Trusted service manager (TSM) architectures and methods

Patent metadata

Field	Value
Publication number	US-9852418-B2
Application number	US-201313794025-A
Country	US
Kind code	B2
Filing date	Mar 11, 2013
Priority date	Jun 6, 2008
Publication date	Dec 26, 2017
Grant date	Dec 26, 2017

Abstract

A client device comprises a first secure element and a second secure element. The first secure element comprises a first computer-readable medium having a payment application comprising instructions for causing the client device to initiate a financial transaction. The second secure element comprises a second computer-readable medium having a security key, a payment instrument, stored authentication data and instructions for generating a secure payment information message responsive to the payment application. The secure payment information message comprises the payment instrument and is encrypted in accordance with the security key.

First claim

What is claimed is:

1. A trusted service manager (TSM) server comprising:
a non-transitory machine-readable memory containing instructions to facilitate transactions via short message service (SMS) over a network; and
one or more hardware processors coupled to the non-transitory machine-readable memory and configured to read instructions from the non-transitory machine-readable memory to cause the TSM server to perform operations comprising:
generating a random key for a client device;
encrypting the random key using a public certificate of the client device;
transmitting, via a first encrypted channel, the random key to a crypto secure element included in the client device;
registering the client device with the TSM server via the crypto secure element by storing authentication data in the crypto secure element, the client device being registered exclusive of an app secure element that is physically separate from the crypto secure element, wherein the random key, the authentication data, and data corresponding to a payment instrument are excluded from the app secure element;
signing a payment application using a public key of the TSM server;
transmitting, via a second encrypted channel, the payment application to the app secure element of the client device;
after the transmitting the payment application to the app secure element, receiving, from the payment application, an encrypted SMS message comprising a payment certificate and an address of a service provider (SP), wherein the payment certificate is sent from the crypto secure element to the payment application in response to the crypto secure element authenticating biometric information of a user associated with the client device inputted to the crypto secure element via a secure tunnel, and wherein the SMS message from the client device is encrypted in accordance with the random key;
decrypting the SMS message using the random key and determining the address of the SP;
re-encrypting the SMS message using a second stored key corresponding to the SP; and
forwarding the re-encrypted SMS message to the SP.

2. The trusted service manager server of claim 1 , wherein the operations further comprise:
signing a second payment application using the public key of the TSM server, the second payment application corresponding to a second SP that is different from the SP; and
transmitting the second payment application to the app secure element, wherein the transmitting the payment application and the transmitting the second payment application are performed based on the registering the client device with the TSM server.

3. The trusted service manager server of claim 1 , wherein the random key is established using Diffie-Hellman (D-H) key exchange.

4. The trusted service manager server of claim 1 , wherein the encrypted SMS message is a secure SMS message addressed to the trusted service manager (TSM) and comprising the address for the service provider (SP) to which the TSM server is to forward the encrypted SMS message.

5. The trusted service manager server of claim 1 , wherein the encrypted SMS message is sent by a secure SMS, wherein when an SMS is sent, the message is encrypted using AES-256, and SHA-512 HMAC is attached.

6. The trusted service manager server of claim 1 , wherein:
the encrypted SMS message is sent by a secure SMS, wherein when an SMS is sent, the message is encrypted using AES-256, and SHA-512 HMAC is attached, and
the SHA-512 HMAC is 64 bytes in binary and truncation is used to bring data to 32 bytes of BASE-64 encoding.

7. The trusted service manager server of claim 1 , wherein:
the encrypted SMS message is sent by a secure SMS, wherein when an SMS is sent, the message is encrypted using AES-256, and SHA-512 HMAC is attached, and
a counter tags the encrypted SMS message for replay protection.

8. A method of facilitating transactions via short message service (SMS) over a network comprising:
generating, by a trusted service manager (TSM) server, a random key for a client device;
encrypting the random key using a public certificate of the client device;
transmitting, via a first encrypted channel, the random key to a crypto secure element included in the client device;
registering the client device with the TSM server via the crypto secure element by storing authentication data in the crypto secure element, the client device being registered exclusive of an app secure element that is physically separate from the crypto secure element, wherein the random key, the authentication data, and data corresponding to a payment instrument are excluded from the app secure element;
signing a payment application using a public key of the TSM server;
transmitting, via a second encrypted channel, the payment application to the app secure element of the client device;
after the transmitting the payment application to the app secure element, receiving, from the payment application, an encrypted SMS message comprising a payment certificate and an address of a service provider (SP), wherein the payment certificate is sent from the crypto secure element to the payment application in response to the crypto secure element authenticating biometric information of a user associated with the client device inputted to the crypto secure element via a secure tunnel, and wherein the SMS message from the client device is encrypted in accordance with the random key;
decrypting the SMS message using the random key and determining the address of the SP;
re-encrypting the SMS message using a second stored key corresponding to the SP; and
forwarding the re-encrypted SMS message to the SP.

9. The method of claim 8 , wherein the random key comprises AES-256 and SHA-512.

10. The method of claim 8 , wherein the random key is established using Diffie-Hellman (D-H) key exchange.

11. The method of claim 8 , wherein the encrypted SMS message is a secure SMS message addressed to the trusted service manager (TSM) server and comprising the address for the service provider (SP) to which the TSM server is to forward the encrypted SMS message.

12. The method of claim 8 , wherein the encrypted SMS message is sent by a secure SMS, wherein when an SMS is sent, the message is encrypted using AES-256, and SHA-512 HMAC is attached.

13. The method of claim 8 , wherein:
the encrypted SMS message is sent by a secure SMS, wherein when an SMS is sent, the message is encrypted using AES-256, and SHA-512 HMAC is attached, and
the SHA-512 HMAC is 64 bytes in binary and truncation is used to bring data to 32 bytes of BASE-64 encoding.

14. The method of claim 8 , wherein:
the encrypted SMS message is sent by a secure SMS, wherein when an SMS is sent, the message is encrypted using AES-256, and SHA-512 HMAC is attached, and
a counter tags the encrypted SMS message for replay protection.

15. A non-transitory machine-readable medium having stored thereon machine-readable instructions executable to cause a trusted service manager (TSM) server to perform operations comprising:
generating a random key for a client device;
encrypting the random key using a public certificate of the client device;
transmitting, via a first encrypted channel, the random key to a crypto secure element included in the client device;
registering the client device with the TSM server via the crypto secure element by storing authentication data in the crypto secure element, the client device being registered exclusive of an app secure element that is physically separate from the crypto secure element, wherein the random key, the authentication data, and data corresponding to a payment instrument are excl

Assignees

• Paypal Inc

Inventors

• Mardikar Upendra

Classifications

• G07C9/257

  electronically (G07C9/26 takes precedence) · CPC title

• G06Q20/382

  insuring higher security of transaction · CPC title

• G06Q20/3227 Primary

  using secure elements embedded in M-devices · CPC title

• G06Q20/3278

  RFID or NFC payments by means of M-devices · CPC title

• G06Q20/3829

  involving key management · CPC title