Establishment of a secure session between a card reader and a mobile device
View Patent ↗Disclosed is a technique for establishing a secure communication session between a mobile device and a card reader. The technique can involve using a trusted, remote validation server to validate security information of both the card reader and a POS module in the mobile device prior to, and as a precondition of, the card reader and the POS module establishing a secure communication session with each other. In certain embodiments the POS module sends the security information of both the card reader and the POS module to the validation server. The security information can include cryptographic keys of the POS module and the card reader and additional security information related to the POS module and its software environment.
1. A method comprising:
detecting, by a point-of-sale (POS) software module that executes in a mobile device, initiation of a session between the POS software module and a mobile card reader coupled to the mobile device;
receiving, by the POS software module in the mobile device, from the mobile card reader, security related information of the mobile card reader;
causing, by the POS software module in the mobile device, the security related information of the mobile card reader and security related information of the POS software module to be transmitted from the mobile device to a remote computer system;
receiving, by the POS software module in the mobile device, an indication that the security related information of the POS software module and the security related information of the mobile card reader have been validated by the remote computer system;
determining, by the POS module in the mobile device, that the indication includes a cryptographic key of the POS software module, signed by the remote computer;
based on a determination that the indication includes a cryptographic key of the POS software module, signed by the remote computer, sending the cryptographic key of the POS software module, signed by the remote computer, by the POS software module to the mobile card reader,
generating, by the POS software module in the mobile device, in cooperation with the mobile card reader, a secure session key;
determining, by the POS software module in the mobile card reader, that a digital signature of the remote computer has been validated by the mobile card reader; and
based on a determination that the digital signature of the remote computer has been validated by the mobile card reader, performing encrypted communication with the mobile card reader by using the generated secure session key.
2. A method as recited in claim 1 , further comprising, during a financial transaction involving a payment card of a customer:
encrypting, by the POS software module, a personal identification number (PIN) of the customer by using the secure session key; and
sending the encrypted PIN from the POS software module to the mobile card reader.
3. A method as recited in claim 1 , wherein generating the secure session key comprises using a Diffie-Hellman message exchange to generate the secure session key.