Secure PIN Character Retrieval and Setting Using PIN Offset Masking
AssigneeTotal System Services, Inc.
InventorsJonathan Lupton, George S. Perkins
Life of this patent
Estimating the term…
Abstract
Securely disclosing a personal identification number (“PIN”) associated with a financial account to an account holder and receiving a new PIN from the account holder. A PIN reveal application can interact with a hardware security module (“HSM”) using a PIN offset masking process and randomly generated account data to reveal the PIN to the account holder one or more PIN characters at a time. A PIN set application also can interact the HSM using a PIN offset masking process and randomly generated account data to receive a new PIN for the account one or more PIN characters at a time. In each of the PIN reveal and PIN setting processes, less than the entirety of the PIN is stored in an unencrypted format outside of the HSM only.
Claims21
A method for disclosing a personal identification number (“PIN”) associated with an account, comprising:
- (a) receiving a request to disclose the PIN, the PIN comprising a plurality of PIN characters encrypted in a first PIN block;
- (b) generating account data for the account;
- (c) generating with a hardware security module (“HSM”) a PIN offset comprising a plurality of PIN offset characters using the account information and the PIN encrypted in the first PIN block;
- (d) receiving at a PIN application executing on a computer the PIN offset from the HSM;
- (e) modifying with the PIN application a portion of the PIN offset characters of the PIN offset and leaving one of the PIN offset characters unchanged;
- (f) creating with the HSM a second encrypted PIN block comprising a second PIN using the modified PIN offset and the account data;
- (g) decrypting with the HSM the second encrypted PIN block;
- (h) outputting a PIN character of the decrypted second PIN block corresponding to the one PIN offset character unchanged in step (e);
- and
- (i) repeating at least steps (e) through (h) for each PIN character, wherein the PIN application deletes the previously decrypted PIN block prior to decrypting another PIN block.
A system for disclosing at least one element of a personal identification number (“PIN”) associated with a transaction account, comprising:
- a user interface for processing a request for disclosure of a portion of the PIN in an unencrypted form, the PIN comprising a plurality of PIN characters stored in an encrypted data element;
- and
- a PIN module logically coupled to the user interface and to a hardware security module (“HSM”) that interacts with the HSM to decrypt the portion of the PIN by applying a PIN mask to the portion of the PIN and randomly generated account information to generate the decrypted portion of the PIN for presentation via the user interface.
A method for setting a personal identification number (“PIN”) of an account, comprising:
- (a) providing a user interface for a user to enter a PIN character for including in the PIN;
- (b) receiving the PIN character at a PIN application operating on a computer;
- (c) appending with the PIN application one or more PIN characters to the received PIN character to create a second PIN;
- (d) generating random account data;
- (e) creating with a secure platform logically coupled to the PIN application a PIN offset using the second PIN and the random account data;
- (f) repeating steps (a) through (e) for each PIN character of the PIN;
- (g) creating with the PIN application a combined PIN offset using each of the PIN offsets generated in step (e);
- and
- (h) creating with the secure platform an encrypted PIN block using information associated with the account, the random account data, and the combined PIN offset.
Dependencies are inferred from the claim text.