System and method for securing a base derivation key for use in injection of derived unique key per transaction devices

A system for preparing an encrypted Base Derivation Key (BDK) for use in injecting a Derived Unique Key Per Transaction (DUKPT) encryption device comprising:

• an asymmetrical decryption device using a private key of a private/public key pair to decrypt asymmetrically a doubly encrypted Base Derivation Key (BDK) segment to generate a symmetrically encrypted BDK segment and to decrypt asymmetrically a singularly encrypted symmetrical key to generate the symmetrical key;
• a symmetrical decryption device for decrypting the symmetrically encrypted BDK segment using the symmetrical key generated by asymmetrically decrypting the singularly encrypted symmetrical key;
• and
• a BDK assembler for assembling a plurality of decrypted BDK segments, each one of which was decrypted with a different symmetrical key, the assembled BDK segments forming a single BDK for use in the injection of a Derived Unique Key Per Transaction (DUKPT) encryption device.

A method for securing a Base Derivation Key (BDK) at a facility for injecting Derived Unique Key Per Transaction (DUKPT) encryption devices comprising:

• encrypting a first Base Derivation Key (BDK) segment using a first symmetrical key;
• encrypting a second Base Derivation Key (BDK) segment using a second symmetrical key, the second symmetrical key being different than the first symmetrical key;
• generating a first asymmetrical key pair;
• generating a second asymmetrical key pair, the second asymmetrical key pair being different than the first asymmetrical key pair;
• generating a first doubly encrypted BDK segment by encrypting the first symmetrically encrypted BDK segment using a public key of the first asymmetrical key pair;
• generating a second doubly encrypted BDK segment by encrypting the second symmetrically encrypted BDK segment using a public key of the second asymmetrical key pair;
• encrypting the first symmetrical key used to encrypt the first BDK segment using the public key of the first asymmetrical key pair;
• encrypting the second symmetrical key used to encrypt the second BDK segment using the public key of the second asymmetrical key pair;
• destroying the public key of the first asymmetrical key pair after the asymmetrical encryption of the first symmetrically encrypted BDK segment and the asymmetrical encryption of the first symmetrical key;
• destroying the public key of the second asymmetrical key pair after the asymmetrical encryption of the second symmetrically encrypted BDK segment and the asymmetrical encryption of the second symmetrical key;
• and
• storing the first private key and the second private key in a local storage device.

A method for preparing an encrypted Base Derivation Key (BDK) for use in generating an Initial PIN Pad Key for injection into a Derived Unique Key Per Transaction (DUKPT) encryption device comprising:

• asymmetrically decrypting with a private key of a first private/public key pair a first doubly encrypted Base Derivation Key (BDK) segment to generate a first symmetrically encrypted BDK segment;
• asymmetrically decrypting with the private key of the first private/public key pair a first singularly encrypted symmetrical key to generate a first symmetrical key;
• symmetrically decrypting the first symmetrically encrypted BDK segment using the first symmetrical key generated from the asymmetrical decryption of the first singularly encrypted symmetrical key to generate a first decrypted BDK segment;
• asymmetrically decrypting with a private key of a second private/public key pair a second doubly encrypted Base Derivation Key (BDK) segment to generate a second symmetrically encrypted BDK segment;
• asymmetrically decrypting with the private key of the second private/public key pair a second singularly encrypted symmetrical key to generate a second symmetrical key;
• symmetrically decrypting the second symmetrically encrypted BDK segment using the second symmetrical key generated from the asymmetrical decryption of the second singularly encrypted symmetrical key to generate a second decrypted BDK segment;
• and
• assembling the first and the second decrypted BDK segments to form a BDK for use in the injection of a Derived Unique Key Per Transaction (DUKPT) encryption device.