METHOD, DEVICE AND SECURE ELEMENT FOR CONDUCTING A SECURED FINANCIAL TRANSACTION ON A DEVICE

• US 20160132861A1
• Filed: 02/28/2013
• Published: 05/12/2016
• Est. Priority Date: 02/29/2012
• Status: Active Grant

• Current Assignee: Apple Inc.
• Original Assignee: Mobeewave, Inc. (Apple Inc.)
• Inventors: a) FONTAINE, Sebastien, DOLCINO, Luc, DU HAYS, Benjamin, DE NANCLAS, Maxime, ALBERTI, Xavier
• Granted Patent: US 9,892,403 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06Q 20/20 Point-of-sale [POS] network systems
• CPC Class Codes: G06Q 20/32 using wireless devices
• CPC Class Codes: G06Q 20/322 Aspects of commerce using mobile devices [M-devices]
• CPC Class Codes: G06Q 20/3227 using secure elements embedded in M-devices
• CPC Class Codes: G06Q 20/3229 Use of the SIM of a M-device as secure element
• CPC Class Codes: G06Q 20/326 Payment applications installed on the mobile devices
• CPC Class Codes: G06Q 20/327 Short range or proximity payments by means of M-devices
• CPC Class Codes: G06Q 20/3278 RFID or NFC payments by means of M-devices
• CPC Class Codes: G06Q 20/34 using cards, e.g. integrated circuit [IC] cards or magnetic cards
• CPC Class Codes: G06Q 20/353 Payments by cards read by M-devices
• CPC Class Codes: G06Q 20/3825 Use of electronic signatures
• CPC Class Codes: G06Q 20/3829 involving key management
• CPC Class Codes: G06Q 20/388 using mutual authentication without cards, e.g. challenge-response
• CPC Class Codes: G06Q 20/4012 Verifying personal identification numbers [PIN]
• CPC Class Codes: G06Q 20/409 Device specific authentication in transaction processing

Abstract

A device and a secure element for conducting a secured financial transaction are disclosed. The device comprises a central processing unit; a communication interface for establishing a communication between the device and a financial institution related to a financial account; an interface for acquiring data relating to the financial account; the secure element for processing at least a portion of the data relating to the financial account acquired by the interface; and control logic for acquiring a purchase amount to be debited from the financial account and for obtaining a transaction authorization from the financial institution related to the financial account, the transaction authorization being based, at least partially, on data processed solely by the secure element independently of data processed by the central processing unit. A method of conducting the secured financial transaction, and a computer program product for execution by the secure element are also disclosed.

Claims

1. (canceled)

2. (canceled)

3. (canceled)

4. (canceled)

5. (canceled)

6. (canceled)

7. (canceled)

8. (canceled)

9. (canceled)

10. (canceled)

11. (canceled)

12. (canceled)

13. (canceled)

14. (canceled)

15. (canceled)

16. (canceled)

17. (canceled)

18. (canceled)

19. (canceled)

20. (canceled)

21. (canceled)

22. (canceled)

23. (canceled)

24. (canceled)

25. (canceled)

26. (canceled)

27. (canceled)

28. (canceled)

29. (canceled)

30. A secure element for installation in a device used as a payment terminal, the secure element comprising instructions to run:

an Europay, MasterCard, and Visa (EMV) transaction module that is configured to process data acquired by an interface of the device from a payment apparatus in accordance with a certification standard; and

an operating system (OS) configured to process data provided by the EMV transaction module in accordance with the Level 1 of the EMVCo standard.

31. The secure element of claim 30, wherein the OS is one of Java Card®

and Global Platform.

32. The secure element of claim 30, wherein the secure element is embedded in one of a chipset embedded on a circuitry of the device, a subscriber identity module (SIM) card, a secure digital (SD) card, a non-volatile memory card, and a housing to be plugged to the device.

33. The secure element of claim 30, wherein the EMV transaction module is one of a contactless transaction module and a contact transaction module.

34. The secure element of claim 30, wherein the certification standard is a certification standard from one of EMVCo, MasterCard®

, Visa®

, American Express®

, JCB®

, Discover®

, and PCI SSC.

35. The secure element of claim 34, wherein the EMV transaction module is certified in accordance with at least one of:

a Level 2 of the certification standard, and a Level 3 of the certification standard.

36. The secure element of claim 30, wherein the EMV transaction module executes:

a reception from a payment control application running on the device of a request to conduct a secured financial transaction;

an acquisition via the interface of the device of data relating to a financial account from the payment apparatus;

an establishment of a secured communication channel with a server of a financial institution related to the financial account through a communication interface of the device;

a sending over the secured communication channel to the server of an authorization request to perform the secured financial transaction, the authorization request comprising at least a portion of the data relating to the financial account;

a reception over the secured communication channel from the server of a response to the authorization request;

a processing of the response to the authorization request to generate a status of the secured financial transaction; and

a sending to the payment control application of the status of the secured financial transaction.

37. The secure element of claim 36, wherein the request to conduct the secured financial transaction comprises a purchase amount to be debited from the financial account.

38. The secure element of claim 36, wherein the interface of the device is a contactless interface configured to receive data contactlessly and the payment apparatus is one of a payment card and a mobile device.

39. The secure element of claim 36, wherein the interface of the device is a smart card reader configured to contact read data and the payment apparatus is a payment card.

40. The secure element of claim 36, wherein the interface of the device is a magnetic strip reader configured to contact read data and the payment apparatus is a payment card with a magnetic strip.

41. The secure element of claim 36, wherein the data relating to the financial account include at least one of a key, a certificate, and a payment card number.

42. A non-transitory computer readable storage medium comprising computer-executable instructions for execution by a device used as a payment terminal, the computer-executable instructions, upon execution by the device, causing to run:

an Europay, MasterCard, and Visa (EMV) transaction module that is configured to process data acquired by an interface of the device from a payment apparatus in accordance with a certification standard; and

an operating system (OS) configured to process data provided by the EMV transaction module in accordance with the Level 1 of the EMVCo standard.

43. The non-transitory computer readable storage medium of claim 42, wherein the EMV transaction module executes:

a reception from a payment control application running on the device of a request to conduct a secured financial transaction;

an acquisition via the interface of the device of data relating to a financial account from the payment apparatus;

an establishment of a secured communication channel with a server of a financial institution related to the financial account through a communication interface of the device;

a sending over the secured communication channel to the server of an authorization request to perform the secured financial transaction, the authorization request comprising at least a portion of the data relating to the financial account;

a reception over the secured communication channel from the server of a response to the authorization request;

a processing of the response to the authorization request to generate a status of the secured financial transaction; and

a sending to the payment control application of the status of the secured financial transaction.

44. The non-transitory computer readable storage medium of claim 43, wherein the request to conduct the secured financial transaction comprises a purchase amount to be debited from the financial account.

45. The non-transitory computer readable storage medium of claim 43, wherein the interface of the device is a contactless interface configured to receive data contactlessly and the payment apparatus is one of a payment card and a mobile device.

46. The non-transitory computer readable storage medium of claim 43, wherein the interface of the device is a smart card reader configured to contact read data and the payment apparatus is a payment card.

47. The non-transitory computer readable storage medium of claim 43, wherein the interface of the device is a magnetic strip reader configured to contact read data and the payment apparatus is a payment card with a magnetic strip.

48. The non-transitory computer readable storage medium of claim 43, wherein the data relating to the financial account comprise at least one of a key, a certificate, and a payment card number.

49. The non-transitory computer readable storage medium of claim 43, wherein the OS is one of Java Card®

and Global Platform.

50. The non-transitory computer readable storage medium of claim 43, wherein the computer program logic is run by a secure element.

51. The non-transitory computer readable storage medium of claim 43, wherein the secure element is embedded in one of a chipset embedded on a circuitry of the device, a subscriber identity module (SIM) card, a secure digital (SD) card, a non-volatile memory card, and a housing to be plugged to the device.

52. The non-transitory computer readable storage medium of claim 43, wherein the EMV transaction module is one of a contactless transaction module and a contact transaction module.

53. The non-transitory computer readable storage medium of claim 43, wherein the certification standard is a certification standard from one of EMVCo, MasterCard®

, Visa®

, American Express®

, JCB®

, Discover®

, and PCI SSC.

54. The non-transitory computer readable storage medium of claim 53, wherein the EMV transaction module is certified in accordance with at least one of:

a Level 2 of the certification standard, and a Level 3 of the certification standard.

55. (canceled)

56. (canceled)

57. (canceled)

58. (canceled)

59. (canceled)