SYSTEM AND METHOD FOR SECURE TRANSACTION PROCESS VIA MOBILE DEVICE

• US 20140214688A1
• Filed: 08/26/2012
• Published: 07/31/2014
• Est. Priority Date: 08/31/2011
• Status: Active Grant

• Current Assignee: Ping Identity Corporation
• Original Assignee: Ping Identity Corporation
• Inventors: Weiner, Avish Jacob, Ne'man, Ran, Ben-Shemen, Shmuel
• Granted Patent: US 9,886,688 B2
• Time in Patent Office: Days
• US Class Current: 705/71
• CPC Class Codes: G06F 21/35 communicating wirelessly
• CPC Class Codes: G06Q 20/3227 using secure elements embedded in M-devices
• CPC Class Codes: G06Q 20/3278 RFID or NFC payments by means of M-devices
• CPC Class Codes: G06Q 20/3829 involving key management
• CPC Class Codes: G07F 7/1016 Devices or methods for securing the PIN and other transaction-data, e.g. by encryption arrangements for secret communication, see H04L9/00

Abstract

A secure element with a user security domain thereon, the user security domain constituted of: a security domain control circuitry; an encoder/decoder functionality responsive to the security domain control circuitry; and a secured keys storage in communication with the security domain control circuitry, the encoder/decoder functionality arranged to: encode data responsive to at least one first key stored on the secured keys storage, and output an encoded data; and decode received data responsive to at least one second key stored on the secured keys storage, and output a decoded data.

Claims

1. A secure element with a user security domain thereon, said user security domain comprising:

a security domain control circuitry;

an encoder/decoder functionality responsive to said security domain control circuitry; and

a secured keys storage in communication with said security domain control circuitry,

said encoder/decoder functionality arranged to;

encode data responsive to at least one first key stored on said secured keys storage, and output an encoded data; and

decode received data responsive to at least one second key stored on said secured keys storage, and output a decoded data.

2. The secure element according to claim 1, further comprising a memory in communication with said security domain control circuitry, said encoder/ decoder functionality arranged to store said output encoded data on said memory responsive to said security domain control circuitry.

3. The secure element according to claim 2, wherein said encoder/ decoder functionality is arranged to retrieve said output encoded data from said memory responsive to said security domain control circuitry as said received data.

4. The secure element according to claim 1, wherein said user security domain further comprises a firewall functionality responsive to said security domain control circuitry, said firewall functionality arranged to encapsulate data.

5. The secure element of claim 1, wherein said user security domain further comprises a firewall functionality responsive to said security domain control circuitry, said firewall functionality arranged to encapsulate data received from a near field communication device and transmit said encapsulated data to a mobile device processor.

6. The secure element of claim 1, wherein said user security domain further comprises a verification functionality responsive to said security domain control circuitry, said verification functionality arranged to verify at least one verification passcode, and output a verification signal whose state is responsive to the verification.

7. The secure element of claim 6, further comprising a memory in communication with said verification functionality, said memory arranged for storage of a PIN verification value,

wherein in the event that said verification passcode is a PIN, said verification functionality is arranged to verify the PIN responsive to the PIN verification value.

8. The secure element of claim 6, wherein said verification functionality is in communication with said secured keys storage, and wherein the verification passcode is verified in cooperation with at least one third key stored on said secured keys storage.

9. The secure element of claim 1, wherein said user security domain further comprises a digital signature functionality responsive to said security domain control circuitry and in communication with said secured keys storage, said digital signature functionality arranged to:

receive data; and

return the received data digitally signed responsive to at least one fourth key stored on said secured keys storage.

10. The secure element of claim 1, wherein said user security domain further comprises:

a secured first identifier storage functionality; and

a secured second identifier, said second identifier arranged in cooperation with a first pseudo-random number generator functionality to output an encoded second identifier.

11. The secure element of claim 10, wherein said secured second identifier is arranged to output separate encoded second identifiers to each of a mobile device processor and a near field communication controller.

12. The secure element of claim 10, wherein said secured second identifier is in communication with said secured keys storage, said second identifier encoded in cooperation with the first pseudo-random number generator functionality responsive to at least one fourth key stored on said secured keys storage.

13. The secure element of claim 10, further comprising a secured third identifier, said identifier arranged in cooperation with a second pseudo-random number generator functionality to output an encoded third identifier.

14. The secure element of claim 13, wherein said secured third identifier is arranged to output separate encoded third identifiers to each of a mobile device processor and a near field communication controller.

15. The secure element of claim 13, wherein said secured third identifier is in communication with said secured keys storage, said third identifier encoded in cooperation with the second pseudo-random number generator functionality responsive to at least one fifth key stored on said secured keys storage.

16. A mobile device comprising:

a mobile device processor;

a data entry device;

a secure element with a user security domain thereon, said secure element in communication with said mobile device processor; and

a security control, said security control arranged in a first mode to provide information from said data entry device to said mobile device processor and in a second mode to provide information from said data entry device to said user security domain.

17. The mobile device according to claim 16, wherein said security control is switchable arranged so that in the first mode information from said data entry device is directed to said mobile device processor and in the second mode to information from said data entry device is directed to secure element.

18. The mobile device according to claim 16, wherein said security control comprises a secured encryption key, and wherein said security control is arranged in the first mode to pass the information from said data entry device to said mobile device processor in an unencrypted form, and in the second mode said security control is arranged to pass the information from said data entry device to said mobile device processor in an encrypted form, said mobile device processor arranged to transmit said encrypted information to said user security domain.

19. The mobile device according to claim 16, further comprising a peripheral device, said security control arranged in the first mode to provide information from said peripheral to said mobile device processor and in a second mode to provide information from said peripheral to said secure element.

20. The mobile device according to claim 16, further comprising a peripheral device in communication with said mobile device processor, said security control arranged in the second mode to:

encrypt information from said peripheral; and

provide the encrypted information from said peripheral to said mobile device processor.

21. The mobile device according to claim 16, further comprising an indicator arranged to output an indication when said security control is in the second mode.

22. The mobile device according to claim 16, further comprising a secure keypad in communication with said secure element, said secure keypad not in communication with said mobile device processor.

23. The mobile device according to claim 16, wherein said user security domain of said secure element comprises:

a security domain control circuitry;

an encoder/decoder functionality responsive to said security domain control circuitry; and

a secured keys storage in communication with said security domain control circuitry.

24. The mobile device according to claim 16, wherein said user security domain of said secure element comprises:

a security domain control circuitry; and

a verification functionality responsive to said security domain control circuitry, said verification functionality arranged to verify a verification passcode received in the second mode from said data entry device, and output a verification signal to said security domain control circuitry whose state is responsive to the verification.

25. A mobile device comprising:

a mobile device processor;

a secure element in communication with said mobile device processor;

a security control in communication with said mobile device processor and said secure element;

a data entry device in communication with said security control;

said security control arranged in a first mode to provide information from said data entry device to said mobile device processor and in a second mode to provide information to said secure element,

said secure element arranged to encrypt said provided information and provide said encrypted information to said mobile device processor.

26. The mobile device according to claim 25, further comprising a peripheral device, said peripheral device in communication with said mobile device processor and said security control, wherein information from said peripheral device is transmitted in parallel to said mobile device processor and said security control.

27. The mobile device according to claim 26, wherein said security control is further arranged to encrypt said information from said peripheral device and provide said encrypted information from said peripheral device to said mobile device processor.

28. The mobile device according to claim 27, wherein said mobile device processor is arranged to transmit said provided encrypted information from said peripheral device to a remote server in communication with the mobile device.