EMBEDDING CLOUD-BASED FUNCTIONALITIES IN A COMMUNICATION DEVICE

• US 20170364903A1
• Filed: 08/21/2017
• Published: 12/21/2017
• Est. Priority Date: 08/22/2014
• Status: Active Grant

• Current Assignee: Eduardo Lopez
• Original Assignee: Eduardo Lopez
• Inventors: Lopez, Eduardo
• Granted Patent: US 10,049,353 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 9/455 Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
• CPC Class Codes: G06Q 20/322 Aspects of commerce using mobile devices [M-devices]
• CPC Class Codes: G06Q 20/3227 using secure elements embedded in M-devices
• CPC Class Codes: G06Q 20/326 Payment applications installed on the mobile devices
• CPC Class Codes: G06Q 20/3263 characterised by activation or deactivation of payment capabilities
• CPC Class Codes: G06Q 20/3265 characterised by personalisation for use
• CPC Class Codes: G06Q 20/327 Short range or proximity payments by means of M-devices
• CPC Class Codes: G06Q 20/3278 RFID or NFC payments by means of M-devices
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: G06Q 20/3825 Use of electronic signatures
• CPC Class Codes: G06Q 20/3829 involving key management
• CPC Class Codes: G06Q 20/385 using an alias or single-use codes
• CPC Class Codes: H04L 63/068 using time-dependent keys, e.g. periodically changing keys cryptographic mechanisms or cryptographic arrangements for controlling usage of secret information H04L9/088
• CPC Class Codes: H04W 12/041 Key generation or derivation
• CPC Class Codes: H04W 12/0431 Key distribution or pre-distribution; Key agreement
• CPC Class Codes: H04W 4/80 Services using short range communication, e.g. near-field communication [NFC], radio-frequency identification [RFID] or low energy communication
• CPC Class Codes: H04W 88/02 Terminal devices

Abstract

Techniques for enhancing the security of a communication device may include providing an application agent and a transaction application that executes on a communication device. The application agent may receive, from the application, a cryptogram key generated by a remote computer, and store the cryptogram key on the communication device. When the application agent receives a request to conduct a transaction from the application, the application agent may generate a transaction cryptogram using the cryptogram key, and provides the transaction cryptogram to an access device.

Claims

1. A portable communication device comprising:

a processor device;

a contactless transceiver coupled to the processor device;

a memory including multiple memory regions and storing an application and an application agent,

wherein the application agent receives, from the application, a cryptogram key generated by a remote computer, stores the cryptogram key, receives a request to conduct a transaction from the application, generates a transaction cryptogram using the cryptogram key, accesses the contactless transceiver, and transmits the transaction cryptogram to an access device via the contactless transceiver, and

wherein the application agent sends a replenishment request for a second cryptogram key to the application, the replenishment request including transaction log information derived from a transaction log, receives the second cryptogram key from the application when the transaction log information in the replenishment request matches transaction log information at the remote computer, and stores the second cryptogram key.

2. The portable communication device of claim 1, wherein the application agent stores the transaction log on the portable communication device.

3. The portable communication device of claim 1, wherein the multiple memory regions include a memory region implementing a trusted execution environment.

4. The portable communication device of claim 1, wherein the contactless transceiver of the portable communication device is not accessible by the application except via the application agent.

5. The portable communication device of claim 1, wherein the application agent does not communicate with the remote computer except via the application.

6. The portable communication device of claim 3, wherein the trusted execution environment is implemented as a virtual machine or as a secure operating mode of the processor.

7. A method for enhancing security of a portable communication device, the method comprising:

receiving, from a remote computer by an application installed on the portable communication device, a cryptogram key;

sending, by the application, the cryptogram key to an application agent installed on the portable communication device;

receiving, by the application, a request to conduct a transaction;

sending, by the application, the request to conduct the transaction to the application agent, wherein the application agent generates a transaction cryptogram using the cryptogram key, and accesses a contactless interface of the portable communication device to transmit the transaction cryptogram to an access device to conduct the transaction;

receiving, from the application agent, a replenishment request for a second cryptogram key, the replenishment request including transaction log information derived from a transaction log;

sending, by the application, the replenish request to the remote computer;

receiving, by the application, the second cryptogram key from the remote computer when the transaction log information in the replenishment request matches transaction log information at the remote computer;

sending, by the application, the second cryptogram key to the application agent for storage.

8. The method of claim 7, wherein the application agent stores the transaction log on the portable communication device.

9. The method of claim 7, wherein the application agent executes in a trusted execution environment.

10. The method of claim 7, wherein the contactless interface of the portable communication device is not accessible by the application except via the application agent.

11. The method of claim 7, wherein the application agent does not communicate with the remote computer except via the application.

12. The method of claim 9, wherein the trusted execution environment is implemented in a virtual machine.

13. The method of claim 9, wherein the trusted execution environment is implemented as a secure operating mode in a processor of the portable communication device

14. A method for enhancing security of a portable communication device, the method comprising:

receiving, by an application agent installed on the portable communication device, a cryptogram key from an application installed on the portable communication device, the cryptogram key provided to the application from a remote computer;

storing, by the application agent, the cryptogram key;

receiving, by the application agent, a request to conduct a transaction from the application;

generating, by the application agent executing, a transaction cryptogram using the cryptogram key;

accessing a contactless interface of the portable communication device to transmit the transaction cryptogram to an access device to conduct the transaction;

sending a replenishment request for a second cryptogram key, the replenishment request including transaction log information derived from a transaction log;

receiving the second cryptogram key when the transaction log information in the replenishment request matches transaction log information at the remote computer; and

storing the second cryptogram key.

15. The method of claim 14, further comprising:

storing, by the application agent, the transaction log on the portable communication device.

16. The method of claim 15, wherein the application agent executes in a trusted execution environment.

17. The method of claim 14, wherein the contactless interface of the portable communication device is not accessible to the application except via the application agent.

18. The method of claim 14, wherein the application agent does not communicate with the remote computer except via application.

19. The method of claim 16, wherein the trusted execution environment is implemented in a virtual machine.

20. The method of claim 16, wherein the trusted execution environment is implemented as a secure operating mode in a processor of the portable communication device.