Secure Session Validation Between Card Reader and Mobile POS
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing mobile payment systems face security challenges in protecting customer PINs and credit card data from unauthorized access, particularly due to the vulnerability of mobile devices to malware and the need for secure communication sessions between card readers and mobile devices.
Innovation Solution
A trusted remote validation system verifies the security of both the card reader and POS module in the mobile device before establishing an encrypted communication session, using cryptographic keys and additional security information to ensure trustworthiness, and generates a shared secure session key for encrypted data exchange.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a mobile device is used to facilitate credit card transactions with a card reader, then convenience and ease of use are improved, but security vulnerabilities arise due to potential malware and unauthorized access
Solution Approach 1:
A secure communication session is established as an intermediary layer between the card reader and POS software, using encrypted channels to protect transaction data and PINs from malware and unauthorized access while maintaining mobile payment convenience
Solution Approach 2:
Security validation is performed preliminarily by verifying the integrity of the POS software and establishing secure communication parameters before actual transaction processing begins, ensuring security measures are in place before sensitive data is handled
2Adaptability or versatility
If PIN input and card data reading are implemented in the mobile device, then transaction functionality is improved, but exposure to unauthorized access and malware increases
Solution Approach 1:
Encrypted communication channels act as intermediaries that protect PINs and card data during transmission between the mobile device and card reader, preventing malware from intercepting sensitive information even though the device handles transaction processing
Solution Approach 2:
The system performs preliminary security validations and establishes secure communication parameters before processing transaction data, creating protective measures that counteract potential malware threats before they can compromise the system
3Reliability
If security validation and secure session establishment are implemented, then data protection is improved, but system complexity increases
Solution Approach 1:
The secure communication session framework provides multiple security functions (encryption, validation, authentication) through a unified interface that works across different transaction types and devices, managing complexity through standardized multi-functional protocols
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Disclosed is a technique for establishing a secure communication session between a mobile device and a card reader. The technique can involve using a trusted, remote validation server to validate security information of both the card reader and a POS module in the mobile device prior to, and as a precondition of, the card reader and the POS module establishing a secure communication session with each other. In certain embodiments the POS module sends the security information of both the card reader and the POS module to the validation server. The security information can include cryptographic keys of the POS module and the card reader and additional security information related to the POS module and its software environment.