Point of sale device with secure connection between security meshes
Systems and methods involving secure connections between security meshes are disclosed herein. One disclosed device includes a first security processor located within a first security mesh, a first casing having a connector and supporting the first security mesh and the applications processor, a second security processor located within a second security mesh, and a second casing connected to the first casing via the connector and supporting the second security mesh. The first security processor and second security processor are programmed to generate a unique pre-shared key independently on both the first security processor and the second security processor using an elliptic key exchange and establish a secure connection between the first security processor and the second security processor using the unique pre-shared key.
1 . A point of sale device comprising:
a first casing housing an applications processor, a first security processor located within a first security mesh, and a first front end for receiving first information associated with a transaction;
a second casing housing a second security processor located within a second security mesh and a second front end for receiving second information associated with the transaction, wherein a secure connection is established between the first security processor and the second security processor; and
a computer readable medium housed within the first casing and accessible to the applications processor and storing instructions which, when executed by the applications processor cause the applications processor to:
in response to detecting the second security processor:
receive capabilities information from the second security processor including a secure protocol compatible with the second security processor;
adjust at least one aspect of an operating system of the applications processor based on the capabilities information;
receive a first remote procedure call (RPC) certificate signing request from the first security processor and a second RPC certificate signing request from the second security processor;
translate the first RPC certificate signing request into a first hypertext transfer protocol (HTTP) certificate signing request and the second RPC certificate signing request into a second HTTP certificate signing request;
transmit the first HTTP certificate signing request and the second HTTP certificate signing request to a certificate authority;
receive a signed first certificate from the certificate authority in response to the first certificate signing request and a signed second certificate from the certificate authority in response to the second certificate signing request; and
transmit the signed first certificate to the first security processor and the signed second certificate to the second security processor to cause the first security processor and the second security processor to each verify the signed first certificate and the signed second certificate to establish a secure connection between the first security processor and the second security processor.
2 . The point of sale device of claim 1 , wherein the first security processor and the second security processor each generate a unique pre-shared key using a key generation algorithm and information from the signed first certificate and the signed second certificate.
3 . The point of sale device of claim 1 , wherein the instructions cause the applications processor to receive the first information associated with the transaction and the second information associated with the transaction.
4 . The point of sale device of claim 2 , wherein the instructions cause the applications processor to transfer, using the secure connection, messages between the first secure processor and the second secure processor.
5 . The point of sale device of claim 4 , wherein the instructions cause the applications processor to periodically poll the second security processor for messages to the first security processor.
6 . The point of sale device of claim 4 , wherein the first security processor decrypts a message of the messages originating at the second security processor.
7 . The point of sale device of claim 6 , wherein the applications processor is unable to decrypt the message.
8 . The point of sale device of claim 7 , wherein the message includes the second information associated with the transaction received at the second front end.
9 . The point of sale device of claim 6 , wherein the first casing is capable of functioning as a separable point of sale device.
10 . The point of sale device of claim 1 , wherein the second casing includes a USB hub to facilitate a wired connection between the first security processor and the second security processor.
11 . A non-transitory, computer-readable medium housed within a first casing of a point of sale device and accessible to an applications processor of the point of sale device, the medium including storing instructions which, when executed by the applications processor cause the applications processor to:
in response to detecting a second security processor housed within a second casing of the point of sale device:
receive capabilities information from the second security processor including a secure protocol compatible with the second security processor;
adjust at least one aspect of an operating system of the applications processor based on the capabilities information;
receive a first remote procedure call (RPC) certificate signing request from the first security processor and a second RPC certificate signing request from the second security processor;
translate the first RPC certificate signing request into a first hypertext transfer protocol (HTTP) certificate signing request and the second RPC certificate signing request into a second HTTP certificate signing request;
transmit the first HTTP certificate signing request and the second HTTP certificate signing request to a certificate authority;
receive a signed first certificate from the certificate authority in response to the first certificate signing request and a signed second certificate from the certificate authority in response to the second certificate signing request;
transmit the signed first certificate to the first security processor and the signed second certificate to the second security processor to cause the first security processor and the second security processor to each verify the signed first certificate and the signed second certificate to establish a secure connection between the first security processor and the second security processor;
receive first information associated with a transaction from the first security processor; and
receive second information associated with the transaction from the second security processor.
12 . The non-transitory, computer-readable medium of claim 11 , wherein the first security processor and the second security processor each generate a unique pre-shared key using a key generation algorithm and information from the signed first certificate and the signed second certificate.
13 . The non-transitory, computer-readable medium of claim 11 , wherein the first casing houses a first front end for receiving the first information associated with the transaction, and wherein the second casing houses a second front end for receiving the second information associated with the transaction.
14 . The non-transitory, computer-readable medium of claim 12 , wherein the instructions cause the applications processor to transfer, using the secure connection, messages between the first secure processor and the second secure processor.
15 . The non-transitory, computer-readable medium of claim 14 , wherein the instructions cause the applications processor to periodically poll the second security processor for messages to the first security processor.
16 . The non-transitory, computer-readable medium of claim 14 , wherein the first security processor decrypts a message of the messages originating at the second security processor.
17 . The non-transitory, computer-readable medium of claim 16 , wherein the applications processor is unable to decrypt the message.
18 . The non-transitory, computer-readable medium of claim 17 , wherein the message includes the second information associated with the transaction.
19 . The non-transitory, computer-readable medium of claim 16 , wherein the first casing is capable of functioning as a separable point of sale device.
20 . The non-transitory, computer-readable medium of claim 11 , wherein the second casing includes a USB hub to facilitate a wired connection between the first security processor and the second security processor.