Hybrid integration of software development kit with secure execution environment
First Claim
1. A portable communication device comprising:
- one or more processor circuits; and
one or more memory units coupled to the one or more processor circuits and storing computer readable code implementing a secure application in a trusted execution environment, which when executed by the one or more processor circuits, performs operations including;
receiving, by the secure application from a mobile application executing in an application execution environment of the portable communication device, a first storage request, the first storage request including a first encrypted data type identifier and an encrypted cryptogram generation key;
decrypting, by the secure application, the first encrypted data type identifier and the encrypted cryptogram generation key using a transport key;
determining, by the secure application, that the first decrypted data type identifier indicates the first storage request is for a cryptogram generation key;
re-encrypting, by the secure application, the decrypted cryptogram generation key using a key-storage key to generate a re-encrypted cryptogram generation key;
storing the re-encrypted cryptogram generation key outside the trusted execution environment;
receiving, by the secure application from the mobile application, a cryptogram generation request, the cryptogram generation request including the re-encrypted cryptogram generation key and transaction data for a transaction, wherein the transaction data is received by the mobile application from an access device;
decrypting, by the secure application, the re-encrypted cryptogram generation key using the key-storage key;
encrypting, by the secure application, the transaction data using the decrypted cryptogram generation key to generate the transaction cryptogram; and
sending, by the secure application to the mobile application, the generated transaction cryptogram, wherein the mobile application transmits the generated transaction cryptogram to the access device to conduct the transaction.
1 Assignment
0 Petitions
Accused Products
Abstract
A portable communication device may include a mobile application executing in an application execution environment and a secure application executing in a trusted execution environment. The secure application may receive, from the mobile application, a storage request to store sensitive data. The storage request may include an encrypted data type identifier and an encrypted sensitive data. The secure application may decrypt the encrypted data type identifier and the encrypted sensitive data using a transport key, and re-encrypt the sensitive data using a storage key. The re-encrypted sensitive data can then be stored in a memory of the portable communication device which is outside the trusted execution environment.
-
Citations
20 Claims
-
1. A portable communication device comprising:
-
one or more processor circuits; and one or more memory units coupled to the one or more processor circuits and storing computer readable code implementing a secure application in a trusted execution environment, which when executed by the one or more processor circuits, performs operations including; receiving, by the secure application from a mobile application executing in an application execution environment of the portable communication device, a first storage request, the first storage request including a first encrypted data type identifier and an encrypted cryptogram generation key; decrypting, by the secure application, the first encrypted data type identifier and the encrypted cryptogram generation key using a transport key; determining, by the secure application, that the first decrypted data type identifier indicates the first storage request is for a cryptogram generation key; re-encrypting, by the secure application, the decrypted cryptogram generation key using a key-storage key to generate a re-encrypted cryptogram generation key; storing the re-encrypted cryptogram generation key outside the trusted execution environment; receiving, by the secure application from the mobile application, a cryptogram generation request, the cryptogram generation request including the re-encrypted cryptogram generation key and transaction data for a transaction, wherein the transaction data is received by the mobile application from an access device; decrypting, by the secure application, the re-encrypted cryptogram generation key using the key-storage key; encrypting, by the secure application, the transaction data using the decrypted cryptogram generation key to generate the transaction cryptogram; and sending, by the secure application to the mobile application, the generated transaction cryptogram, wherein the mobile application transmits the generated transaction cryptogram to the access device to conduct the transaction. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10)
-
-
11. A method for managing sensitive data in a portable communication device having a mobile application executing in an application execution environment and a secure application executing in a trusted execution environment, the method comprising:
-
receiving, by the secure application from the mobile application, a first storage request, the first storage request including a first encrypted data type identifier and an encrypted cryptogram generation key; decrypting, by the secure application, the first encrypted data type identifier and the encrypted cryptogram generation key using a transport key; determining, by the secure application, that the first decrypted data type identifier indicates the first storage request is for a cryptogram generation key; re-encrypting, by the secure application, the decrypted cryptogram generation key using a key-storage key to generate a re-encrypted cryptogram generation key; storing the re-encrypted cryptogram generation key in a memory of the portable communication device which is outside the trusted execution environment; receiving, by the secure application from the mobile application, a cryptogram generation request, the cryptogram generation request including the re-encrypted cryptogram generation key and transaction data for a transaction, wherein the transaction data is received by the mobile application from an access device; decrypting, by the secure application, the re-encrypted cryptogram generation key using the key-storage key; encrypting, by the secure application, the transaction data using the decrypted cryptogram generation key to generate the transaction cryptogram; and sending, by the secure application to the mobile application, the generated transaction cryptogram, wherein the mobile application transmits the generated transaction cryptogram to the access device to conduct the transaction. - View Dependent Claims (12, 13, 14, 15, 16, 17, 18, 19, 20)
-
Specification