System and method for variable length encryption

Patent metadata

Field	Value
Publication number	US-10007910-B2
Application number	US-201615012739-A
Country	US
Kind code	B2
Filing date	Feb 1, 2016
Priority date	Oct 17, 2006
Publication date	Jun 26, 2018
Grant date	Jun 26, 2018

Abstract

Systems and methods for performing a secure transaction provided. In one embodiment, the method includes: reading data on a command token, reading data on a token; encrypting the token data with a key; encrypting an authentication data with a clear text token data; and transmitting the encrypted authentication data with the encrypted token data to a remote device.

First claim

What is claimed is:

1. A method of encrypting token data at a token reader comprising a processor, the method comprising, performing by the token reader, the steps of:
receiving clear text token data from a token;
defining a first portion and a second portion of the clear text token data;
generating an encryption mask based on encrypting the second portion of the clear text token data using a key;
translating the first portion of the clear text token data using a substitution table; and
encrypting the clear text data by applying the encryption mask to the translated first portion using a modulo operation while not encrypting the second portion, thereby resulting in encrypted token data comprising an encrypted first portion and an unencrypted second portion;
wherein the encrypted token data has the same format as the clear text token data so that the encrypted token data has the same length as the clear text token data and has characters selected from the same symbol set as the clear text token data, wherein the symbol set is an arbitrary string symbol set comprising a plurality of members.

2. The method of claim 1 , wherein the token reader is a point-of-sale terminal and the clear text token data comprises bank card data.

3. The method of claim 1 , further comprising the token reader transmitting the encrypted token data to a gateway over a network.

4. The method of claim 1 , wherein the received clear text token data is clear text token data from a bank card, and wherein the first portion of the clear text token data comprises a portion of an account number, and the second portion of the clear text token data comprises a bank identification number.

5. The method of claim 4 , wherein the encryption mask is generated by encrypting the bank identification number.

6. A token reader for encrypting token data, the token reader comprising:
a processor; and
a non-transitory computer-readable medium operatively coupled to the processor and having instructions stored thereon that, when executed by the processor, causes the token reader to:
receive clear text token data from a token;
define a first portion and a second portion of the clear text token data;
generate an encryption mask based on encrypting the second portion of the clear text token data using a key;
translate the first portion of the clear text token data using a substitution table; and
encrypt the clear text data by applying the encryption mask to the translated first portion using a modulo operation while not encrypting the second portion, thereby resulting in encrypted token data comprising an encrypted first portion and an unencrypted second portion;

wherein the encrypted token data has the same format as the clear text token data so that the encrypted token data has the same length as the clear text token data and has characters selected from the same symbol set as the clear text token data, wherein the symbol set is an arbitrary string symbol set comprising a plurality of members.

7. The token reader of claim 6 , wherein the token reader is a point-of-sale terminal and the clear text token data comprises bank card data.

8. The token reader of claim 6 , wherein the instructions, when executed by the processor, further cause the token reader to transmit the encrypted token data to a gateway over a network.

9. The token reader of claim 6 , wherein the received clear text token data is clear text token data from a bank card, and wherein the first portion of the clear text token data comprises a portion of an account number, and the second portion of the clear text token data comprises a bank identification number.

10. The token reader of claim 9 , wherein the encryption mask is generated by encrypting the bank identification number.

11. A method of decrypting encrypted token data at a secure transaction device comprising a network interface connected to a transaction processing network, the method comprising, performing by the secure transaction device, the steps of:
receiving encrypted token data over the transaction processing network;
defining a first portion and a second portion of the encrypted token data, where the encrypted token data comprises an encrypted first portion and an unencrypted second portion;
generating a decryption mask based on encrypting the unencrypted second portion using a key;
decrypting the encrypted token data by applying the decryption mask to the first portion using a modulo operation, thereby resulting in clear text token data comprising a decrypted first portion and an unencrypted second portion; and
translating the decrypted first portion using a substitution table;
wherein the encrypted token data has the same format as the clear text token data so that the encrypted token data has the same length as the clear text token data and has characters selected from the same symbol set as the clear text token data, wherein the symbol set is an arbitrary string symbol set comprising a plurality of members.

12. The method of claim 11 , wherein the clear text token data is clear text token data from a bank card, and wherein the decrypted first portion of the clear text token data comprises a portion of an account number, and the unencrypted second portion of the clear text token data comprises a bank identification number.

13. The method of claim 12 , wherein the decryption mask is generated by encrypting the bank identification number.

14. A secure transaction device for decrypting encrypted token data received over a transaction processing network, the secure transaction device comprising:
a network interface connected to the transaction processing network;
a processor; and
a non-transitory computer-readable medium operatively coupled to the processor and having instructions stored thereon that, when executed by the processor, causes the secure transaction device to:
receive encrypted token data over the transaction processing network;
define a first portion and a second portion of the encrypted token data, where the encrypted token data comprises an encrypted first portion and an unencrypted second portion;
generate a decryption mask based on encrypting the unencrypted second portion using a key;
decrypt the encrypted token data by applying the decryption mask to the first portion using a modulo operation, thereby resulting in clear text token data comprising a decrypted first portion and an unencrypted second portion; and
translate the decrypted first portion using a substitution table;

wherein the encrypted token data has the same format as the clear text token data so that the encrypted token data has the same length as the clear text token data and has characters selected from the same symbol set as the clear text token data, wherein the symbol set is an arbitrary string symbol set comprising a plurality of members.

15. The secure transaction device of claim 14 , wherein the clear text token data is clear text token data from a bank card, and wherein the decrypted first portion of the clear text token data comprises a portion of an account number, and the unencrypted second portion of the clear text token data comprises a bank identification number.

16. The secure transaction device of claim 15 , wherein the decryption mask is generated by encrypting the bank identification number.

Assignees

• Verifone Inc

Inventors

• Von Mueller Clay
• Bellare Mihir
• Yale Scott
• Hazel Patrick K
• Catinella Paul Elbridge

Classifications

• H04L9/0625

  with splitting of the data block into left and right halves, e.g. Feistel based algorithms, DES, FEAL, IDEA or KASUMI · CPC title

• H04L63/0428

  wherein the data content is protected, e.g. by encrypting or encapsulating the payload · CPC title

• H04L9/3247

  involving digital signatures · CPC title

• G06Q20/3829 Primary

  involving key management · CPC title

• G06Q2220/00

  Business processing using cryptography · CPC title