COTS Device Secure Payment Processing via Software Attestation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Small businesses face significant challenges in converting commercial-off-the-shelf (COTS) devices into point of sale systems without compromising payment credentials or requiring additional hardware.
Innovation Solution
A secure application program is installed on the COTS device, which establishes a secure connection with a back-end system for attestation and processes payment credentials using native near field communication capabilities, ensuring security and eliminating the need for additional hardware.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If additional hardware elements are used to convert a computing device into a point of sale device, then payment credential security is improved, but device complexity and cost increase
Solution Approach 1:
The patent extracts the security-critical functions (payment credential storage, encryption, and secure communication) from the main COTS device and implements them through a secure application program with protected memory regions and cryptographic operations. This allows the COTS device to function as a POS device without requiring additional specialized hardware elements.
Solution Approach 2:
The patent introduces a secure application program as an intermediary layer between the NFC interface and the external system. This intermediary handles all payment credential operations securely, mediating between the hardware capabilities and security requirements without needing additional hardware security modules.
2Adaptability or versatility
If additional hardware elements are used to convert a computing device into a point of sale device, then payment processing capability is improved, but cost increases
Solution Approach 1:
The patent makes the COTS device universally capable of payment processing by implementing a secure application program that can handle various payment credential types (credit cards, debit cards, mobile payments) through the existing NFC interface. The same hardware infrastructure supports multiple payment functions without requiring specialized hardware for each payment type.
Solution Approach 2:
The COTS device serves itself as a complete POS system by utilizing its built-in NFC capabilities combined with the secure application program. The device independently performs payment credential receipt, encryption, and secure transmission without requiring external specialized hardware components that would need to be integrated and maintained.
3Device complexity
If a secure application program is used instead of additional hardware, then device complexity is reduced, but security requirements increase
Solution Approach 1:
The secure application program performs preliminary security actions by establishing encrypted communication channels before payment credential transmission and by pre-configuring secure memory regions for credential storage. Attestation protocols are executed in advance to verify the integrity of the secure environment, ensuring security is maintained without requiring complex hardware verification processes.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method (400) for secured receipt and usage of payment credentials using a commercial-off-the-shelf, COTS, device (102) includes: storing (402), in the COTS device, a secure application program; establishing (404), by the program (208), a secure communication channel with a back-end system (108); exchanging (406) attestation data between the program (208) and the back-end system (108) using the communication channel; receiving (408) payment credentials from a payment card (104) by a near field communication, NFC, interface (210) in the COTS device (102); transmitting (410) the payment credentials to the program (208) by the NFC interface (210); enciphering (412), by the program (208), the payment credentials; and transmitting (414), by the program (208) of the COTS device (102), the enciphered payment credentials to the back-end system (108) using the secure communication channel.