Method of data transmission, corresponding device, system and computer program

Patent metadata

Field	Value
Publication number	US-11868992-B2
Application number	US-201716074989-A
Country	US
Kind code	B2
Filing date	Jan 27, 2017
Priority date	Feb 2, 2016
Publication date	Jan 9, 2024
Grant date	Jan 9, 2024

Abstract

A method for transmitting data, implemented within a secured execution environment of an electronic device, called a trusted component, which is coupled to a cash register. The method includes transmitting, by using a payment terminal, a piece of data intended for cash register. The method includes, prior to transmitting the data: receiving, from the cash register, a first request for setting up a first secured communications channel with the trusted component; setting up the first secured communications channel by using at least one piece of data contained in the first request; receiving, from the payment terminal, a second request for setting up a second secured communications channel with the trusted component; and setting up the second secured communications channel with the payment terminal by using at least one piece of data of the second request.

First claim

The invention claimed is:

1. A method for securing transmission of data, implemented within a secured execution environment of an electronic device, called a trusted component, said trusted component being coupled to a cash register of a merchant, said method for transmitting data comprising the following acts performed by a secured processor of the trusted component executing a trust application:
receiving, from the cash register, a first request for setting up a first secured communications channel with said trusted component, the first request comprising an identifier of said cash register, cyphered by the cash register with a key of said trusted component;
in response to receiving the first request, the trusted component setting up said first secured communications channel between the trusted component and the cash register by using at least said identifier of said cash register contained in said first request;
receiving, through a communication interface of the cash register, from a payment terminal of the merchant, distinct from the cash register, a second request for setting up a second secured communications channel with said trusted component, wherein the second request corresponds to a pairing instruction, sent to the payment terminal by the cash register, wherein the pairing instruction comprises session initialization data;
in response to receiving the second request, the trusted component setting up said second secured communications channel between the trusted component and said payment terminal by using at least one piece of data contained in said second request; and
after setting up the first and second secured communications channels:
receiving a first message through the second secured communications channel established with said secure component, originating from the payment terminal and addressed to said cash register, the first message containing said session initialization data intended for the cash register,
extracting said session initialization data from the first message, and
transmitting a second message to the cash register through the first secured communications channel, the second message containing the session initialization data intended for the cash register.

2. The method for securing transmission according to claim 1 , wherein the act of setting up said first secured communications channel comprises:
extracting the identifier of said cash register from the received first request;
searching, within an authorization data structure, for a piece of data corresponding to said identifier of said cash register;

and in response to said search delivering a positive result:
pairing said cash register with said trusted component, implementing a predetermined pairing protocol.

3. The method for securing transmission according to claim 1 , wherein the act of setting up said second secured communications channel comprises:
extracting an identifier of said payment terminal from the received second request;
searching, within an authorization data structure, for a piece of data corresponding to said identifier of said payment terminal;
and in response to said search delivering a positive result:
pairing said payment terminal with said trusted component, implementing a predetermined pairing protocol.

4. The method for securing transmission according to claim 1 wherein:
receiving the first message comprises receiving a message of confirmation of pairing coming from said payment terminal, which comprises at least one first piece of encrypted pairing confirmation data;
the extracting comprises decrypting said at least one first piece of encrypted pairing confirmation data, delivering the at least one piece of pairing confirmation data;
encrypting said at least one piece of pairing confirmation data, delivering at least one second piece of encrypted pairing confirmation data;
transmitting said second message comprises transmitting said at least one second piece of encrypted pairing confirmation data to said cash register through the first secured communication channel.

5. The method for securing transmission according to claim 4 , wherein the act of receiving the first message originating from said payment terminal comprises receiving said at least one first piece of encrypted pairing confirmation data through the communication interface of said cash register, which plays a role of a relay between said payment terminal and said trusted component and relays the at least one first piece of encrypted pairing confirmation data to the trusted component.

6. An electronic device for securing transmission of data, having available a secured execution environment, called a trusted component, said trusted component being coupled with a cash register of a merchant, said trusted component comprising:
a secured processor; and
a non-transitory computer-readable medium comprising instructions of a trust application stored thereon, which when executed by the processor configure the trusted component to perform acts comprising:
receiving, from the cash register, a first request for setting up a first secured communications channel with said trusted component, the first request comprising an identifier of said cash register, cyphered by the cash register with a key of said trusted component;
in response to receiving the first request, the trusted component setting up said first secured communications channel between the trusted component and the cash register by using at least said identifier of said cash register contained in said first request;
receiving, through a communication interface of the cash register, from a payment terminal of the merchant, distinct from the cash register, a second request for setting up a second secured communications channel with said trusted component, wherein the second request corresponds to a pairing instruction, sent to the payment terminal by the cash register, wherein the pairing instruction comprises session initialization data;
in response to receiving the second request, the trusted component setting up said second secured communications channel between the trusted component and said payment terminal by using at least one piece of data contained in said second request; and
after setting up the first and second secured communications channels:
receiving a first message through the second secured communications channel established with said secure component, originating from the payment terminal and addressed to said cash register, the first message containing said session initialization data intended for the cash register,
extracting said session initialization data from the first message, and
transmitting a second message to the cash register through the first secured communications channel, the second message containing the session initialization data intended for the cash register.

7. A system comprising:
a cash register of a merchant;
a payment terminal of the merchant, said payment terminal being distinct from the cash register and configured to carry out payment operations in favor of said cash register; and
a trusted component providing a secured execution environment, said trusted component being coupled with the cash register, and said trusted component comprising:
a secured processor; and
a non-transitory computer-readable medium comprising instructions of a trust application stored thereon, which when executed by the processor configure the trusted component to perform acts comprising:
receiving, from the cash register, a first request for setting up a first secured communications channel with said trusted component, the first request comprising an identifier of said cash register, cyphered by the cash register with a key of said trusted component;
in response to receiving the fir

Assignees

• Banks And Acquirers Int Holding

Inventors

• Quentin Pierre
• Marcon Jerome

Classifications

• G06Q20/382 Primary

  insuring higher security of transaction · CPC title

• G06F21/44

  Program or device authentication · CPC title

• G06F21/602

  Providing cryptographic facilities or services · CPC title

• G06F21/606

  by securing the transmission between two devices or processes · CPC title

• G06F21/645

  using a third party · CPC title