Methods for processing secure financial transactions using commercial off-the-shelf or IoT devices

Abstract

A system and method for processing secure financial transactions using commercial off-the-shelf or Internet of Things devices. The method includes requesting a trusted application manager to verify the identity of the commercial off-the-shelf or Internet of Things device, and executing the application on the commercial off-the-shelf or Internet of Things device. After verification, the trusted application manager installs the trusted application in a trusted execution environment of the commercial off-the-shelf or Internet of Things device. In addition, a resonant response is triggered when a tag is within a predetermined distance from the commercial off-the-shelf or Internet of Things device on which the trusted application is installed, and tag information is received from the tag. Finally, based on the received tag information, a secure financial transaction using the commercial off-the-shelf or Internet of Things device is processed by accessing the trusted execution environment. The off-the-shelf or Internet of Things device includes a distributed ledger, and the distributed ledger includes information corresponding to at least one of ownership, manufacturing, and usage information of the off-the-shelf or Internet of Things device.

Description

Technical Field

[0001] The present invention generally relates to digital payments. More specifically, but not exclusively, the present invention relates to secure financial payment methods and devices based on Commercial off-the-shelf (COTS) / Internet of Things (IoT) devices. Background Art

[0002] In the digital world that accompanies the trend of digital economy, users have an increasing demand for security. As modern systems become more complex, open and interconnected, new challenges arise. Traditional security technologies can no longer meet the security needs of such architectures. Here is a clear explanation of the latest trends in integrating trusted computing concepts into embedded systems.

[0003] Specifically, in order to perform secure processing on COTS / IoT devices, especially those involving money transfers, there are often deficiencies in trust and identification. Various efforts have been made to address the issues of trust, tamper-proof identification, and compliance with regulatory agencies when it comes to money transfers. However, most, if not all, of the solutions proposed are primarily from a software protection perspective, involving external ecosystem support, high costs, and susceptibility to tampering.

[0004] In view of the foregoing, there is a need for new and / or improved techniques to facilitate secure financial payments using COTS / IoT devices without compromising the trust and identity of the COTS / IoT devices processing such transactions. Summary of the invention

[0005] Therefore, an improved technology is needed to solve the above problems. In order to meet this demand, a system and method for processing secure financial transactions using commercial off-the-shelf or IoT devices are provided. The method includes requesting a trusted application manager (TAM) to verify the identity of the COTS / IoT device and executing an application on the COTS / IoT device. After verification, the TAM installs a trusted application (TA) in the trusted execution environment (TEE) of the COTS / IoT device. In addition, a resonant response is triggered when the tag is within a predetermined distance from the COTS / IoT device on which the TA is installed, and tag information is received from the tag. Finally, based on the received tag information, secure financial transactions using COTS / IoT devices are processed by accessing the TEE.

[0006] In another embodiment, a COTS / IoT device includes a distributed ledger, and wherein the distributed ledger includes information corresponding to at least one of COTS / IoT device ownership, manufacturing, and usage information.

[0007] In yet another embodiment, the information corresponding to the COTS / IoT device in the distributed ledger is modified through the TEE.

[0008] In yet another embodiment, the application is executed in an operating system of a COTS / IoT device.

[0009] In yet another embodiment, the TAM is a remote system that verifies the identity of a COTS / IoT device and installs the TA in the TEE of the COTS / IoT device.

[0010] In yet another embodiment, the resonance response is performed multiple times, and the distance of the tag from the COTS / IoT device is calculated for each of the multiple resonance responses.

[0011] In yet another embodiment, in the event that a reduction in distance is identified in a subsequent resonance response using a COTS / IoT device, a secure financial transaction is initiated.

[0012] In yet another embodiment, a resonant response to calculate distance is implemented using one or more of light proximity, acoustic proximity, or accelerometers to determine a relative distance to initiate payment processing. The relative distance is configurable and used for fraud detection purposes by ensuring that payment is initiated from an authentic / genuine payment card. The distance can be adjusted to accommodate changes to current and future guidelines related to payment schemes.

[0013] In another embodiment, a COTS / IoT device for processing secure financial transactions is provided. The COTS / IoT device is configured to use an operating system portion of a processor to request a trusted application manager (TAM) to verify the device identity and install a trusted application (TA) in a trusted execution environment (TEE) of the COTS / IoT device, wherein the TEE is separated from the operating system of the COTS / IoT device and runs in parallel on the TEE portion of the processor. In addition, the application is executed on the COTS / IoT device. In addition, when the tag is within a predetermined distance from the COTS / IoT device on which the TA is installed, a resonance response is induced using the operating system portion of the processor, and tag information is received from the tag. Finally, in the case where a secure PIN entry is performed, a secure financial transaction using the COTS / IoT device is processed using the TEE portion of the processor based on the received tag information. The COTS / IoT device also includes a distributed ledger, and wherein the distributed ledger includes information corresponding to at least one of ownership, manufacturing, and usage information of the COTS / IoT device.

[0014] According to the following detailed description, other objects, features and advantages of the present invention will become apparent. However, it should be understood that although the preferred embodiments of the present invention are indicated, the detailed description and specific examples are given only by way of illustration, and various modifications can naturally be made without departing from the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] The present disclosure is illustrated by way of example but is not limited to the accompanying drawings. The elements illustrated in the drawings are not necessarily drawn to scale, and similar reference numerals indicate similar elements, wherein:

[0016] Figure 1 is an exemplary simple architecture of a trusted execution environment (TEE) system 100 for secure financial transactions according to an embodiment of the present invention;

[0017] Figure 2 is an exemplary flow chart 200 for deploying a trusted application (TA) in a TEE environment of a COTS / IoT device according to an embodiment of the present invention;

[0018] Figure 3 An exemplary block diagram illustrating a system 300 for secure financial transactions using COTS / IoT devices with additional security by incorporating a distributed ledger in the COTS / IoT devices according to an embodiment of the present invention;

[0019] Figure 4Aand Figure 4B respectively describe an exemplary resonance response and tag discovery, distance or resonance response time calculation according to an embodiment of the present invention; and

[0020] Figure 5 is a flow chart of an exemplary method 500 for processing secure financial transactions using COTS / IoT devices according to an embodiment of the present invention. DETAILED DESCRIPTION

[0021] The following detailed description includes references to the accompanying drawings, which form a part of the detailed description. The accompanying drawings show descriptions according to exemplary embodiments. These exemplary embodiments are described in sufficient detail to enable those skilled in the art to practice the subject matter of the present invention. However, it should be clear to those of ordinary skill in the art that the present invention may also be practiced without these specific details. In other examples, well-known methods, procedures, and components are not described in detail to avoid unnecessary confusion of various aspects of the embodiments. The embodiments may be combined, other embodiments may be adopted, or structural or logical changes may be made without departing from the scope of the present invention. Therefore, the following detailed description should not be considered to have a limiting meaning.

[0022] In this document, as is common in patent documents, the term "a" or "an" is used to include one or more. In this document, the term "or" is used to represent an exclusive "or", so unless otherwise indicated, "A or B" includes "A not B", "B not A", and "A and B".

[0023] It should be understood that the inventive capabilities described in the present disclosure and the elements shown in the accompanying drawings may be implemented in various forms such as hardware, firmware, software, non-transitory computer-readable media, or a combination thereof.

[0024] Embodiments disclose secure financial transaction acceptance techniques for using commercial off-the-shelf (COTS) devices or Internet of Things (IoT) devices. For example, embodiments provide a COTS / IoT device for processing secure financial transactions. The COTS / IoT device is configured to execute applications on the COTS / IoT device using an operating system portion of a processor. In addition, a trusted application manager (TAM) is requested to verify and install a trusted application (TA) in a trusted execution environment (TEE) of the COTS / IoT device using the OS portion of the processor.

[0025] The TEE of the COTS / IoT device is separated from the OS environment of the COTS / IoT device and the two run in parallel. In addition, a resonance response is induced when the tag is within a predetermined distance from the COTS / IoT device, and tag information is received from the tag. In addition, based on the received tag information, a secure financial transaction is processed using the COTS / IoT device by accessing the TEE portion of the processor. The COTS / IoT device also includes a distributed ledger, which includes information corresponding to at least one of ownership, manufacturing, and usage information of the COTS / IoT device.

[0026] Figure 1 1 is an exemplary simple architecture of a Trusted Execution Environment (TEE) system 100 for secure financial transactions according to an embodiment of the present invention. Figure 1 As described in , an operating system (OS) application environment and a trusted execution environment (TEE) coexist in a COTS / IoT device. The TEE includes a small secure core that shares a processor with the OS application environment. Since both critical and non-critical applications run on COTS / IoT devices such as mobile phones, laptops, tablets, and other devices, sensitive elements of critical applications can be executed in the TEE separately from the OS application environment. This provides an additional level of security by protecting the associated code and data from the more vulnerable OS side of the COTS / IoT device. The architecture ensures better data integrity because the data cannot be modified by unauthorized or undetected users / programs. Confidential data or code can be stored in the TEE, and similarly confidential data or code can be stored in the OS in encrypted form without guaranteeing the security level provided by the TEE.

[0027] The execution of a trusted application (TA) in the TEE can affect the execution of applications in the OS, but the execution in the OS cannot interfere with the execution in the TEE. Applications running on the OS can request execution of code or verification of tokens / keys through the TEE client API. In addition, the TEE can execute individual TAs or verify keys / tokens and provide the results to the TEE client API.

[0028] In an embodiment, the COTS / IoT devices may include smartphones, laptops, computers, tablets, smart watches, and other COTS / IoT devices known in the art.

[0029] Figure 2200 is an exemplary flow chart for deploying a trusted application (TA) in a TEE environment of a COTS / IoT device according to an embodiment of the present invention. A trusted application manager (TAM) is a remote server configured to establish communication with the TEE environment of a COTS / IoT device. The TAM can also authorize the installation of a trusted application in the TEE environment of a COTS / IoT device. The TAM can also be configured to push data or other confidential keys for the TA into the TEE.

[0030] An application store can be a platform on which developers / companies can host applications for download. Users of COTS / IoT devices can download applications from an application store. Typical examples of application stores can include Google Play and Apple's App Store, etc.

[0031] Reference Figure 2 , in the flow chart, process 'a' indicates the developer / company involved in developing an application hosted on the app store. It should be understood that for simplicity, the TAM and the developer / company have been grouped together, but it is always possible that the developer / company is different from the TAM. In addition, it should be noted that before the application is moved to the TAM, the application is signed by the TAM or the manufacturer as a trusted application.

[0032] Flow 'b' indicates the creation of a security domain after the application is downloaded and run for the first time in a COTS / IoT device. A security domain is a location where keys can be stored where trusted applications can be encrypted for security at rest.

[0033] In addition, at process 'c', the application requests TAM to approve the installation of TA in TEE. At process 'd', TAM can perform multiple checks such as verifying the identity of the COTS / IoT device, verifying whether the COTS / IoT device is a trusted endpoint, and keeping track of the number of trusted applications deployed, etc., and issue a token / key to authorize the installation of TA in the TEE of the COTS / IoT device after positive verification.

[0034] In addition, at process 'e', ​​the TA is installed in the TEE of the COTS / IoT device and securely stored in the TEE. In addition, the TAM can also share some personalized data with the application. Identifier 'f' indicates the TA loaded into the TEE of the COTS / IoT device, which has been positively verified and installed.

[0035] Figure 3An exemplary block diagram illustrating a system 300 for secure financial transactions using COTS / IoT devices with additional security by incorporating a distributed ledger in the COTS / IoT devices according to an embodiment of the present invention.

[0036] like Figure 3 As illustrated in FIG. 1 , the system 300 includes a COTS / IoT device 1. The COTS / IoT device 1 includes an application for processing secure payments by accessing a trusted application (TA) installed in a TEE. The TEE is separate from the operating system of the COTS / IoT device and runs in parallel on the TEE portion of the processor. In addition, a resonance response is induced when a tag as illustrated in the figure is brought close to the COTS / IoT device.

[0037] In an embodiment, the tag may include, but is not limited to, for example, a credit card, a debit card, a smart watch, a smart bracelet, and other devices capable of storing information related to payment credentials.

[0038] In an embodiment, a resonance response may be triggered only when the tag is within a predetermined distance from the COTS / IoT device. In response to the resonance response, the TAG may share information corresponding to the tag with the COTS / IoT device for processing payment.

[0039] Figure 4A and Figure 4B The exemplary resonance response and tag discovery, distance or resonance response time calculation according to the embodiment of the present invention are respectively described. Figure 4A As indicated in , a TAG can be discovered by a COTS / IoT device when it is within the range of the actual signal strength "m". However, the tag's information may not be received until the tag is within a distance "n" from the COTS / IoT device.

[0040] In an embodiment, the tag distance is continuously monitored after the tag is discovered. In addition, in the event that the distance calculated in the first resonance response is greater than the distance calculated in the second resonance response or subsequent resonance responses and the tag is within a predetermined distance from the COTS / IoT device, the tag information can be received by the COTS / IoT device. A financial transaction can be triggered thereafter.

[0041] In embodiments, different techniques may be suitable for implementing the resonant response, such as, but not limited to, using one or more of optical proximity, acoustic proximity, and relative distance, as well as other techniques known in the art.

[0042] Return to reference Figure 3As described, multiple COTS / IoT devices can share a distributed ledger with each other. This can be implemented using state-of-the-art distributed ledger technologies, such as, but not limited to, blockchain, hashgraph, and other technologies. The distributed ledger can include information corresponding to the unique identification number of the COTS / IoT device, ownership of the COTS / IoT device, usage information of the COTS / IoT device, manufacturing information of the COTS / IoT device, and other information.

[0043] Information corresponding to access to the distributed ledger (such as private keys and other encrypted information) can also be stored in the TEE through updates to the TA via the TAM.

[0044] This enables tracking of ownership details of the device. In addition, crowd leasing can also be facilitated - i.e. giving ownership of the device via a "crowd leasing" approach and actually identifying the individual leasing it. The duration of ownership can also be recorded and this enables distribution of the benefits of leasing as required. Usage / consumption information can include, but is not limited to, estimated life of the device, automatic maintenance, and chargeable usage, etc.

[0045] Figure 5 5 is a flow chart of an exemplary method 500 for processing secure financial transactions using COTS / IoT devices according to an embodiment of the present invention. Method 500 can be implemented in a COTS / IoT device. The COTS / IoT device is embedded with a unique key during the manufacturing stage. In addition, the developer application can be signed by the TAM so that the TA can be installed in the TEE of the COTS / IoT device. At step 502, a request to install a trusted application in the TEE of the COTS / IoT device can be sent to the TAM. In addition, at step 504, after positive verification, the application can be executed on the COTS / IoT device.

[0046] Furthermore, at step 506, a resonant response may be triggered when the tag is found within a predetermined distance from the COTS / IoT device. Thereafter, at step 508, secure financial transactions using the COTS / IoT device are processed by accessing the TEE using information from the tag. Furthermore, at step 510, a distributed ledger such as a blockchain or hashgraph may be implemented to maintain a ledger in all COTS / IoT devices. The distributed ledger may include information corresponding to ownership, usage information, and manufacturers of the COTS / IoT device, as well as other details.

[0047] In the foregoing detailed description, several specific details, examples, and situations are explained to help a thorough understanding of the present invention. However, embodiments of the present disclosure may also be practiced without these specific details. In addition, these examples and situations are for illustration only and are not intended to limit the present disclosure in any way. One of ordinary skill in the art will be able to implement appropriate functions without undue experimentation through the included descriptions. Therefore, the scope of the present invention should be determined by the attached claims and their legal equivalents rather than the details, examples, and situations provided.

[0048] It should be noted that the above method is described as a series of steps; this is a process for illustrative purposes only. Therefore, it should be understood that some steps can be added, some steps can be omitted, the order of the steps can be rearranged, or some steps can be performed simultaneously.

[0049] Although the embodiments have been described with reference to specific exemplary embodiments, it is apparent that various combinations, modifications, additions and omissions may be made to these embodiments without departing from the broader spirit and scope of the foregoing disclosure and the appended claims. Therefore, the specification and drawings should be viewed in an illustrative rather than a restrictive sense. It should be understood that the words or terms used herein are for descriptive and not limiting purposes.

Claims

1. A method for processing secure financial transactions using a commercial off-the-shelf or IoT device, the method comprising: Among the COTS or IoT devices: Requesting a trusted application manager to verify the identity of the device and deploying a trusted application in a trusted execution environment of the COTS or IoT device, wherein the trusted execution environment is separate from and runs in parallel with an operating system of the COTS or IoT device; Execute trusted applications on commercial off-the-shelf or IoT devices; inducing a resonant response when the tag is within a predetermined distance from a commercial off-the-shelf or IoT device on which a trusted application is installed, and receiving tag information from the tag; Based on the received tag information, processing a secure financial transaction using a commercial off-the-shelf or IoT device by accessing the trusted execution environment; Where commercial off-the-shelf or IoT devices include distributed ledgers; wherein after discovery of the tag, the distance of the tag is continuously monitored, whereby in the event that the distance calculated in a first resonance response is greater than the distance calculated in a second resonance response or a subsequent resonance response and the tag is within the predetermined distance from the COTS or IoT device, the tag information can be received by the COTS or IoT device, whereafter a financial transaction can be triggered; wherein a resonant response is implemented using a combination of light proximity, acoustic proximity, or accelerometers, the resonant response being used to calculate and determine the relative distance at which payment processing is initiated; wherein the relative distance is adjustable for fraud detection and compliance with payment schemes; The resonance response is performed a plurality of times, and a distance of the tag from the COTS or IoT device is calculated for each of the plurality of resonance responses; and wherein in the event that a decrease in distance is identified in a subsequent resonance response using the COTS or IoT device, the secure financial transaction is triggered.

2. The method of claim 1, wherein the distributed ledger includes information corresponding to at least one of COTS or IoT device ownership, manufacturing, and usage information.

3. The method of claim 2, wherein information corresponding to the commercial off-the-shelf or IoT device in the distributed ledger is modified by the trusted execution environment.

4. The method of claim 1, wherein the trusted application is executed in an operating system of the commercial off-the-shelf or IoT device.

5. The method of claim 1, wherein the trusted application manager is a remote system that verifies the identity of the COTS or IoT device and installs the trusted application in the trusted execution environment of the COTS or IoT device.

6. A commercial off-the-shelf or IoT device for processing secure financial transactions, the commercial off-the-shelf or IoT device being configured as: Use the operating system portion of the processor to execute applications on commercial off-the-shelf or IoT devices; Using the operating system portion of the processor, requesting a trusted application manager to verify a device identity and install a trusted application in a trusted execution environment of the COTS or IoT device, wherein the trusted execution environment is separate from and runs in parallel with an operating system of the COTS or IoT device; Execute trusted applications on commercial off-the-shelf or IoT devices; inducing a resonance response using the operating system portion of the processor and receiving tag information from the tag when the tag is within a predetermined distance from a commercial off-the-shelf or IoT device having a trusted application installed thereon; processing, using the operating system portion of the processor, a secure financial transaction using the commercial off-the-shelf or Internet of Things device by accessing the trusted execution environment based on the received tag information; Where commercial off-the-shelf or IoT devices include distributed ledgers; wherein after discovery of the tag, the distance of the tag is continuously monitored, whereby in the event that the distance calculated in a first resonance response is greater than the distance calculated in a second resonance response or a subsequent resonance response and the tag is within the predetermined distance from the COTS or IoT device, the tag information can be received by the COTS or IoT device, whereafter a financial transaction can be triggered; wherein a resonant response is implemented using a combination of light proximity, acoustic proximity, or accelerometers, the resonant response being used to calculate and determine the relative distance at which payment processing is initiated; wherein the relative distance is adjustable for fraud detection and compliance with payment schemes; The resonance response is performed a plurality of times, and a distance of the tag from the COTS or IoT device is calculated for each of the plurality of resonance responses; and wherein in the event that a decrease in distance is identified in a subsequent resonance response using the COTS or IoT device, the secure financial transaction is triggered.

7. The COTS or IoT device of claim 6, wherein the distributed ledger includes information corresponding to at least one of COTS or IoT device ownership, manufacturing, and usage information.

8. The COTS or IoT device of claim 7, wherein information corresponding to the COTS or IoT device in the distributed ledger is modified by the trusted execution environment.

Images