# US 7,841,523 B2 · Secure payment card transactions

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 7,841,523 B2
- Document ID: US7841523B2
- Status: Granted
- Kind: B2
- Application number: 11/750,184
- Filed: 2007-05-17
- Published: 2008-11-20
- Granted: 2010-11-30
- Earliest claimed: 2007-05-17
- Assignees: Shift4 Corporation
- Inventors: John David Oder, II; John David Oder; Kevin James Cronic; Steven Mark Sommers; Dennis William Warner
- Web page: https://patentgrep.com/patent/US7841523B2

## CPC

- G06Q 20/40: Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
- G06Q 20/20: Point-of-sale [POS] network systems
- G06Q 40/00: Finance; Insurance; Tax strategies; Processing of corporate or income taxes
- G07F 7/088: {the card reader being part of the point of sale [POS] terminal or electronic cash register [ECR] itself}
- G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G07F: COIN-FREED OR LIKE APPARATUS (coin sorting G07D3/00; coin testing G07D5/00; {handling coins or paper currencies apart from payment activated apparatus G07D; payment architectures, schemes or protocols G06Q20/00})

## Abstract

Payment card transactions at a point of sale (POS) are secured in certain embodiments by intercepting, with a POS security layer installed on a POS terminal, payment data from the POS terminal, transmitting the payment data from the POS security layer to a server security application installed on a POS server, and providing false payment data from the POS security layer to a POS terminal application installed on the POS terminal. The false payment data in various embodiments is processed as if it were the payment data, such that the POS terminal transmits an authorization request to the POS server using the false payment data. In addition, the authorization request may be transmitted from the POS server to a payment gateway.

## Claims

### Claim 1

A method of adding security to a point-of-sale (POS) system that comprises a POS terminal which communicates over a network with a POS server, the POS terminal including a payment card reader and having a POS terminal application installed thereon, the POS server having a POS server application installed thereon which communicates with the POS terminal application over a non-secure channel to process payment card transactions, the method comprising:
installing a POS security layer on the POS terminal, the POS security layer configured to at least (a) intercept actual card data received from the payment card reader when a user initiates a payment card transaction, (b) pass false card data to the POS terminal application for use in place of the actual card data, such that the false card data is transmitted over the non-secure channel to the POS server in place of the actual card data, and (c) transmit the actual card data to the POS server over a secure channel; and
installing a server security application on the POS server, the server security application configured to receive the actual card data from the POS security layer over the secure channel and to use the false card data to process the payment card transaction.

### Claim 2 (depends on 1)

The method of claim 1, wherein the false card data includes a false payment card number.

### Claim 3 (depends on 1)

The method of claim 1, wherein the server security application is configured to generate at least a portion of the false card data.

### Claim 4 (depends on 1)

The method of claim 1, wherein the POS security layer is configured to generate at least a portion of the false card data.

### Claim 5 (depends on 1)

The method of claim 1, wherein the server security application is configured to generate the false card data such that the false card data is in a card-swipe compatible format but does not correspond to a valid payment card account.

### Claim 6 (depends on 4)

The method of claim 4, wherein at least a portion of the false card data is re-used as a token for an additional payment card transaction.

### Claim 7 (depends on 1)

The method of claim 1, wherein the actual card data is obtained from a card swipe.

### Claim 8 (depends on 1)

The method of claim 1, wherein the actual card data is manually entered.

### Claim 9

A method for securing payment card transactions at a point of sale (POS), the method comprising:
intercepting, with a POS security layer installed on a POS terminal, payment data from the POS terminal, the payment data comprising actual card data from a payment card;
transmitting the payment data from the POS security layer to a server security application installed on a POS server;
providing false payment data from the POS security layer to a POS terminal application installed on the POS terminal, the false payment data configured to be processed as if it were the payment data, such that the POS terminal is configured to transmit a first authorization request to the POS server using the false payment data; and
transmitting a second authorization request from the POS server to a remote server, the second authorization request comprising at least the payment data.

### Claim 10 (depends on 9)

The method of claim 9, further comprising generating the false payment data with the server security application.

### Claim 11 (depends on 9)

The method of claim 9, wherein transmitting the payment data from the POS security layer to the server security application further comprises transmitting the payment data over a secure channel.

### Claim 12 (depends on 9)

The method of claim 9, further comprising encrypting the payment data with the POS security layer.

### Claim 13 (depends on 12)

The method of claim 12, further comprising encrypting two versions of the payment data with the POS security layer, wherein one version of encrypted card data is not decryptable at the POS server and the other version of encrypted card data is decryptable at the POS server.

### Claim 14 (depends on 13)

The method of claim 13, further comprising encrypting a personal identification number (PIN) of the payment card using the payment data.

### Claim 15 (depends on 13)

The method of claim 13, further comprising destroying the version of encrypted card data that is decryptable at the POS server.

### Claim 16 (depends on 13)

The method of claim 13, further comprising destroying the version that is decryptable at the POS server after a time-out period.

### Claim 17 (depends on 9)

The method of claim 9, further comprising generating the false payment data using an algorithm that substantially guarantees that the false payment data does not represent valid payment data.

### Claim 18 (depends on 9)

The method of claim 9, wherein intercepting payment data on a POS terminal comprises accessing an input buffer on the POS terminal.

### Claim 19 (depends on 9)

The method of claim 9, wherein the second authorization request further comprises the false payment data.

### Claim 20 (depends on 9)

The method of claim 9, wherein the POS security layer is further configured to display a substitute payment screen configured to enable a cardholder to provide at least a portion of the payment data to the POS security layer.

### Claim 21 (depends on 9)

The method of claim 9, wherein the POS security layer is capable of being invoked directly by a user action.

### Claim 22 (depends on 21)

The method of claim 21, wherein the user action comprises a hotkey press or manual key card input.

### Claim 23 (depends on 9)

The method of claim 9, wherein the POS security layer is capable of being invoked indirectly by entry of the payment data into the POS terminal.

### Claim 24 (depends on 9)

The method of claim 9, wherein the POS security layer is capable of being invoked programmatically.

### Claim 25 (depends on 9)

The method of claim 9, wherein the payment data further comprises at least one of a personal identification number (PIN), a signature, biometric data, an expiration date, a cardholder name, a card security code, or a dynamic security code.

### Claim 26 (depends on 9)

The method of claim 9, wherein the remote server is a payment gateway.

### Claim 27 (depends on 9)

The method of claim 9, wherein at least a portion of the false payment data is derived from a range of card numbers regarded as invalid by one or more card associations.

### Claim 28

A method for securing payment card transactions at a point of sale (POS), the method comprising:
intercepting payment data from a POS terminal, the payment data comprising actual card data from a payment card;
transmitting the actual card data from the POS terminal to a gateway security application installed on a gateway server;
receiving, at the POS terminal, false card data, the false card data configured to be processed in place of the actual card data; and
providing the false card data to the POS terminal, such that the POS terminal is configured to transmit an authorization request comprising the false card data.

### Claim 29 (depends on 28)

The method of claim 28, wherein the gateway security application provides the false card data to the POS terminal.

### Claim 30 (depends on 28)

The method of claim 28, further comprising receiving the authorization request at the gateway server from a POS server in communication with the POS terminal.

### Claim 31 (depends on 30)

The method of claim 30, further comprising transmitting a second authorization request from the gateway server to a card processor, the second authorization request comprising at least the actual card data.

### Claim 32 (depends on 31)

The method of claim 31, further comprising receiving, at the gateway server, a response to the second authorization request from the card processor.

### Claim 33 (depends on 32)

The method of claim 32, further comprising transmitting the response from the gateway server to the POS server.

### Claim 34 (depends on 33)

The method of claim 33, further comprising returning at least a portion of the false card data to the POS server as a token for an additional payment transaction.

### Claim 35

A payment card processing system for securing payment card transactions at a point of sale (POS), the system comprising:
a POS terminal comprising a host computer and a card entry device, the host computer having a POS terminal application installed thereon;
a POS server in communication with the POS terminal over a network, the POS server having a POS server application installed thereon that communicates with the POS terminal application to process payment card transactions,
a POS security layer installed on the host computer of the POS terminal, the POS security layer configured to at least (a) intercept actual card data received from the card entry device when a user initiates a payment card transaction, (b) pass false card data to the POS terminal application for use in place of the actual card data, such that the false card data is transmitted to the POS server in place of the actual card data, and (c) transmit the actual card data to the POS server; and
a server security application installed on the POS server, the server security application in communication with the POS security layer over the secure channel, the server security application configured to receive the actual card data from the POS security layer over the secure channel and to use the false card data to process the payment card transaction.

### Claim 36 (depends on 35)

The payment card processing system of claim 35, wherein the server security application is further configured to generate the false data using an algorithm that substantially guarantees that the false data does not represent valid card data.

### Claim 37 (depends on 35)

The payment card processing system of claim 35, wherein the POS security layer is further configured to intercept the payment data by accessing an input buffer on the POS terminal.

### Claim 38 (depends on 35)

The payment card processing system of claim 35, wherein the server security application is further configured to transmit an authorization request to a gateway, the authorization request comprising the false card data and the actual card data.

### Claim 39 (depends on 35)

The payment card processing system of claim 35, wherein the POS server application is configured to store the false card data in a transaction database.

### Claim 40 (depends on 35)

The payment card processing system of claim 35, wherein the POS server application is configured to store the false card data in a database as log data.

### Claim 41 (depends on 40)

The payment card processing system of claim 40, wherein no complete actual payment data is stored at the POS terminal or the POS server.

### Claim 42 (depends on 35)

The payment card processing system of claim 35, wherein the POS security layer is further configured to transmit the actual card data over a secure channel to the POS server.