Embedding cloud-based functionalities in a communication device

• US 9,775,029 B2
• Filed: 08/24/2015
• Issued: 09/26/2017
• Est. Priority Date: 08/22/2014
• Status: Active Grant

• Current Assignee: Visa International Service Association (Visa, Inc.)
• Original Assignee: Visa International Service Association (Visa, Inc.)
• Inventors: Lopez, Eduardo
• Primary Examiner(s): Chai, Longbit
• Application Number:
  US14/834,028
• Publication Number:
  US 20160057619A1
• Time in Patent Office: 764 Days
• Field of Search: 726 26
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 9/455 Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
• CPC Class Codes: G06Q 20/322 Aspects of commerce using mobile devices [M-devices]
• CPC Class Codes: G06Q 20/3227 using secure elements embedded in M-devices
• CPC Class Codes: G06Q 20/326 Payment applications installed on the mobile devices
• CPC Class Codes: G06Q 20/3263 characterised by activation or deactivation of payment capabilities
• CPC Class Codes: G06Q 20/3265 characterised by personalisation for use
• CPC Class Codes: G06Q 20/327 Short range or proximity payments by means of M-devices
• CPC Class Codes: G06Q 20/3278 RFID or NFC payments by means of M-devices
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: G06Q 20/3825 Use of electronic signatures
• CPC Class Codes: G06Q 20/3829 involving key management
• CPC Class Codes: G06Q 20/385 using an alias or single-use codes
• CPC Class Codes: H04L 63/068 using time-dependent keys, e.g. periodically changing keys cryptographic mechanisms or cryptographic arrangements for controlling usage of secret information H04L9/088
• CPC Class Codes: H04W 12/041 Key generation or derivation
• CPC Class Codes: H04W 12/0431 Key distribution or pre-distribution; Key agreement
• CPC Class Codes: H04W 4/80 Services using short range communication, e.g. near-field communication [NFC], radio-frequency identification [RFID] or low energy communication
• CPC Class Codes: H04W 88/02 Terminal devices

Abstract

Techniques for enhancing the security of a communication device may include providing an application agent that executes in a trusted execution environment of the communication device, and a transaction application that executes in a normal application execution environment of the communication device. The application agent may receive, from the application, a limited-use key (LUK) generated by a remote computer, and store the LUK in a secure storage of the trusted execution environment. When the application agent receives a request to conduct a transaction from the application executing in the normal execution environment, the application agent may generate a transaction cryptogram using the LUK, and provides the transaction cryptogram to an access device.

Claims

1. A portable communication device comprising:

a processor device;

a contactless transceiver coupled to the processor device;

a first memory region storing an application executing in a normal execution environment; and

a second memory region storing an application agent executing in a trusted execution environment,

wherein the application agent receives, from the application executing in the normal execution environment, a limited-use key (LUK) generated by a remote computer and associated with a set of one or more limited-use thresholds that limits usage of the LUK, stores the LUK in a secure storage of the trusted execution environment, receives a request to conduct a transaction from the application executing in the normal execution environment, generates a transaction cryptogram using the LUK, accesses the contactless transceiver, and transmits the transaction cryptogram to an access device via the contactless transceiver, and

wherein the application agent sends a replenishment request for a second LUK to the application executing in the normal execution environment, the replenishment request including transaction log information derived from a transaction log stored in the trusted execution environment, receives the second LUK from the application executing in the normal execution environment when the transaction log information in the replenishment request matches transaction log information at the remote computer, and stores the second LUK in the secure storage of the trusted execution environment.

2. The portable communication device of claim 1, wherein the application agent further stores the transaction log in the secure storage of the trusted execution environment.

3. The portable communication device of claim 1, wherein the contactless transceiver of the portable communication device is not accessible by the application executing in the normal execution environment except via the application agent executing in the trusted execution environment.

4. The portable communication device of claim 1, wherein the application agent executing in the trusted execution environment does not communicate with the remote computer except via the normal execution environment.

5. The portable communication device of claim 1, wherein the trusted execution environment is implemented as a virtual machine or as a secure operating mode of the processor.

6. The portable communication device of claim 1, wherein the transaction log information includes an authentication code computed over at least a portion of the transaction log.

7. A method for enhancing security of a portable communication device, the method comprising:

receiving, from a remote computer by an application executing in a normal execution environment of the portable communication device, a limited-use key (LUK) that is associated with a set of one or more limited-use thresholds that limits usage of the LUK;

sending, by the application executing in the normal execution environment, the LUK to an application agent executing in a trusted execution environment of the portable communication device;

receiving, by the application executing in the normal execution environment, a request to conduct a transaction;

sending, by the application executing in the normal execution environment, the request to conduct the transaction to the application agent executing in the trusted execution environment, wherein the application agent generates a transaction cryptogram using the LUK, and accesses a contactless interface of the portable communication device to transmit the transaction cryptogram to an access device to conduct the transaction;

receiving, from the application agent executing in the trusted execution environment, a replenishment request for a second LUK, the replenishment request including transaction log information derived from a transaction log stored in the trusted execution environment;

sending, by the application executing in the normal execution environment, the replenish request to the remote computer;

receiving, by the application executing in the normal execution environment, the second LUK from the remote computer when the transaction log information in the replenishment request matches transaction log information at the remote computer; and

sending, by the application executing in a normal execution environment, the second LUK to the application agent executing in the trusted execution environment for storage.

8. The method of claim 7, wherein the application agent stores the transaction log in the trusted execution environment.

9. The method of claim 7, wherein the contactless interface of the portable communication device is not accessible by the application executing in the normal execution environment except via the application agent executing in the trusted execution environment.

10. The method of claim 7, wherein the application agent executing in the trusted execution environment does not communicate with the remote computer except via the normal execution environment.

11. The method of claim 7, wherein the trusted execution environment is implemented in a first virtual machine, and the normal execution environment is implemented in a second virtual machine.

12. The method of claim 7, wherein the trusted execution environment is implemented as a secure operating mode in the processor of the portable communication device.

13. The method of claim 7, wherein the transaction log information includes an authentication code computed over at least a portion of the transaction log.

14. A method for enhancing security of a portable communication device, the method comprising:

receiving, by an application agent executing in a trusted execution environment of the portable communication device, a limited-use key (LUK) from an application executing in a normal execution environment of the portable communication device, the LUK associated with a set of one or more limited-use thresholds that limits usage of the LUK, and provided to the application executing in the normal execution environment from a remote computer;

storing, by the application agent executing in the trusted execution environment, the LUK in a secure storage of the trusted execution environment;

receiving, by the application agent executing in the trusted execution environment, a request to conduct a transaction from the application executing in the normal execution environment;

generating, by the application agent executing in the trusted execution environment, a transaction cryptogram using the LUK;

accessing a contactless interface of the portable communication device to transmit the transaction cryptogram to an access device to conduct the transaction;

sending a replenishment request for a second LUK, the replenishment request including transaction log information derived from a transaction log stored in the trusted execution environment;

receiving the second LUK when the transaction log information in the replenishment request matches transaction log information at the remote computer; and

storing the second LUK in a secure storage of the trusted execution environment.

15. The method of claim 14, further comprising:

storing, by the application agent executing in the trusted execution environment, the transaction log in the secure storage of the trusted execution environment.

16. The method of claim 14, wherein the contactless interface of the portable communication device is not accessible to the application executing in the normal execution environment except via the application agent executing in the trusted execution environment.

17. The method of claim 14, wherein the application agent executing in the trusted execution environment does not communicate with the remote computer except via the normal execution environment.

18. The method of claim 14, wherein the trusted execution environment is implemented in a first virtual machine, and the normal execution environment is implemented in a second virtual machine.

19. The method of claim 14, wherein the trusted execution environment is implemented as a secure operating mode in the processor of the portable communication device.

20. The method of claim 14, wherein the transaction log information includes an authentication code computed over at least a portion of the transaction log.