Abstract: Methods and systems related to near field communication (NFC) front ends for point of sale terminals are disclosed. One point of sale system includes an applications microprocessor programmed to: (i) instantiate an operating system for the point of sale system and (ii) generate a set of data packets. The system also includes a discrete microcontroller communicatively coupled with the applications microprocessor and programmed to: (i) selectively operate in an unsecure mode and a secure mode; and (ii) filter, when operating in the unsecure mode, the set of data packets received from the applications microprocessor using a filter and a whitelist for the filter. The system also includes a near field communication front end communicatively coupled to the discrete microcontroller and an antenna, for transmitting a near field communication signal based on information from the set of data packets via the antenna.

Abstract: Methods and systems for processing secure information are disclosed. One method includes receiving secure data from a user via an input device. The method also includes routing the secure data to a secure processor using a hardware multiplexer. The method also includes processing the secure data using the secure processor. The method also includes receiving non-secure data from the user via the input device. The method also includes routing the non-secure data to a second processor using the hardware multiplexer. The method also includes processing the non-secure data using the second processor. The method also includes altering a routing state of the hardware multiplexer using the secure processor. The routing state of the hardware multiplexer is only controlled by the secure processor.

Abstract: A computer-implemented method for an extensible point-of-sale device is disclosed. The method includes registering a third-party application to be notified of a transaction change on the point-of-sale device. The method also includes displaying a user interface to a user during a purchase transaction on a display of the point-of-sale device using one of a register module and a payment module. The method also includes receiving the transaction change via the user interface of the point-of-sale device. The method also includes broadcasting the transaction change to a set of registered applications that includes the third-party application. The method also includes taking an action that modifies the purchase transaction using the third-party application in response to the broadcasting.

Abstract: Methods and systems related to near field communication (NFC) front ends for point of sale terminals are disclosed. One point of sale system includes an applications microprocessor programmed to: (i) instantiate an operating system for the point of sale system and (ii) generate a set of data packets. The system also includes a discrete microcontroller communicatively coupled with the applications microprocessor and programmed to: (i) selectively operate in an unsecure mode and a secure mode; and (ii) filter, when operating in the unsecure mode, the set of data packets received from the applications microprocessor using a filter and a whitelist for the filter. The system also includes a near field communication front end communicatively coupled to the discrete microcontroller and an antenna, for transmitting a near field communication signal based on information from the set of data packets via the antenna.

Abstract: A dual mode payment interface device has a touch display and alternatively operates in a first mode and a second mode. The first mode provides access to a merchant system interface (MSI) on the touch display and provides access to a customer system interface (CSI) on the touch display. The second mode provides access to a CSI on the touch display and does not provide access to the MSI on the touch display. The system also includes a merchant display device having a second touch display. The merchant display device provides access to the MSI on the second touch display. The system also includes a wire that provides a communicative connection between the dual mode payment interface device and the merchant display device. The second mode is enabled by the communicative connection.

Abstract: This disclosure includes biometrically secured networked devices with enhanced privacy protection. One system includes a first biometrically secured device having a first sensor, and a second biometrically secured device having a second sensor. The first device is programmed to: (i) obtain a first sample of a first biometric using the first sensor; (ii) generate a secret biometrically derived key using the first sample of the first biometric; (iii) encrypt a set of biometric data using the secret biometrically derived key; and (iv) transmit the set of encrypted biometric data to the second biometrically secured device. The second device is programmed to: (i) obtain a second sample of the first biometric using the second sensor; (ii) generate the secret biometrically derived key using the second sample of the first biometric; and (iii) decrypt the set of biometric data using the secret biometrically derived key.

Abstract: A computer-implemented method for an extensible point-of-sale device is disclosed. The method includes registering a third-party application to be notified of a transaction change on the point-of-sale device. The method also includes displaying a user interface to a user during a purchase transaction on a display of the point-of-sale device using one of a register module and a payment module. The method also includes receiving the transaction change via the user interface of the point-of-sale device. The method also includes broadcasting the transaction change to a set of registered applications that includes the third-party application. The method also includes taking an action that modifies the purchase transaction using the third-party application in response to the broadcasting.

Abstract: An external biometric reader and verification device for providing access control to a computing device, and associated methods, are disclosed. The external reader can store and verify biometrics under the control of the computing device and send identity verification messages to the computing device. One disclosed device includes a biometric reader communicatively connected to an external secure microcontroller. The external secure microcontroller stores a set of biometric data and a signing key. The signing key can be injected by a device manufacturer in a controlled key injection room in a manufacturing facility and can be used to sign a certificate. An operating system of the computing device can be programmed to send a request for the certificate, receive the certificate, and predicate control of access to the operating system using the verification messages on verification of the certificate.

Abstract: Apparatuses and methods associated with a dual mode system are disclosed herein. One disclosed system includes a dual mode payment interface device having a touch display and alternatively operating in a first mode and a second mode. The first mode provides access to a merchant system interface (MSI) on the touch display and provides access to a customer system interface (CSI) on the touch display. The second mode provides access to a CSI on the touch display and does not provide access to the MSI on the touch display. The system also includes a merchant display device having a second touch display. The merchant display device provides access to the MSI on the second touch display. The system also includes a wire that provides a communicative connection between the dual mode payment interface device and the merchant display device. The second mode is enabled by the communicative connection.

Abstract: A dual mode payment interface device has a touch display and alternatively operates in a first mode and a second mode. The first mode provides access to a merchant system interface (MSI) on the touch display and provides access to a customer system interface (CSI) on the touch display. The second mode provides access to a CSI on the touch display and does not provide access to the MSI on the touch display. The system also includes a merchant display device having a second touch display. The merchant display device provides access to the MSI on the second touch display. The system also includes a wire that provides a communicative connection between the dual mode payment interface device and the merchant display device. The second mode is enabled by the communicative connection.

Abstract: Methods and systems related to the use of tokenization services in payment processing systems are disclosed. The methods and systems include token translation services, token maps used as the basis for customer data models, specific approaches for securing the token maps and associated data, and the efficient storage of the token maps and associated data to facilitate enhanced payments experiences and analytics. One method includes transmitting a tokenization request with an encrypted payment account number from a POS to a tokenization service, receiving a token from the tokenization service in response to the tokenization request, salting the token with data to produce a salted token, encrypting the salted token using a secure processor on the POS, mapping the encrypted salted token to the payment account number in a map, and storing the map and the encrypted salted token in a memory on the secure processor on the POS.

Abstract: Methods and systems related to the use of tokenization services in payment processing systems are disclosed. The methods and systems include token translation services, token maps used as the basis for customer data models, specific approaches for securing the token maps and associated data, and the efficient storage of the token maps and associated data to facilitate enhanced payments experiences and analytics. One method includes transmitting a tokenization request with an encrypted payment account number from a POS to a tokenization service, receiving a token from the tokenization service in response to the tokenization request, salting the token with data to produce a salted token, encrypting the salted token using a secure processor on the POS, mapping the encrypted salted token to the payment account number in a map, and storing the map and the encrypted salted token in a memory on the secure processor on the POS.

Abstract: Methods and systems related to distributing payment keys to multiple discrete devices in a point of sale (POS) system are disclosed. One method includes storing a payment key on a first discrete device for a POS system and a public key certificate on a second discrete device for the POS system. The method also includes communicatively connecting the first discrete device with the second discrete device using a wire, transmitting the public key certificate from the second discrete device to the first discrete device using the wire, and verifying the public key certificate on the first discrete device. The method also includes finalizing a secure connection between the first discrete device and the second discrete device over the wire using a protocol after the public key certificate is verified.

Abstract: Methods and systems related to near field communication (NFC) front ends for point of sale terminals are disclosed. One point of sale system includes an applications microprocessor programmed to: (i) instantiate an operating system for the point of sale system and (ii) generate a set of data packets. The system also includes a discrete microcontroller communicatively coupled with the applications microprocessor and programmed to: (i) selectively operate in an unsecure mode and a secure mode; and (ii) filter, when operating in the unsecure mode, the set of data packets received from the applications microprocessor using a filter and a whitelist for the filter. The system also includes a near field communication front end communicatively coupled to the discrete microcontroller and an antenna, for transmitting a near field communication signal based on information from the set of data packets via the antenna.

Abstract: Systems and methods for provisioning secure terminals for secure transactions are disclosed herein. A disclosed method includes generating a key using a key generator element on a secure terminal and sending a key validation request for the key from the secure terminal to a provisioning device. The method also includes parsing the key validation request and generating a key validation for the key and a trusted time stamp on the provisioning device. The method also includes sending, from the provisioning device, the key validation and the trusted time stamp to the secure terminal. The method also includes setting a clock on the secure terminal using the trusted time stamp and storing the key validation at the secure terminal.

Abstract: Embodiments of the present invention enable near field communication (NFC) through a touch display. Some embodiments include specialized touch displays with lower electromagnetic dissipation factors than standard touch displays. Some embodiments include methods and devices for detecting the activation or deactivation of NFC communication using the touch display and adapting the touch display to that activation or deactivation. Disclosed techniques for adapting the touch display include optimizing the behavior of the touch display for operation in the face of electromagnetic interference when NFC is activated and conducting a partial recalibration of the touch display when NFC is deactivated.

Abstract: Methods and systems related to near field communication (NFC) front ends for point of sale terminals are disclosed. One point of sale system includes an NFC front end communicatively coupled to an antenna, a discrete microcontroller (DM) communicatively coupled thereto, and an applications microprocessor (AP) communicatively coupled to the DM. The DM stores a first software stack for a first NFC protocol, a second software stack for a second NFC protocol, and instructions to process a digitized NFC signal from the NFC front end with the first software stack. The AP stores instructions to instantiate an operating system for the point of sale system, instantiate a master NFC service, and transmit a remote procedure call from the master NFC service to the DM to switch between the first software stack and the second software stack.

Abstract: Systems, and associated methods, involving both a trusted and an untrusted device where sensitive data or keys are shared between those devices are disclosed. A disclosed method includes storing a key in a secure memory on a first device, receiving sensitive data via a user interface on a second device, generating a set of white box encryption instructions based on the key using a white box encryption generator on the first device, generating a complete data representation of the set of white box encryption instructions using a secure processor on the first device, transmitting the complete data representation from the first device to the second device, and encrypting the sensitive data using the complete data representation on the second device. The complete data representation is not Turing complete and is not executable with respect to the second device.

Abstract: Methods and systems related to provisioning a secure connection are disclosed. One disclosed method includes storing a device secret on a secure element in a first device, storing a mapping from the device secret to a device identifier of the first device on a cloud architecture, generating a pairing key using a first connection protocol key generator on the secure element and the device secret, and generating the pairing key using a second connection protocol key generator on the cloud architecture and the device secret. The method also includes transmitting the pairing key from the cloud architecture to a second device in response to receiving the device identifier, mutually authenticating the first and second device using the pairing key, and adding the secure connection to the inter-device connection using the pairing key as stored on the first device and as stored on the second device.