Abstract: A retail environment having retail terminals with data entry point devices selectively encrypts input received by the data entry point devices and passes the encrypted data to a security module. The selective encryption is based on whether or not sensitive or confidential information, such as a personal identification number (PIN) associated with a debit card, is being input. To prevent hacking of the software of the retail terminal, content destined for display on the retail terminal is authenticated prior to display. In this manner, the retail terminal may be assured that confidential information is input only when desired, and thus may be encrypted only as needed.

Abstract: A security module used in a retail establishment has two zones of operation. The first zone uses a first encryption scheme between data entry point devices, such as a PIN keypad and the security module. The second zone uses a second encryption scheme between the security module and the host network computer. Both the local encryption scheme and the host encryption scheme may be selectively and independently switched from a legacy encryption scheme to a new encryption scheme to accommodate evolving encryption requirements.

Abstract: A security architecture for a retail environment providing both on-line and off-line personal identification number (PIN) validation for a smart card transaction using a reduced number of secure access modules (SAMs). In one embodiment, the retail environment includes and security module and numerous fuel dispensers each including a controller and one or more PINpads and card readers. The security module includes one or more SAMs for off-line PIN validation. Each of the PINpads communicates with the security module, and the security module performs either on-line or off-line PIN validation for every PINpad in the retail environment. Accordingly, the security module uses one set of SAMs for off-line validation for every PINpad in the retail environment.