METHOD, DEVICE, ADD-ON AND SECURE ELEMENT FOR CONDUCTING A SECURED FINANCIAL TRANSACTION ON A DEVICE

• US 20140324698A1
• Filed: 04/25/2014
• Published: 10/30/2014
• Est. Priority Date: 02/29/2012
• Status: Active Grant

• Current Assignee: Apple Inc.
• Original Assignee: Mobeewave, Inc. (Apple Inc.)
• Inventors: DOLCINO, Luc, FONTAINE, Sebastien, ALBERTI, Xavier, DU HAYS, Benjamin, DE NANCLAS, Maxime
• Granted Patent: US 11,132,665 B2
• Time in Patent Office: Days
• US Class Current: 705/44
• CPC Class Codes: G06Q 20/20 Point-of-sale [POS] network systems
• CPC Class Codes: G06Q 20/32 using wireless devices
• CPC Class Codes: G06Q 20/322 Aspects of commerce using mobile devices [M-devices]
• CPC Class Codes: G06Q 20/3227 using secure elements embedded in M-devices
• CPC Class Codes: G06Q 20/3229 Use of the SIM of a M-device as secure element
• CPC Class Codes: G06Q 20/326 Payment applications installed on the mobile devices
• CPC Class Codes: G06Q 20/327 Short range or proximity payments by means of M-devices
• CPC Class Codes: G06Q 20/3278 RFID or NFC payments by means of M-devices
• CPC Class Codes: G06Q 20/34 using cards, e.g. integrated circuit [IC] cards or magnetic cards
• CPC Class Codes: G06Q 20/353 Payments by cards read by M-devices
• CPC Class Codes: G06Q 20/3825 Use of electronic signatures
• CPC Class Codes: G06Q 20/3829 involving key management
• CPC Class Codes: G06Q 20/388 using mutual authentication without cards, e.g. challenge-response
• CPC Class Codes: G06Q 20/4012 Verifying personal identification numbers [PIN]
• CPC Class Codes: G06Q 20/409 Device specific authentication in transaction processing

Abstract

A device, an add-on and a secure element for conducting a secured financial transaction are disclosed. The device comprises a central processing unit; a communication interface for establishing a communication between the device and a financial institution related to a financial account; an interface for acquiring data relating to the financial account; the secure element for processing at least a portion of the data relating to the financial account acquired by the interface; and control logic for acquiring a purchase amount to be debited from the financial account and for obtaining a transaction authorization from the financial institution related to the financial account, the transaction authorization being based, at least partially, on data processed solely by the secure element independently of data processed by the central processing unit. A method of conducting the secured financial transaction, and a computer program product for execution by the secure element are also disclosed.

Claims

1. A housing to be plugged with a device to be used as a payment terminal for conducting a secured financial transaction, the housing comprising:

a secure element for processing at least a portion of data relating to a financial account acquired by an interface; and

control logic configured to acquire a purchase amount to be debited from the financial account and to obtain a transaction authorization from a financial institution related to the financial account, the transaction authorization being based, at least partially, on data processed solely by the secure element independently of data processed by a central processing unit of the device;

wherein the data processed solely by the secure element include at least a portion of the acquired data relating to the financial account.

2. The housing of claim 1, wherein the secure element is embedded on a chipset, the chipset comprising instructions to run:

an Europay, MasterCard, and Visa (EMV) transaction module that is configured to process data acquired by the interface in accordance with a certification standard; and

an operating system (OS) configured to process data provided by the EMV transaction module in accordance with the Level 1 of the EMVCo standard.

3. The housing of claim 2, wherein the EMV transaction module is one of a contactless transaction module and a contact transaction module.

4. The housing of claim 1, wherein the central processing unit runs a financial transaction application configured to control the secure element without accessing some of the data processed by the secure element.

5. The housing of claim 1, wherein the data relating to the financial account include at least one of a key, a certificate, and a payment card number.

6. The housing of claim 2, wherein the EMV transaction module executes:

a reception from a payment control application running on the device of a request to conduct a financial transaction;

an acquisition via the interface of data relating to a financial account from a payment apparatus;

an establishment of a secured communication channel with a server of a financial institution related to the financial account through a communication interface of the device;

a sending over the secured communication channel to the server of an authorization request to perform the financial transaction, the authorization request comprising at least a portion of the data related to the financial account;

a reception over the secured communication channel from the server of a response to the authorization request;

a processing of the response to the authorization request to generate a status of the financial transaction; and

a sending to the payment control application of the status of the financial transaction.

7. The housing of claim 6, wherein the interface is a contactless interface configured to receive data contactlessly and the payment apparatus is one of a payment card and a mobile device.

8. An add-on for connection to a device to be used as a payment terminal for conducting a secured financial transaction, the add-on comprising:

a secure element for processing at least a portion of data relating to a financial account acquired by an interface of at least one of the add-on and the device; and

wherein the secure element is adapted to interact with control logic configured to acquire a purchase amount to be debited from the financial account and to obtain a transaction authorization from a financial institution related to the financial account, the transaction authorization being based, at least partially, on data processed solely by the secure element independently of data processed by a central processing unit of the device;

wherein the data processed solely by the secure element include at least a portion of the acquired data relating to the financial account.

9. The add-on of claim 8, wherein the interface of the at least one of the add-on and the device is controlled by the secure element via the central processing unit of the device.

10. The add-on of claim 8, wherein the interface of the at least one of the add-on and the device is controlled by the secure element via a central processing unit of the add-on.

11. The add-on of claim 8, wherein the interface of the at least one of the add-on and the device is controlled by the secure element independently of the central processing unit of the device.

12. The add-on of claim 8, wherein the secure element is embedded on a chipset, the chipset comprising instructions to run:

an Europay, MasterCard, and Visa (EMV) transaction module that is configured to process data acquired by the interface in accordance with a certification standard; and

an operating system (OS) configured to process data provided by the EMV transaction module in accordance with the Level 1 of the EMVCo standard.

13. The add-on of claim 12, wherein the EMV transaction module is one of a contactless transaction module and a contact transaction module.

14. The add-on of claim 8, wherein the central processing unit runs a financial transaction application configured to control the secure element without accessing some of the data processed by the secure element.

15. The add-on of claim 8, wherein the data relating to the financial account include at least one of a key, a certificate and a payment card number.

16. The add-on of claim 12, wherein the EMV transaction module executes:

a reception from a payment control application running on the device of a request to conduct a financial transaction;

an acquisition via the interface of data relating to a financial account from a payment apparatus;

an establishment of a secured communication channel with a server of a financial institution related to the financial account through a communication interface of the device;

a sending over the secured communication channel to the server of an authorization request to perform the financial transaction, the authorization request comprising at least a portion of the data related to the financial account;

a reception over the secured communication channel from the server of a response to the authorization request;

a processing of the response to the authorization request to generate a status of the financial transaction; and

a sending to the payment control application of the status of the financial transaction.

17. The add-on of claim 16, wherein the interface is a contactless interface configured to receive data contactlessly and the payment apparatus is one of a payment card and a mobile device.

18. The add-on of claim 8, wherein the add-on is one of a housing, a case, a sleeve, a cover, a dongle and an accessory.

19. An add-on for connection to a device to be used as a payment terminal for conducting a secured financial transaction, the add-on comprising:

a slot for receiving a secure element for processing at least a portion of data relating to a financial account acquired by an interface of at least one of the add-on and the device; and

wherein the slot is adapted to allow the secure element to interact with control logic configured to acquire a purchase amount to be debited from the financial account and to obtain a transaction authorization from a financial institution related to the financial account, the transaction authorization being based, at least partially, on data processed solely by the secure element independently of data processed by a central processing unit of the device;

wherein the data processed solely by the secure element include at least a portion of the acquired data relating to the financial account.