Purchase transaction system with encrypted transaction information

Patent metadata

Field	Value
Publication number	US-9704159-B2
Application number	US-46718809-A
Country	US
Kind code	B2
Filing date	May 15, 2009
Priority date	May 15, 2009
Publication date	Jul 11, 2017
Grant date	Jul 11, 2017

Abstract

Systems and methods are provided for securing payment card information. A user may present a payment card such as a credit card to point-of-sale equipment. The point-of-sale equipment may use a symmetric key to encrypt payment card information associated with the payment card. The symmetric key may be encrypted at the point-of-sale equipment using the identity-based-encryption (IBE) public key of a purchase transaction processor to produce a key transfer block. The key transfer block and the encrypted payment card information may be conveyed from the point-of-sale equipment to the purchase transaction processor over a communications network. At the purchase transaction processor, an IBE private key may be used to recover the symmetric key from the key transfer block. The symmetric key can be used to decrypt the encrypted payment card information for processing and re-encryption using a key associated with the purchase transaction processor.

First claim

What is claimed is:

1. A computer-implemented method for using identity-based-encryption (IBE) to secure payment card information associated with a payment card of a user in a system having point-of-sale equipment, a purchase transaction processor equipment, and an additional purchase transaction processor equipment that communicate over a communications network, the method comprising:
identifying, by the point-of-sale equipment, a first host address of the purchase transaction processor equipment and a second host address of the additional purchase transaction processor equipment;
generating, by the point-of-sale equipment, first and second symmetric keys;
generating, by the point-of-sale equipment, a first IBE public key associated with the purchase transaction processor equipment based on the identified first host address;
generating, by the point-of-sale equipment, a second IBE public key associated with the additional purchase transaction processor equipment based on the identified second host address;
generating, by an IBE encryption engine on the point-of-sale equipment, a first key transfer block by encrypting the first symmetric key using the generated first IBE public key and generating a second key transfer block by encrypting the second symmetric key using the second generated IBE public key;
after passage of a predetermined amount of time, regenerating, by the point-of-sale equipment, the first symmetric key and generating, by the point-of-sale equipment, a third key transfer block by encrypting the regenerated first symmetric key using the generated first IBE public key;
after passage of an additional predetermined amount of time, regenerating, by the point-of-sale equipment, the second symmetric key and generating, by the point-of-sale equipment, a fourth key transfer block by encrypting the regenerated second symmetric key using the generated second IBE public key;
storing, by storage circuitry on the point-of-sale equipment, the first symmetric key, the second symmetric key, the regenerated first symmetric key, the regenerated second symmetric key, and the first, second, third, and fourth key transfer blocks;
obtaining, by a card reader on the point-of-sale equipment, the payment card information associated with the payment card of the user during a purchase transaction;
determining, by the point-of-sale equipment, that the purchase transaction processor equipment is associated with the payment card of the user based on the payment card information obtained by the card reader;
based on determining that the purchase transaction processor equipment is associated with the payment card of the user generating, by a symmetric key encryption engine on the point-of-sale equipment, encrypted payment information by encrypting the payment card information using the regenerated first symmetric key stored at the storage circuitry;
sending, by the point-of-sale equipment, the third key transfer block stored at the storage circuitry from the point-of-sale equipment to the purchase transaction processor equipment over the communications network;
sending, by the point-of-sale equipment, the encrypted payment card information from the point-of-sale equipment to the purchase transaction processor equipment over the communications network;
receiving, by the purchase transaction processor equipment, the third key transfer block and the encrypted payment card information from the point-of-sale equipment;
receiving, by the purchase transaction processor equipment, an IBE private key corresponding to the first IBE public key;
obtaining, by an IBE decryption engine on the purchase transaction processor equipment, the regenerated first symmetric key by decrypting the third key transfer block using the IBE private key;
decrypting, by a symmetric key decryption engine on the purchase transaction processor equipment, the encrypted payment card information using the regenerated first symmetric key that was obtained by decrypting the third key transfer block; and
authorizing, by the purchase transaction processor equipment, a payment with the payment card of the user based on the decrypted payment card information.

2. The method defined in claim 1 , further comprising:
re-encrypting, by the purchase transaction processor equipment, the decrypted payment card information, wherein re-encrypting the decrypted payment card information comprises:
re-encrypting, using a format-preserving encryption algorithm implemented on storage and processing circuitry at the purchase transaction processor equipment, the decrypted payment card information.

3. The method defined in claim 1 , wherein receiving the IBE private key comprises requesting the IBE private key from an IBE private key generator over the communications network.

4. The method defined in claim 1 , wherein generating the third key transfer block comprises:
obtaining, by the point-of-sale equipment, IBE public parameter information from a public parameter server over the communications network; and
generating, by the point-of-sale equipment, the third key transfer block by encrypting the regenerated first symmetric key using the IBE public parameter information and the first IBE public key associated with the purchase transaction processor equipment.

5. The method defined in claim 1 , wherein the payment card comprises a credit card, wherein the payment card information includes at least part of a credit card number, and wherein obtaining the payment card information comprises obtaining the credit card number associated with the credit card during the purchase transaction.

6. The method defined in claim 1 , wherein the payment card comprises a credit card with a magnetic stripe, wherein the payment card information includes magnetic stripe track information from the magnetic stripe, and wherein obtaining the payment card information associated with the payment card of the user during the purchase transaction comprises obtaining the magnetic stripe information associated with the credit card during the purchase transaction.

7. The method defined in claim 1 , wherein obtaining the payment card information comprises:
reading, by the card reader on the point-of-sale equipment, magnetic stripe information from the payment card.

8. The method defined in claim 1 , wherein the generated first IBE public key includes a first expiration time, and wherein receiving the IBE private key by the purchase transaction processor equipment comprises:
sending a request by the purchase transaction processor equipment, for the IBE private key to an IBE private key generator over the communications network; and
receiving the IBE private key by the purchase transaction processor equipment from the IBE private key generator only prior to expiration of the first expiration time of the first IBE public key.

9. The method defined in claim 1 , wherein regenerating the first symmetric key and generating the third key transfer block comprises:
regenerating the first symmetric key and generating the third key transfer block after passage of a day.

10. The method defined in claim 1 , wherein regenerating the first symmetric key and generating the third key transfer block comprises:
regenerating the first symmetric key and generating the third key transfer block after passage of an hour.

11. The method defined in claim 1 , further comprising:
obtaining, by the card reader on the point-of-sale equipment, additional payment card information associated with an additional payment card of a second user during an additional purchase transaction;
determining, by the point-of-sale equipment, that the additional purchase transaction processor equipment is associated with

Assignees

• Pauker Matthew J
• Spies Terence
• Entit Software Llc

Inventors

• Pauker Matthew J
• Spies Terence

Classifications

• H04L2209/56

  Financial cryptography, e.g. electronic payment or e-cash · CPC title

• H04L9/0825

  using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates · CPC title

• G06Q20/3829 Primary

  involving key management · CPC title

• G06Q20/3674

  involving authentication · CPC title

• G06Q20/20

  Point-of-sale [POS] network systems · CPC title