Small form-factor cryptographic expansion device

• US 9,426,127 B2
• Filed: 05/02/2013
• Issued: 08/23/2016
• Est. Priority Date: 05/02/2012
• Status: Active Grant

• Current Assignee: Visa International Service Association (Visa, Inc.)
• Original Assignee: Visa International Service Association (Visa, Inc.)
• Inventors: Huxham, Horatio Nelson, O'Regan, Alan Joseph
• Primary Examiner(s): Najjar, Saleh
• Assistant Examiner(s): ALMEIDA, DEVIN E
• Application Number:
  US13/875,985
• Publication Number:
  US 20130294602A1
• Time in Patent Office: 1,209 Days
• US Class Current: 1/1
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 9/0625 with splitting of the data block into left and right halves, e.g. Feistel based algorithms, DES, FEAL, IDEA or KASUMI
• CPC Class Codes: H04L 9/0631 Substitution permutation network [SPN], i.e. cipher composed of a number of stages or rounds each involving linear and nonlinear transformations, e.g. AES algorithms
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/03 Protecting confidentiality, e.g. by encryption
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 88/02 Terminal devices

Abstract

A cryptographic expansion device that can be attached to a communication component of a communication device to enable the communication device to perform cryptographic operations on communications sent to and from the communication device is described. The cryptographic expansion device can be a small-form factor cryptographic expansion device that can be used with a small-form factor communication component such as a micro-SIM (subscriber identity module) card. When used with a communication device, the cryptographic expansion device enables the communication device to send and received end-to-end secure encrypted communications. The end-to-end secure communications enabled by the cryptographic expansion device can be utilized by a user of the communication device to perform financial and/or banking transactions.

Claims

1. A label comprising:

a top electrical contact plate on top of the label for interfacing to a communication device;

a bottom electrical contact plate on bottom of the label for interfacing to a communication component;

a substrate disposed between the top electrical contact plate and the bottom electrical contact plate; and

a hardware security module embedded within the substrate and disposed entirely between a top planar area spanned by the top electrical contact plate and a bottom planar area spanned by the bottom electrical contact plate, wherein the hardware security module is coupled to the top and bottom electrical contact plates, and includes a secure processing unit and a public processing unit,

wherein the public processing unit includes a communication device interface coupled to the top electrical contact plate, and a communication component interface coupled to the bottom electrical contact plate, and

wherein the public processing unit is configured to process messages received at the communication device interface and the communication component interface, and to send, to the secure processing unit, requests to perform cryptographic operations in response to receiving messages on the communication device interface that are associated with secure operations.

2. The label of claim 1, further comprising an adhesive material disposed on the bottom of the label to attach the label to the communication component.

3. The label of claim 1, wherein the communication component is a Subscriber Identity Module (SIM) card.

4. The label of claim 1, wherein the top electrical contact plate includes a first set of grooves to define a first set of electrical contacts, and the bottom electrical contact plate includes a second set of grooves to define a second set of electrical contacts.

5. The label of claim 1, wherein the public processing unit is configured to pass through messages that are associated with non-secure operations between the communication device interface and the communication component interface.

6. The label of claim 1, wherein the secure operations include sending secure communications using a communication protocol selected from a group consisting of Short Message Service (SMS) protocol, Unstructured Supplementary Service Data (USSD) protocol, Near Field Communication (NFC) protocol, and Radio Frequency (RF) communications protocol.

7. The label of claim 6, wherein the secure communications are used in financial transactions.

8. A system comprising:

a communication component; and

a label attached to the communication component, the label comprising;

a top electrical contact plate on top of the label;

a bottom electrical contact plate on bottom of the label and electrically coupled to the communication component;

a cryptoprocessor embedded in the label between the top and bottom electrical contact plates; and

a processor coupled to the cryptoprocessor and embedded in the label between the top and bottom electrical contact plates, wherein the processor includes a communication device interface coupled to the top electrical contact plate, and a communication component interface coupled to the bottom electrical contact plate,

wherein the cryptoprocessor and the processor are disposed entirely between a top planar area spanned by the top electrical contact plate and a bottom planar area spanned by the bottom electrical contact plate,

wherein the label enables a communication device using the communication component to send encrypted data using the cryptoprocessor in the label, and

wherein the processor is configured to process messages received at the communication device interface and the communication component interface, and to send, to the cryptoprocessor, requests to perform cryptographic operations in response to receiving messages on the communication device interface that are associated with secure operations.

9. The system of claim 8, wherein the communication component is a communication card, and the label is attached to the communication card with an adhesive material.

10. The system of claim 9, wherein the label is configured to render the cryptoprocessor and the processor unusable when an attempt is made to remove the label from the communication card.

11. The system of claim 8, wherein the cryptoprocessor is configured to respond only to encryption and decryption requests from the processor.

12. The system of claim 8, wherein the encrypted data is sent using a communication interface of the communication device.

13. The system of claim 8, wherein the encrypted data is associated with a payment transaction.

14. The system of claim 12, wherein the communications device is a mobile phone, and the communication interface is one of a cellular communications interface for transmitting SMS messages, a cellular communications interface for transmitting USSD messages, a NFC interface, and a RF interface.

15. A method for enabling transmission of secure communications from a communication device using a label having a first and second electrical contact plates respectively on top and bottom of the label, wherein the label is attached to a communication component of the communication device via the second electrical contact plate, the method comprising:

receiving, at the label, a first message;

determining that the first message is associated with a secure operation;

performing, by a cryptographic processor embedded in the label between the first and second electrical contact plates, a cryptographic operation on data associated with the secure operation; and

sending the data processed by the cryptographic processor from the label to the communication device via the first electrical contact plate for transmission in a secure communication,

wherein the cryptographic processor is disposed entirely between a first planar area spanned by the first electrical contact plate and a second planar area spanned by the second electrical contact plate, and

wherein the cryptographic operation is performed in response to an encryption or decryption request sent to the cryptographic processor from a public processor disposed in the label.

16. The method of claim 15, further comprising:

sending the secure communication from the communication device in one of a SMS message, a USSD message, a NFC communication, and a RF communication.

17. The method of claim 15, further comprising:

receiving, in the label, a second message;

determining that the second message is associated with a non-secure operation; and

passing through the second message between the communication component and the communication device.

18. The method of claim 15, wherein the data processed by the cryptographic processor is associated with a financial transaction being conducted with the communication device.

19. The method of claim 15, wherein the cryptographic processor is accessible to both the communication component and the communication device only through the public processor disposed in the label.

20. The method of claim 15, wherein the communication component is a SIM card, and the communication device is a mobile device.