Secure Element Credential Splitting for Online Payment Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The inefficient and insecure use of electronic device secure elements for online financial transactions, particularly in contactless proximity-based communications, where secure use of commerce credentials is often compromised.
Innovation Solution
A multi-path communication system for electronic device secure element data, involving a commercial entity and a financial institution subsystem, where a transaction key is derived based on transaction key data, enabling secure communication of credential data through unconventional paths to enhance security and simplify merchant integration.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If commerce credentials are communicated through the merchant subsystem for online payments, then the payment transaction can be processed, but the sensitive credential data is exposed to the merchant subsystem creating security vulnerabilities
Solution Approach 1:
The credential data is divided into two separate portions: first portion (token information) that is communicated through the merchant subsystem for transaction processing, and second portion (crypto information) that is communicated directly from the electronic device to the financial institution subsystem without passing through the merchant. This segmentation allows the system to maintain security by keeping sensitive crypto data out of merchant systems while still enabling payment processing.
Solution Approach 2:
The commercial entity subsystem acts as an intermediary that receives both portions of credential data from the electronic device and facilitates their separate communication paths to the financial institution subsystem. This intermediary coordinates the multi-path communication, ensuring that the crypto information bypasses the merchant subsystem while the token information can be processed by the merchant.
2Reliability
If multi-path communication is implemented to secure credential data, then security is enhanced, but the system complexity increases
Solution Approach 1:
The commercial entity subsystem performs multiple functions: it receives device transaction data, derives transaction keys, communicates with both the merchant subsystem and financial institution subsystem, and coordinates the multi-path data transmission. By consolidating these functions in a single subsystem, the patent reduces overall system complexity while maintaining the security benefits of multi-path communication.
3Reliability
If credential data is split into multiple portions and communicated through different paths, then security is improved, but the processing time and transaction complexity increases
Solution Approach 1:
The commercial entity subsystem derives the transaction key in advance using the first portion of credential data (token information) before the final payment authorization. This preliminary key derivation enables the system to prepare and validate the crypto information path separately, allowing for more efficient parallel processing and reducing overall transaction time while maintaining security.
Data Source
AI summary
Systems, methods, and computer-readable media for communicating electronic device secure element data over multiple paths for online payments are provided. In one example embodiment, a method includes, inter alia, at a commercial entity subsystem, receiving, from an electronic device, device transaction data that includes credential data indicative of a payment credential on the electronic device for funding a transaction with a merchant subsystem, accessing a transaction identifier, deriving a transaction key based on transaction key data that includes the accessed transaction identifier, transmitting, to one of the merchant subsystem and the electronic device, merchant payment data that includes a first portion of the credential data and the accessed transaction identifier, and sharing, with a financial institution subsystem using the transaction key, commercial payment data that includes a second portion of the credential data that is different than the first portion of the credential data. Additional embodiments are also provided.