Secure remote payment transaction processing using a secure element

Patent metadata

Field	Value
Publication number	US-9646303-B2
Application number	US-201414461227-A
Country	US
Kind code	B2
Filing date	Aug 15, 2014
Priority date	Aug 15, 2013
Publication date	May 9, 2017
Grant date	May 9, 2017

Abstract

Embodiments of the present invention are directed to methods, apparatuses, computer readable media and systems for securely processing remote transactions. One embodiment of the invention is directed to a method of processing a remote transaction initiated by a mobile device. The method comprises receiving, by a mobile payment application on a secure memory of the mobile device, transaction data from a transaction processor application on the mobile device. The method further comprises validating that the transaction processor application is authentic and in response to validating the transaction processor application, providing encrypted payment credentials to the transaction processor application. The transaction processor application further initiates a payment transaction with a transaction processor server computer using the encrypted payment credentials.

First claim

What is claimed is:

1. A method of processing a remote transaction initiated by a mobile device, the method comprising:
receiving, by a mobile payment application on a secure memory of the mobile device, transaction data and a transaction processor certificate from a transaction processor application stored on the mobile device outside of the secure memory;
determining, by the mobile payment application, that the transaction processor application is authentic;
extracting, by the mobile payment application, a transaction processor public key from the transaction processor certificate;
determining, by the mobile payment application, payment credentials stored in the secure memory;
encrypting, by the mobile payment application, the payment credentials using the extracted transaction processor public key;
based on a determination that the transaction processor application is authentic, transmitting by the mobile payment application, the encrypted payment credentials to the transaction processor application; and
transmitting, by the transaction processor application, the encrypted payment credentials to a transaction processor server computer in communication with the mobile device,
wherein the encrypted payment credentials are used to process a payment transaction.

2. The method of claim 1 , wherein determining that the transaction processor application is authentic further comprises:
verifying, by the mobile payment application, that the transaction processor certificate is currently valid with a certificate authority; and
validating, by the mobile payment application, that the transaction processor certificate is authentic using a certificate authority public key.

3. The method of claim 1 , wherein the transaction processor server computer decrypts the payment credentials using a transaction processor private key and generates an authorization request message using the decrypted payment credentials.

4. The method of claim 1 , wherein the transaction processor application is a merchant application and the transaction processor server computer is a merchant server computer.

5. The method of claim 2 , wherein the certificate authority is associated with a payment processing network.

6. The method of claim 2 , wherein the method further comprises:
determining, by the mobile payment application, that the transaction processor certificate is not currently valid with the certificate authority; and
updating, by the mobile payment application, the transaction processor certificate with the certificate authority.

7. The method of claim 1 , wherein the method further comprises:
generating, by the mobile payment application, a dynamic value using a shared algorithm that is also used by a payment processing network or an issuer, wherein the dynamic value is validated by the payment processing network or the issuer during transaction processing.

8. The method of claim 1 , wherein the encrypted payment credentials include an encrypted account identifier and an encrypted expiration date.

9. The method of claim 3 , wherein the transaction processor public key is a merchant public key, and the transaction processor private key is a merchant private key.

10. A mobile device comprising:
a processor;
a computer-readable medium coupled to the processor, the computer-readable medium comprising a transaction processor application;
a secure processor; and
a secure computer-readable medium coupled to the secure processor, the secure computer-readable medium comprising code, executable by the secure processor, for performing a method of processing a remote transaction, the method comprising the steps of:
receiving transaction data and a transaction processor certificate from the transaction processor application on the mobile device;
determining that the transaction processor application is authentic;
extracting, by the mobile payment application, a transaction processor public key from the transaction processor certificate;
determining, by the mobile payment application, payment credentials stored in the secure memory;
encrypting, by the mobile payment application, the payment credentials using the extracted transaction processor public key;

based on a determination that the transaction processor application is authentic, transmitting the encrypted payment credentials to the transaction processor application; and
transmitting the encrypted payment credentials to a transaction processor server computer in communication with the mobile device,
wherein the encrypted payment credentials are used to process a payment transaction.

11. The mobile device of claim 10 , wherein determining that the transaction processor application is authentic further comprises the steps of:
verifying that the transaction processor certificate is currently valid with a certificate authority; and
validating that the transaction processor certificate is authentic using a certificate authority public key.

12. The mobile device of claim 10 , wherein the transaction processor application is a merchant application and the transaction processor server computer is a merchant server computer.

13. The mobile device of claim 10 , wherein the transaction processor server computer decrypts the payment credentials using a transaction processor private key and generates an authorization request message using the decrypted payment credentials.

14. The method of claim 1 wherein transmitting comprises transmitting the encrypted payment credentials from the mobile device to the transaction processor server computer over a cellular network.

15. The method of claim 14 wherein the encrypted payment credentials comprise a token that is encrypted, the token being a substitute for a primary account number.

16. The method of claim 1 wherein the secure memory is a secure element that stores a secret key that is only known to a trusted service manager.

Assignees

• Karpenko Igor
• Makhotin Oleg
• Pirzadeh Kiushan
• Powell Glenn
• Sheets John
• Wong Erick
• Visa Int Service Ass

Inventors

• Karpenko Igor
• Makhotin Oleg
• Pirzadeh Kiushan
• Powell Glenn
• Sheets John
• Wong Erick

Classifications

• G06Q20/367

  involving electronic purses or money safes · CPC title

• H04L9/0825

  using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates · CPC title

• G06Q20/3825

  Use of electronic signatures · CPC title

• G06Q20/3227

  using secure elements embedded in M-devices · CPC title

• G06Q20/38215 Primary

  Use of certificates or encrypted proofs of transaction rights · CPC title