System and method to protect privacy of personal-identification-number entry on consumer mobile device and computing apparatus
A system for accepting the input of a PIN comprises a first device receiving a randomized PIN layout derived on a fourth device. The randomized PIN layout is displayed on a display of the first device. A second device comprises an input for accepting a series of key presses to produce a PIN token. The PIN token indicating each of the series of key presses. A third device is in communication with the second device. The third device derives the randomized PIN layout and receives the PIN token from the second device without the PIN token being present on the first device. The third device combines the PIN layout and the PIN token to produce a PIN. The PIN is used to authenticate a transaction. The fourth and third devices each store a shared secret used to independently derive the randomized PIN layout on the fourth and third devices.
1. A system for accepting input of a PIN from a user, the system comprising:
a first device receiving a randomized PIN layout from a fourth device,
the fourth device deriving the randomized PIN layout, and
the first device displaying the randomized PIN layout on a first display of the first device to enable the user to enter a series of key presses at a second device;
the second device comprising an input for accepting the series of key presses from the user to produce a PIN token,
the PIN token indicating each of the series of key presses; and
a third device in communication with the second device,
the third device deriving the randomized PIN layout and receiving the PIN token from the second device without the PIN token being present on the first device,
the third device combining the PIN layout and the PIN token to produce a PIN, and
the PIN being used to authenticate a transaction.
2. The system of claim 1 wherein the fourth device is in communication with the third device, the fourth device and the third device each storing a shared secret, the shared secret used to independently derive the randomized PIN layout on the fourth device and the third device.
3. The system of claim 1 wherein the third device is located remotely from the first and second device.
4. The system of claim 1 wherein the first device and the second device comprise a transaction authentication system, the transaction being used to authenticate the veracity of a point of sale terminal.
5. The system of claim 4 wherein the transaction authentication system is used to accept payments from a customer payment device.
6. A system for accepting input of a PIN from a user, the system comprising:
a first device receiving a randomized PIN layout from a fourth device,
the fourth device deriving the randomized PIN layout, and
the first device displaying the randomized PIN layout on a first display of the first device to enable the user to enter a series of key presses at a second device;
a second device comprising an input for accepting the series of key presses from the user to produce a PIN token,
the PIN token indicating each of the series of key presses; and
a third device in communication with the second device and the fourth device,
the third device receiving the randomized PIN layout from the fourth device and receiving the PIN token from the second device without the PIN token being present on the first device,
the third device combining the PIN layout and the PIN token to produce a PIN, and
the PIN being used to authenticate a transaction.
7. The system of claim 6 wherein the third device is located remotely from the first and second device.
8. The system of claim 6 wherein the first device and the second device comprise a transaction authentication system, the transaction being used to authenticate the veracity of a point of sale terminal.
9. The system of claim 8 wherein the transaction authentication system is used to accept payments from a customer payment device.
10. A system for accepting input of a PIN from a user, the system comprising:
a first device receiving a randomized PIN layout from a third device,
the third device deriving the randomized PIN layout, and
the first device displaying the randomized PIN layout on a first display of the first device to enable the user to enter a series of key presses at a second device;
a second device comprising an input for accepting the series of key presses from the user to produce a PIN token,
the PIN token indicating each of the series of key presses; and
the third device in communication with the second device,
the third device receiving the PIN token from the second device without the PIN token being present on the first device,
the third device combining the PIN layout and the PIN token to produce a PIN, and
the PIN being used to authenticate a transaction.
11. The system of claim 10 wherein the third device is located remotely from the first and second device.
12. The system of claim 10 wherein the first device and the second device comprise a transaction authentication system, the transaction being used to authenticate the veracity of a point of sale terminal.
13. The system of claim 12 wherein the transaction authentication system is used to accept payments from a customer payment device.
14. A method for authenticating a purchase on a point of sale terminal, the method comprising:
displaying a randomized PIN layout on a first device,
the first device receiving the randomized PIN layout from a fourth device,
the fourth device deriving the randomized PIN layout,
the first device displaying the randomized PIN layout on a first display of the first device to enable a user to enter a series of key presses at a second device;
accepting, at an input of the second device, the series of key presses;
producing, by the second device, a PIN token based on said accepted series of key presses,
the PIN token indicating each of the series of key presses; and
receiving the PIN token from the second device at a third device without the PIN token being present on the first device,
the third device deriving the randomized PIN layout,
the third device combining the PIN layout and the PIN token to produce a PIN, and
the PIN being used to authenticate a transaction.
15. The method of claim 14 wherein the transaction is used to authenticate the veracity of the point of sale terminal.
16. The method of claim 14 wherein the transaction is used to authenticate a payment to complete the purchase.
17. The method of claim 14 wherein the third device and the fourth device derive the randomized PIN layout using a common shared secret.