Secure PIN character retrieval and setting using PIN offset masking
AssigneeTotal System Services, Inc.
InventorsJonathan Lupton, George S. Perkins
Life of this patent
Estimating the term…
Abstract
Securely disclosing a personal identification number (“PIN”) associated with a financial account to an account holder and receiving a new PIN from the account holder. A PIN reveal application can interact with a hardware security module (“HSM”) using a PIN offset masking process and randomly generated account data to reveal the PIN to the account holder one or more PIN characters at a time. A PIN set application also can interact the HSM using a PIN offset masking process and randomly generated account data to receive a new PIN for the account one or more PIN characters at a time. In each of the PIN reveal and PIN setting processes, less than the entirety of the PIN is stored in an unencrypted format outside of the HSM only.
Claims22
A method for disclosing a personal identification number (“PIN”) associated with an account, comprising:
- (a) receiving a request to disclose the PIN, the PIN comprising a plurality of PIN characters encrypted in a first PIN block;
- (b) generating account data for the account;
- (c) generating, by a processor, a PIN offset comprising a plurality of PIN offset characters using the account data and the PIN characters encrypted in the first PIN block;
- (d) modifying a portion of the PIN offset characters of the PIN offset other than one unmodified PIN offset character;
- (e) creating, by the processor, a second encrypted PIN block using the modified PIN offset and the account data;
- (f) decrypting, by the processor, the second encrypted PIN block;
- and
- (g) outputting a PIN character of the decrypted second PIN block corresponding to the unmodified PIN offset character of the PIN offset.
A system for disclosing at least one element of a personal identification number (“PIN”) associated with a transaction account, comprising:
- a user device that processes a request for disclosure of a portion of the PIN in an unencrypted form, the PIN comprising a plurality of PIN characters stored in an encrypted data element;
- and
- a computing device logically coupled to the user device and configured to
- receive a PIN offset and modify a first portion of the characters of the PIN offset other than one unmodified PIN offset character, to generate a modified PIN offset,
- create a second encrypted data element using the modified PIN offset and randomly generated account information,
- decrypt the second encrypted data element to generate a decrypted PIN block, and
- output a PIN character of the decrypted PIN block corresponding to the unmodified PIN offset character of the PIN offset.
A method for setting a personal identification number (“PIN”) of an account, comprising:
- (a) receiving a PIN character of the PIN;
- (b) appending one or more PIN characters to the received PIN character to create a second PIN;
- (c) generating random account data;
- (d) creating, by a processor, a PIN offset using the second PIN and the random account data;
- (e) repeating steps (a) through (d) for each PIN character of the PIN;
- (f) creating a combined PIN offset using each of the PIN offsets created in step (d);
- and
- (g) creating an encrypted PIN block using information associated with the account, the random account data, and the combined PIN offset.
Dependencies are inferred from the claim text.