block 316).

(42) If the content file was not authenticated (decision 310), alternative handling is performed on the content file (block 312) as illustrated in the flowchart in FIG. 6. The alternative handling process is illustrated in FIG. 7. The fuel dispenser control system 32 first determines if execution of the content file should be aborted by determining the configuration information concerning alternative handling of content files stored in memory of the fuel dispenser 12 (decision 350). If the content file execution is to be aborted, the process ends (block 316 from FIG. 6). If the content file is to be executed, but in a special manner, the special handling data for non-authenticated content files is checked in memory of the fuel dispenser 12 (block 352). If the special handling data requires that data entry input devices at the fuel dispenser 12 be disabled (decision 354), the fuel dispenser control system 32 causes the data entry input devices to be disabled (block 356), and the content file is executed if desired (block 314 from FIG. 6). In this manner, the content file is still executed on the fuel dispenser 12 but the customer cannot interact with the data entry input devices since they are disabled. If the data entry input devices are not to be disabled, any other alternative handling is performed as dictated by the special handling data in memory of the fuel dispenser 12 (block 358), and the content file is executed (block 314 from FIG. 6) if desired.

(43) If the content is derived from a third party other than the OEM, the previously incorporated '411 application describes how to authenticate such content as well. The '411 application also describes how content may be delivered to the fuel dispenser 12 in a secure manner. The interested reader is referred to the '411 application for a more thorough understanding of authentication and content delivery. Other techniques for authenticating data are also within the scope of the present invention.

(44) Those skilled in the art will recognize improvements and modifications to the preferred embodiments of the present invention. All such improvements and modifications are considered within the scope of the concepts disclosed herein and the claims that follow.