# US 2023/0410076 A1 · Embedded card reader security > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2023/0410076 A1 - Document ID: US20230410076A1 - Status: Published application - Kind: A1 - Application number: 18/210,895 - Filed: 2023-06-16 - Published: 2023-12-21 - Earliest claimed: 2021-02-23 - Assignees: Block, Inc. - Applicants: Block, Inc. - Inventors: Murat Cat; Murtaza Munaim; Gokhan Aydeniz; Conrad Rushing - Web page: https://patentgrep.com/patent/US20230410076A1 ## CPC - G06Q 20/20: Point-of-sale [POS] network systems - G06Q 20/206: {comprising security or operator identification provisions, e.g. password entry} - G06Q 20/326: {Payment applications installed on the mobile devices} - G06Q 20/4012: {Verifying personal identification numbers [PIN]} - G07F 7/0886: {the card reader being portable for interacting with a POS or ECR in realizing a payment transaction} - G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR - G07F: COIN-FREED OR LIKE APPARATUS (coin sorting G07D3/00; coin testing G07D5/00; {handling coins or paper currencies apart from payment activated apparatus G07D; payment architectures, schemes or protocols G06Q20/00}) ## Abstract Systems, devices, and methods for embedded card reader security include configuring a personal account number (PAN) application installed on a device to utilize an embedded card reader (ECR) and receiving, at the PAN application and based at least in part on an interaction between the ECR and the device, a PAN for a transaction. The PAN may be sent to a payment processing service and a personal identification number (PIN) application may render a PIN user interface. The PIN may be received at the PIN application and sent to the payment processing service. The transaction may be completed based at least in part on an indication from the payment processing service that the PAN and the PIN have been accepted. ## Claims ### Claim 1 (canceled) ### Claim 2 A device, comprising: one or more processors; and non-transitory computer-readable media storing instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising: configuring a personal account number (PAN) application installed on the device to utilize an embedded card reader (ECR) of the device; receiving, at the PAN application and based at least in part on an interaction between the ECR and the device, a PAN for a transaction; sending, utilizing the PAN, the PAN to a payment processing service; in response to determining that the PAN has been received at the payment processing service, causing a personal identification number (PIN) application residing on the device to render a PIN user interface, the PIN application and the PAN application being configured to prevent communication with each other; receiving, at the PIN application and utilizing the PIN user interface, the PIN; sending, utilizing the PIN application, the PIN to the payment processing service; and completing the transaction based at least in part on an indication from the payment processing service that the PAN and the PIN have been accepted. ### Claim 3 (depends on 2) The device of claim 2, the operations further comprising removing the PAN from the device in response to sending the PAN to the payment processing service. ### Claim 4 (depends on 2) The device of claim 2, the operations further comprising: receiving, from the payment processing service, a request for the PIN; and removing the PAN from the device in response to receiving the request for the PIN. ### Claim 5 (depends on 2) The device of claim 2, the operations further comprising removing the PAN from the device, wherein requesting the PIN is in response to removing the PAN from the device. ### Claim 6 (depends on 2) The device of claim 2, the operations further comprising: causing, after receiving the PAN, a trust routine to be performed in association with the device, the trust routine configured to determine whether the device has been tampered with; determining that the trust routine indicates the device has not been tampered with; and wherein requesting the PIN is in response to the trust routine indicating the device has not been tampered with. ### Claim 7 (depends on 2) The device of claim 2, wherein: receiving the PAN at the PAN application comprises receiving the PAN at a trusted execution environment (TEE) of the device; and the PIN is received by the PIN application outside the TEE of the device. ### Claim 8 (depends on 2) The device of claim 2, the operations further comprising: in response to requesting the PIN, receiving an indication that user input is received that corresponds to the PIN; and wherein completing the transaction is based at least in part on the user input corresponding to the PIN. ### Claim 9 (depends on 2) The device of claim 2, wherein: receiving the PAN comprises receiving encrypted first data representing the PAN from the ECR at the PAN application; and receiving the PIN comprises receiving encrypted second data representing the PIN at the PIN application. ### Claim 10 (depends on 2) The device of claim 2, wherein receiving the PIN comprises receiving encrypted data representing the PIN at the PIN application, and the operations further comprise: sending the encrypted data to the payment processing system; receiving, from the payment processing service, an indication that the PIN, as decrypted by the payment processing system, is authorized in association with the PAN; and wherein completing the transaction is based at least in part on the PIN being authorized in association with the PAN. ### Claim 11 (depends on 2) The device of claim 2, the operations further comprising removing, by the PAN application, the PAN from the device before requesting the PIN. ### Claim 12 A method, comprising: configuring a personal account number (PAN) application installed on a device to utilize an embedded card reader (ECR) of the device; receiving, at the PAN application and based at least in part on an interaction between the ECR and the device, a PAN for a transaction; sending, utilizing the PAN, the PAN to a payment processing service; in response to determining that the PAN has been received at the payment processing service, causing a personal identification number (PIN) application residing on the device to render a PIN user interface, the PIN application and the PAN application being configured to prevent communication with each other; receiving, at the PIN application and utilizing the PIN user interface, the PIN; sending, utilizing the PIN application, the PIN to the payment processing service; and completing the transaction based at least in part on an indication from the payment processing service that the PAN and the PIN have been accepted. ### Claim 13 (depends on 12) The method of claim 12, further comprising removing the PAN from the device in response to sending the PAN to the payment processing service. ### Claim 14 (depends on 12) The method of claim 12, further comprising: receiving, from the payment processing service, a request for the PIN; and removing the PAN from the device in response to receiving the request for the PIN. ### Claim 15 (depends on 12) The method of claim 12, further comprising removing the PAN from the device, wherein requesting the PIN is in response to removing the PAN from the device. ### Claim 16 (depends on 12) The method of claim 12, further comprising: causing, after receiving the PAN, a trust routine to be performed in association with the device, the trust routine configured to determine whether the device has been tampered with; determining that the trust routine indicates the device has not been tampered with; and wherein requesting the PIN is in response to the trust routine indicating the device has not been tampered with. ### Claim 17 (depends on 12) The method of claim 12, wherein: receiving the PAN at the PAN application comprises receiving the PAN at a trusted execution environment (TEE) of the device; and the PIN is received by the PIN application outside the TEE of the device. ### Claim 18 (depends on 12) The method of claim 12, further comprising: in response to requesting the PIN, receiving an indication that user input is received that corresponds to the PIN; and wherein completing the transaction is based at least in part on the user input corresponding to the PIN. ### Claim 19 (depends on 12) The method of claim 12, wherein: receiving the PAN comprises receiving encrypted first data representing the PAN from the ECR at the PAN application; and receiving the PIN comprises receiving encrypted second data representing the PIN at the PIN application. ### Claim 20 (depends on 12) The method of claim 12, wherein receiving the PIN comprises receiving encrypted data representing the PIN at the PIN application, and the method further comprises: sending the encrypted data to the payment processing service; receiving, from the payment processing system, an indication that the PIN, as decrypted by the payment processing system, is authorized in association with the PAN; and wherein completing the transaction is based at least in part on the PIN being authorized in association with the PAN. ### Claim 21 (depends on 12) The method of claim 12, further comprising removing, by the PAN application, the PAN from the device before requesting the PIN.