Block, Inc.

Square, Inc.

Janek Klawe

Dino Dai Zovi

Richard Neal Harris

Systems and methods directed to a payment server updating test criteria for an attestation routine, comprising receiving a request for attesting security of a payment terminal, generating an attestation routine comprising test criteria, sending the attestation routine to the payment terminal, and receiving attestation data based on execution of the attestation routine. Then, based at least in part on the attestation data and payment transaction data, the payment server determines indications of fraudulent transactions or tamper attempts, stores the indications in association with the attestation data and the payment transaction, receives feedback data including that one or more payment transactions were improperly denied or improperly accepted, and stores the feedback data in association with the payment transaction data. Based at least in part on the indications and the feedback data, the test criteria is updated and an updated attestation routine comprising the updated test criteria is generated.

Logical validation of devices against fraud and tampering

Disclosed herein is a method and system to determine whether a payment terminal has been tampered with based on a comparison of attestation data received from the payment terminal, for example in an offline mode when an otherwise secure remote server cannot be reached. If the determination yields that the request has been approved, the terminal generates an attestation ticket having one or more validity conditions, wherein the validity conditions include expiration time that indicates the time after which the attestation ticket becomes invalid. The attestation ticket can be used as long as it is valid or until another trigger causes the ticket to be invalidated or regenerated.

This disclosure is directed to receiving a request for attesting security of a device, determining to approve the request based on attestation data associated with the device, generating a ticket having validity conditions, and sending the ticket to the device to enable the device to receive payment data from a second device.

Disclosed herein is a method and system to establish a secure communication channel between a payment object reader and a payment terminal For this, the server determines whether a payment terminal has associated with an attestation ticket. The method further includes determining, whether to approve or deny the request for establishing the secure communication channel between the payment object reader and the payment terminal based on the attestation ticket. If the determination yields that the request has been approved, further generating a session approval interrupt having one or more session approval conditions; and sending the session approval interrupt to the payment terminal, where the session approval interrupt causes a secure communication channel to be established between the payment object reader and the payment terminal.

Methods, systems, and apparatus, including computer programs encoded on a computer storage medium, for storing a plurality of stored fingerprints, wherein each of the stored fingerprints is associated with a respective software environment and a respective mobile device; receiving from a first mobile device a first fingerprint of a first software environment in the first mobile device; determining whether the stored fingerprints include less than a threshold amount of fingerprints identical to the first fingerprint; based on a determination that the stored fingerprints include less than the threshold amount of fingerprints identical to the first fingerprint, determining that the first software environment is a compromised software environment; and performing a corrective measure.

Data security measures for mobile devices

Disclosed herein is a method and system to determine whether a payment terminal has been tampered with based on a comparison of attestation data received from the payment terminal. If the determination yields that the request has been approved, the terminal generates an attestation ticket having one or more validity conditions, wherein the validity conditions include expiration time that indicates the time after which the attestation ticket becomes invalid. The attestation ticket can be used as long as it is valid or until another trigger causes the ticket to be invalidated or regenerated.

Growing community of inventors

New York, NY, United States of America

Janek Klawe