Portable terminal
View Patent ↗A portable terminal ( 10 ) for encrypting information is described. The terminal ( 10 ) generates a new key for each transaction, where the new key is generated using one or more properties of the terminal ( 10 ). The one or more properties are variable and may include the history of usage of the terminal, and/or the date and time settings. The terminal ( 10 ) may generate a unique challenge in addition to the new key so that a unique challenge can be issued for each transaction. A method of encrypting information in a portable terminal, a method of communicating encrypted information between a portable terminal and a self-service terminal, and a transaction system comprising a self-service terminal ( 52 ) and a portable terminal ( 10 ) are also described.
1. A method of operating a portable computer, comprising:
a) storing records of events experienced by the computer in user-accessible memory within the computer;
b) using one or more of the records as seed for generating plain text of a first session key K 1 , wherein
(A) a hashing algorithm is applied to the seed to provide a hashed value which is split into two portions and
(B) the two portions are processed to provide K 1 ; and then
c) encrypting K 1 , transmitting K 1 (encrypted) to an external terminal, receiving an encrypted response from the external terminal, and de-crypting the encrypted response using the plain text of K 1 .
2. Method according to claim 1 , and further comprising:
d) repeating processes of paragraphs (a) and (b) to produce a second session key K 2 , different from the first session key K 1 ; and
e) using K 2 in a transaction with an external terminal.
3. Method according to claim 1 , wherein the records used as seed include at least one element selected from the following group:
1) recorded button selections,
2) recorded pointer movements,
3) recorded data entered by a user,
4) current date setting, and
5) current time setting.
4. Method according to claim 1 , wherein the portable computer requires entry of a Personal Identification Number, PIN, prior to generation of the encryption key, and will not complete the transaction without the PIN.
5. A method, comprising:
a) using a portable computer to
i) generate a first session key K 1 , based on one or more seeds derived from data contained in user-accessible memory, wherein
(A) a hashing algorithm is applied to the one or more seeds to provide a hashed value which is split into two portions and
(B) the two portions are processed to provide K 1 ;
ii) encrypt K 1 into K 1 (encrypted), using a public key PK;
iii) transmitting K 1 (encrypted) to an external terminal in connection with a first transaction;
b) using the portable computer to
i) generate a second session key K 2 , based on one or more seeds derived from data contained in user-accessible memory, wherein
(A) a hashing algorithm is applied to the one or more seeds to provide a hashed value which is split into two portions and
(B) the two portions are processed to provide K 2 ;
ii) encrypt K 2 into K 2 (encrypted), using a the public key PK;
iii) transmitting K 2 (encrypted) to an external terminal in connection with a second transaction.
6. Method according to claim 5 , wherein the data from which as the seeds are derived include at least one element selected from the following group:
1) recorded button selections,
2) recorded pointer movements,
3) recorded data entered by a user,
4) current date setting, and
5) current time setting.
7. Method according to claim 5 , and further comprising:
c) in connection with the first transaction,
i) receiving into the portable computer an encrypted message EM 1 from the external terminal, and
ii) de-crypting EM 1 using K 1 .
8. Method according to claim 7 , and further comprising:
d) in connection with the second transaction,
i) receiving into the portable computer an encrypted message EM 2 from the external terminal, and
ii) de-crypting EM 2 using K 2 .
9. Method according to claim 7 , wherein the portable computer requires entry of a Personal Identification Number, PIN, prior to encryption, and will not complete the transaction without the PIN.
10. Method according to claim 5 , wherein the portable computer requires entry of a Personal Identification Number, PIN, prior to generation of the encryption key, and will not complete the transaction without the PIN.
11. A method, comprising:
a) maintaining a commercially available Personal Digital Assistant, PDA, which has no secure area for storing an encryption key usable to encrypt outgoing data; and
b) using the PDA for encryption and transmission of a message to an external controller in connection with a financial transaction, wherein the encryption comprises deriving a seed from data stored in user-accessible memory; and deriving a session key from said seed, which session key is used in the financial transaction, and not used thereafter, wherein
(A) a hashing algorithm is applied to the seed to provide a hashed value which is split into two portions and
(B) the two portions are processed to provide the session key.
12. Apparatus, comprising:
a) a portable computer having
i) no secure area for storing an encryption key used to encrypt outgoing data;
ii) system memory, all of which is accessible to a user of the computer; and
iii) data stored in the system memory, which data changes over time;
b) means for
i) utilizing selected changing data in the system memory as a seed for generating a session key K 1 , wherein
(A) a hashing algorithm is applied to the seed to provide a hashed value which is split into two portions and
(B) the two portions are processed to provide K 1 ;
ii) encrypting K 1 into K 1 (encrypted); and
iii) transmitting K 1 (encrypted) to an external terminal.
13. Apparatus according to claim 12 , wherein the data used as the seed includes at least one element selected from the following group:
1) recorded button selections,
2) recorded pointer movements,
3) recorded data entered by a user,
4) current date setting, and
5) current time setting.
14. Apparatus according to claim 13 , and further comprising:
c) means for
i) receiving an encrypted message from the external terminal, and
ii) de-crypting the encrypted message using K 1 .
15. A portable computer, comprising:
a) means for storing records of events experienced by the computer in user-accessible memory within the computer;
b) means for using one or more of the records as a seed for generating an encryption key, wherein
(A) a hashing algorithm is applied to the seed to provide a hashed value which is split into two portions and
(B) the two portions are processed to provide the encryption key; and
c) means for using the encryption key in a transaction with an external terminal.
16. Method according to claim 15 , wherein the records used as the seed include at least one element selected from the following group:
1) recorded button selections,
2) recorded pointer movements,
3) recorded data entered by a user,
4) current date setting, and
5) current time setting.
17. A method, comprising:
a) storing records of events experienced by a portable computer in user-accessible memory within the computer;
b) using one or more of the records as a seed for generating a session key K 1 , wherein
(A) a hashing algorithm is applied to the seed to provide a hashed value which is split into two portions and
(B) the two portions are processed to provide K 1 ;
c) encrypting K 1 into K 1 (encrypted) using a public key;
d) transmitting K 1 (encrypted) to an external terminal;
e) at the external terminal, decrypting K 1 (encrypted) into K 1 ;
f) encrypting a message M into M(encrypted) using K 1 as key;
g) transmitting M(encrypted) to the portable computer; and
h) decrypting M(encrypted) using K 1 within the portable computer.