Method, device and secure element for conducting a secured financial transaction on a device

• US 10,504,101 B2
• Filed: 01/18/2019
• Issued: 12/10/2019
• Est. Priority Date: 02/29/2012
• Status: Active Grant

• Current Assignee: Apple Inc.
• Original Assignee: Mobeewave, Inc. (Apple Inc.)
• Inventors: Fontaine, Sebastien, Dolcino, Luc, Du Hays, Benjamin, De Nanclas, Maxime, Alberti, Xavier
• Primary Examiner(s): Akintola, Olabode
• Application Number:
  US16/251,827
• Publication Number:
  US 20190156320A1
• Time in Patent Office: 326 Days
• Field of Search: 705 35- 44
• CPC Class Codes: G06Q 20/20 Point-of-sale [POS] network systems
• CPC Class Codes: G06Q 20/32 using wireless devices
• CPC Class Codes: G06Q 20/322 Aspects of commerce using mobile devices [M-devices]
• CPC Class Codes: G06Q 20/3227 using secure elements embedded in M-devices
• CPC Class Codes: G06Q 20/3229 Use of the SIM of a M-device as secure element
• CPC Class Codes: G06Q 20/326 Payment applications installed on the mobile devices
• CPC Class Codes: G06Q 20/327 Short range or proximity payments by means of M-devices
• CPC Class Codes: G06Q 20/3278 RFID or NFC payments by means of M-devices
• CPC Class Codes: G06Q 20/34 using cards, e.g. integrated circuit [IC] cards or magnetic cards
• CPC Class Codes: G06Q 20/353 Payments by cards read by M-devices
• CPC Class Codes: G06Q 20/3825 Use of electronic signatures
• CPC Class Codes: G06Q 20/3829 involving key management
• CPC Class Codes: G06Q 20/388 using mutual authentication without cards, e.g. challenge-response
• CPC Class Codes: G06Q 20/4012 Verifying personal identification numbers [PIN]
• CPC Class Codes: G06Q 20/409 Device specific authentication in transaction processing

Abstract

A device and a secure element for conducting a secured financial transaction are disclosed. The device comprises a central processing unit; a communication interface for establishing a communication between the device and a financial institution related to a financial account; an interface for acquiring data relating to the financial account; the secure element for processing at least a portion of the data relating to the financial account acquired by the interface; and control logic for acquiring a purchase amount to be debited from the financial account and for obtaining a transaction authorization from the financial institution related to the financial account, the transaction authorization being based, at least partially, on data processed solely by the secure element independently of data processed by the central processing unit. A method of conducting the secured financial transaction, and a computer program product for execution by the secure element are also disclosed.

Claims

1. A method of operating a mobile device used as a payment terminal by a merchant, the mobile device being distinct from a dedicated payment terminal, the mobile device being configured to run a point of sale (POS) application for receiving a payment from a customer and to operate a secure element, the mobile device comprising a central processing unit, a contactless interface and a communication interface, the secure element being characterized by software components operating a secured environment, the POS application comprising a payment control application configured to interact with the secure element, the method comprising:

receiving user input comprising an amount corresponding to the payment;

activating the contactless interface of the mobile device;

receiving, via the contactless interface of the mobile device and from a payment apparatus of the customer, an indication of one or more payment applications supported by the payment apparatus;

selecting a payment application of the one or more payment applications supported by the payment apparatus;

acquiring, by the secure element, via the contactless interface of the mobile device, data associated with the payment apparatus, wherein the data associated with the payment apparatus identifies the customer'"'"'s financial account, and wherein at least a portion of the data associated with the payment apparatus is solely accessible by the secure element;

encrypting, by the secure element, the at least the portion of the data associated with the payment apparatus, thereby generating encrypted data;

establishing, through the communication interface of the mobile device, a secured communication channel between the secure element and a remote server; and

sending over the secured communication channel, to the remote server, the encrypted data and an identifier corresponding to the merchant so that a transaction authorization request may be processed.

2. The method of claim 1, wherein the contactless interface comprises a Contactless Front End, wherein the payment apparatus comprises a Proximity Integrated Circuit Card (PICC), wherein the data associated with the payment apparatus comprises payment credentials, and wherein acquiring, by the secure element, via the contactless interface of the mobile device, the data associated with the payment apparatus comprises:

receiving, by the secure element, a start payment applet message;

starting a payment applet operated by the secure element;

sending, by the payment applet, a request to enable a reader mode of the Contactless Front End;

reading, by the Contactless Front End, the payment credentials associated with the PICC; and

sending, by the payment applet, a request to deactivate the reader mode of the Contactless Front End.

3. The method of claim 1, wherein acquiring, by the secure element, via the contactless interface of the mobile device, the data associated with the payment apparatus comprises:

a sending of a Select Proximity Payment System Environment (PPSE) request to the payment apparatus, and wherein the receiving the indication of the one or more payment applications supported by the payment apparatus is in response to the PPSE request.

4. The method of claim 2, wherein communications between the payment control application and the secure element are made through the Contactless Front End.

5. The method of claim 1, further comprising

receiving, by the payment control application and via user input from the customer, a Personal Identification Number (PIN);

receiving, by the secure element, the PIN; and

validating payment credentials corresponding to the payment apparatus based on the PIN.

6. The method of claim 1, wherein establishing, through the communication interface of the mobile device, the secured communication channel between the secure element and the remote server comprises a sending, by the secure element, of a request to establish the secured communication channel by the payment control application.

7. The method of claim 1, wherein the at least a portion of the data associated with the payment apparatus comprises payment credentials.

8. The method of claim 1, further comprising:

receiving, over the secured communication channel, from the server, a response to the transaction authorization request; and

processing the response to the transaction authorization request to generate a status of a financial transaction.

9. The method of claim 8, further comprising:

receiving, by the secure element, a stop payment applet message; and

stopping a payment applet operated by the secure element.

10. The method of claim 1, wherein the secured communication channel is based on encryption keys.

11. The method of claim 1, wherein the payment apparatus is one of a payment card and another mobile device.

12. The method of claim 1, further comprising:

retrieving biometrics data corresponding to the customer;

receiving, by the secure element, the biometrics data; and

validating the customer'"'"'s identity based on the biometrics data.

13. A mobile device to be used as a payment terminal by a merchant, the mobile device being distinct from a dedicated payment terminal, the mobile device being configured to run a point of sale (POS) application for receiving a payment from a customer and to operate a secure element, the mobile device comprising a non-transitory computer readable storage medium comprising computer-executable instructions, a central processing unit, a contactless interface and a communication interface, the secure element being characterized by software components operating a secured environment, the POS application comprising a payment control application configured to interact with the secure element, the computer-executable instructions, upon execution, causing to execute:

receiving user input comprising an amount corresponding to the payment;

activating the contactless interface of the mobile device;

receiving, via the contactless interface of the mobile device and from a payment apparatus of the customer, an indication of one or more payment applications supported by the payment apparatus;

selecting a payment application of the one or more payment applications supported by the payment apparatus;

acquiring, by the secure element, via the contactless interface of the mobile device, data associated with the payment apparatus, wherein the data associated with the payment apparatus identifies the customer'"'"'s financial account, and wherein at least a portion of the data associated with the payment apparatus is solely accessible by the secure element;

encrypting, by the secure element, the at least the portion of the data associated with the payment apparatus, thereby generating encrypted data;

establishing, through the communication interface of the mobile device, a secured communication channel between the secure element and a remote server; and

sending over the secured communication channel, to the remote server, the encrypted data and an identifier corresponding to the merchant so that a transaction authorization request may be processed.

14. The mobile device of claim 13, wherein the contactless interface comprises a Contactless Front End, wherein the payment apparatus comprises a Proximity Integrated Circuit Card (PICC), wherein the data associated with the payment apparatus comprises payment credentials, and wherein acquiring, by the secure element, via the contactless interface of the mobile device, the data associated with the payment apparatus comprises:

receiving, by the secure element, a start payment applet message;

starting a payment applet operated by the secure element;

sending, by the payment applet, a request to enable a reader mode of the Contactless Front End;

reading, by the Contactless Front End, the payment credentials associated with the PICC; and

sending, by the payment applet, a request to deactivate the reader mode of the Contactless Front End.

15. The mobile device of claim 13, wherein acquiring, by the secure element, via the contactless interface of the mobile device, the data associated with the payment apparatus comprises:

a sending of a Select Proximity Payment System Environment (PPSE) request to the payment apparatus, and wherein the receiving the indication of the one or more payment applications supported by the payment apparatus is in response to the PPSE request.

16. The mobile device of claim 13, wherein establishing, through the communication interface of the mobile device, the secured communication channel between the secure element and the remote server comprises a sending, by the secure element, of a request to establish the secured communication channel by the payment control application.

17. A non-transitory computer readable storage medium comprising computer-executable instructions for execution by a mobile device used as a payment terminal by a merchant, the mobile device being distinct from a dedicated payment terminal, the mobile device being configured to run a point of sale (POS) application for receiving a payment from a customer and to operate a secure element, the mobile device comprising a central processing unit, a contactless interface and a communication interface, the secure element being characterized by software components operating a secured environment, the POS application comprising a payment control application configured to interact with the secure element, the computer-executable instructions, upon execution, causing to execute:

receiving user input comprising an amount corresponding to the payment;

activating the contactless interface of the mobile device;

receiving, via the contactless interface of the mobile device and from a payment apparatus of the customer, an indication of one or more payment applications supported by the payment apparatus;

selecting a payment application of the one or more payment applications supported by the payment apparatus;

acquiring, by the secure element, via the contactless interface of the mobile device, data associated with the payment apparatus, wherein the data associated with the payment apparatus identifies the customer'"'"'s financial account, and wherein at least a portion of the data associated with the payment apparatus is solely accessible by the secure element;

encrypting, by the secure element, the at least the portion of the data associated with the payment apparatus, thereby generating encrypted data;

establishing, through the communication interface of the mobile device, a secured communication channel between the secure element and a remote server; and

sending over the secured communication channel, to the remote server, the encrypted data and an identifier corresponding to the merchant so that a transaction authorization request may be processed.

18. The non-transitory computer readable storage medium of claim 17, wherein the contactless interface comprises a Contactless Front End, wherein the payment apparatus comprises a Proximity Integrated Circuit Card (PICC), wherein the data associated with the payment apparatus comprises payment credentials, and wherein acquiring, by the secure element, via the contactless interface of the mobile device, the data associated with the payment apparatus comprises:

receiving, by the secure element, a start payment applet message;

starting a payment applet operated by the secure element;

sending, by the payment applet, a request to enable a reader mode of the Contactless Front End;

reading, by the Contactless Front End, the payment credentials associated with the PICC; and

sending, by the payment applet, a request to deactivate the reader mode of the Contactless Front End.

19. The non-transitory computer readable storage medium of claim 18, wherein acquiring, by the secure element, via the contactless interface of the mobile device, the data associated with the payment apparatus comprises:

a sending of a Select Proximity Payment System Environment (PPSE) request to the payment apparatus, and wherein the receiving the indication of the one or more payment applications supported by the payment apparatus is in response to the PPSE request.