Web server bypass of backend process on near field communications and secure element chips

• US 9,906,958 B2
• Filed: 02/26/2015
• Issued: 02/27/2018
• Est. Priority Date: 05/11/2012
• Status: Active Grant

• Current Assignee: T-Mobile Innovations LLC (Deutsche Telekom AG)
• Original Assignee: Sprint Communications Company LP (Deutsche Telekom AG)
• Inventors: Katzer, Robin Dale, Paczkowski, Lyle W.
• Primary Examiner(s): Desrosiers, Evans
• Application Number:
  US14/632,850
• Publication Number:
  US 20150172928A1
• Time in Patent Office: 1,097 Days
• Field of Search: 713168-174, 713182-186, 713202, 709206, 709225, 709229, 709249, 709389, 726 2- 8
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06Q 20/3227 using secure elements embedded in M-devices
• CPC Class Codes: G06Q 20/3278 RFID or NFC payments by means of M-devices
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 4/80 Services using short range communication, e.g. near-field communication [NFC], radio-frequency identification [RFID] or low energy communication

Abstract

A mobile access terminal providing access to data in a secure element of the mobile access terminal is provided. The mobile access terminal comprises the secure element; a web browser; a near field communications system; an over-the-air proxy; an application programming interface layer; and a web server residing on a secure storage area of the mobile access terminal, wherein the web browser is provided with exclusive access to the web server.

Claims

1. A mobile access terminal providing access to secure information in a secure element of the mobile access terminal comprising:

the secure element storing the secure information;

a web browser, stored in a non-transitory memory of the mobile access terminal, configured to transmit a secure information request to a server on the mobile access terminal and transmit the secure information, that is received from the server, to a vendor website;

a trusted security zone, wherein the trusted security zone provides at least one chipset with a hardware root of trust, a secure execution environment for applications, and secure access to peripherals; and

the server residing and executing within at least one of the secure element or the trusted security zone of the mobile access terminal, wherein the server is configured to;

in response to receiving the secure information request from the web browser, provide access to the secure information stored in the secure element exclusively to the web browser,

transmit the secure information using Hypertext Transfer Protocol Secure protocol when the secure information leaves the server for the web browser, and

block access to the secure information stored in the secure element when receiving secure information requests from entities other than the web browser.

2. The system of claim 1, wherein the server comprises one or more of software and hardware.

3. The system of claim 1, wherein the server is configured to interact with the web browser to share data from the secure element.

4. The system of claim 1, wherein a call session control function resides on a core of the secure element.

5. The system of claim 1, wherein the secure element comprises dedicated, embedded hardware in the mobile access terminal.

6. The system of claim 1, wherein the secure element further comprises a kernel of an operating system.

7. The system of claim 1, wherein the web browser accesses the server via one or more of a certificate and a secret key.

8. The system of claim 1, wherein the server is secure and is protected from being compromised.

9. A method for securing user data on a mobile access terminal comprising:

providing, by a mobile access terminal, a secure element, a web browser, a trusted security zone, and a server, wherein the server executes from and is located within at least one of the secure element or the trusted security zone on the mobile access terminal, and wherein the trusted security zone provides at least one chipset with a hardware root of trust, a secure execution environment for applications, and secure access to peripherals;

securely storing, by the mobile access terminal, secure user data of the user of the mobile access terminal in a secure storage area of the server;

initiating, by the mobile access terminal, a transaction with another system external to the mobile access terminal;

transmitting a secure user data request from the web browser to the server that resides on the mobile access terminal, the secure user data request being in response to initiating the transaction with the other system external to the mobile access terminal;

in response to receiving the secure user data request from the web browser, transmitting, by the server, the secure user data to the web browser using a Hypertext Transfer Protocol Secure protocol;

receiving, by the web browser, the secure user data from the secure storage area via the server in response to the server receiving the secure user data request from the web browser, wherein the server provides the secure user data stored in the secure storage area exclusively to the web browser in response to receiving the secure user data request from the web browser while blocking entities other than the web browser from accessing the secure user data stored in the secure storage area; and

executing a secure transaction, by the mobile access terminal via the server, with the other system external to the mobile access terminal based on the received secure user data.

10. The method of claim 9, wherein the secure storage area comprises at least one of the secure element or the trusted security zone.

11. The method of claim 9, wherein the server is operable to interface with the web browser to share data from one or more of the secure element and the trusted security zone.

12. The method of claim 9, further comprising a call session control function residing on a core of the secure element.

13. The method of claim 9, wherein the trusted security zone is built into the mobile access terminal processor architecture.

14. The method of claim 9, wherein the secure user data is stored in the trusted security zone of the mobile access terminal, and wherein the stored secure user data comprises a certificate and a secret key for use by an enterprise application on the mobile access terminal to verify the identity of the device to an enterprise cloud service.

15. The method of claim 14, wherein the enterprise application accesses the server using the Hypertext Transfer Protocol Secure (HTTPS) protocol to create a secure tunnel to retrieve the certificate and secret key.

16. A mobile access terminal providing access to secure information in the mobile access terminal, the mobile access terminal comprising:

a secure element;

a web browser, stored in a non-transitory memory of the mobile access terminal, configured to transmit a secure information request to a server on the mobile access terminal and transmit the secure information, that is received from the server, to a vendor website;

a trusted security zone, wherein the trusted security zone provides at least one chipset with a hardware root of trust, a secure execution environment for applications, and secure access to peripherals, and wherein the trusted security zone and the secure element are located in a core of the mobile access terminal; and

the server residing and executing within at least one of the secure element or the trusted security zone, wherein the server is configured to;

provide access to the secure information stored in the secure element or the trusted security zone exclusively to the web browser in response to receiving the secure information request from the web browser,

transmit the secure information using Hypertext Transfer Protocol Secure protocol when the secure information leaves the server for the web browser, and

block access to the secure information stored in the secure element or the trusted security zone when receiving secure information requests from entities other than the web browser.

17. The system of claim 16, wherein the server residing within at least one of the secure element or the trusted security zone comprises one or more of software and hardware.

18. The system of claim 16, wherein the server is operable to interact with the web browser to share data from one or more of the secure element and the trusted security zone.

19. The system of claim 16, wherein the server resides within the trusted security zone of the mobile access terminal, and wherein the server enables communication using the Hypertext Transfer Protocol Secure (HTTPS) protocol.

20. The system of claim 19, further comprising an enterprise application communicating with an enterprise cloud service, wherein the enterprise application accesses the server to retrieve a certificate and a secret key stored in the trusted security zone and wherein the certificate and the secret key are used to confirm the identity of the mobile access terminal to the enterprise cloud service.