Systems and methods for provisioning point of sale terminals
A provisioning system is provided for terminals such as point of sale terminals. An interface device interfaces with a smart card and a provisioning server, providing initialization keys and security codes that are stored on the smart card. At a terminal, an initialization key from the smart card may be provided to the terminal if a correct security code is entered at the terminal. The terminal may then provide a terminal authorization package to the smart card. The terminal authorization package is stored on the smart card. At the interface device, the terminal authorization package is provided to the provisioning server. The terminal may then securely communicate transactions with an issuer server.
1 . An initialization device comprising:
a card reader configured to interface with a smart card;
a network interface configured to communicate with a provisioning server; and
a processor configured to establish a secure channel between the smart card and the provisioning server, receive one or more initialization keys from the provisioning server, transmit the one or more initialization keys to the smart card, and transmit one or more security codes to the smart card,
wherein the one or more initialization keys enable the smart card to provision a point of sale terminal prior to deployment of the point of sale terminal for secure processing of transactions.
2 . The initialization device of claim 1 , wherein the secure channel is established based on a previously configured key stored at the smart card.
3 . The initialization device of claim 1 , wherein the network interface comprises an intermediate computing device, wherein the intermediate computing device is in communication with the initialization device via a short range communication interface and with the provisioning server via a network.
4 . The initialization device of claim 3 , wherein the short range communication interface is a wireless interface.
5 . The initialization device of claim 3 , wherein the short range communication interface is a wired interface.
6 . The initialization device of claim 1 , wherein the processor is configured to receive a terminal authorization package from the smart card and transmit the terminal authorization package to the provisioning server.
7 . The initialization device of claim 6 , wherein the terminal authorization package is signed based on a private key of the smart card.
8 . The initialization device of claim 1 , wherein the provisioning server comprises a hardware security module (HSM), and wherein the secure channel is established between the smart card and the HSM of the provisioning server.
9 . The initialization device of claim 1 , wherein the processor is configured to transmit an initialization counter value to the smart card.
10 . The initialization device of claim 1 , further comprising an input device configured to receive the one or more security codes, wherein the processor is configured to transmit the one or more security codes to the smart card via the card reader.
11 . An initialization device comprising:
a card reader configured to interface with a smart card;
a network interface configured to communicate with a provisioning server; and
a processor configured to establish a secure channel between the smart card and the provisioning server, receive a terminal authorization package from the smart card for each point of sale terminal provisioned by the smart card and transmit the terminal authorization packages for each of the point of sale terminals provisioned by the smart card to the provisioning server.
12 . The initialization device of claim 11 , wherein each terminal authorization package is cryptographically signed by the smart card.
13 . The initialization device of claim 12 , wherein the terminal authorization package is signed based on a private key of the smart card.
14 . The initialization device of claim 12 , wherein individual components of the terminal authorization package are cryptographically signed by the smart card.
15 . The initialization device of claim 14 , wherein the individual components of the terminal authorization package include at least one of a unique identifier of the point of sale terminal or a key.
16 . The initialization device of claim 11 , wherein the network interface comprises an intermediate computing device, wherein the intermediate computing device is in communication with the initialization device via a short range communication interface and with the provisioning server via a network.
17 . The initialization device of claim 16 , wherein the short range communication interface is one of a wired interface or a wireless interface.
18 . The initialization device of claim 11 , wherein the provisioning server comprises a hardware security module (HSM), and wherein the secure channel is established between the smart card and the HSM of the provisioning server.
19 . The initialization device of claim 11 , wherein the processor is configured to receive one or more initialization keys from the provisioning server and transmit the one or more initialization keys to the smart card.
20 . The initialization device of claim 19 , further comprising an input device configured to receive one or more security codes, and wherein the processor is configured to transmit the one or more security codes to the smart card via the card reader.