Trust-zone End-to-End Payment Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Consumer electronic devices expose sensitive credit card payment information when enrolling for payment transactions, as this information is exchanged between the device and the card network token service provider, making it vulnerable to attackers.
Innovation Solution
Implementing trust-zone-based end-to-end security by generating device certificates and public-private key pairs on the electronic device, which are signed with a unique private key, and using these to encrypt messages with the TSP server's public keys, ensuring only the TSP or the device can decrypt the information, thereby protecting it from intermediaries.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If credit card payment information is exchanged between electronic device and TSP server for enrollment, then payment functionality is enabled, but sensitive information becomes exposed to attackers
Solution Approach 1:
The patent segments the communication process into two distinct phases: certificate exchange phase and payment information exchange phase. By separating these functions, the sensitive payment artifacts never leave the trusted execution environment, while still enabling payment functionality through the certificate-based authentication mechanism.
Solution Approach 2:
The patent introduces device certificates and TSP certificates as intermediary authentication objects. These certificates serve as mediators that enable the TSP server to identify and communicate securely with the electronic device without exposing sensitive payment information. The certificates act as trusted intermediaries that establish secure channels.
2Reliability
If device certificates are exchanged with TSP server, then secure communication is established, but device complexity increases
Solution Approach 1:
The patent performs certificate generation and exchange as a preliminary action during device initialization or first enrollment, before any payment transactions occur. The trusted execution environment automatically handles the certificate creation and exchange process, storing the device certificate locally and sharing it with the TSP server in advance, so that subsequent payment communications can proceed without repeating this complex setup.
Data Source
AI summary
Methods, electronic devices, and systems for exchanging encrypted information. A method for exchanging encrypted information by an electronic device includes generating one or more device certificates and one or more device public private key pairs. The one or more device certificates are signed using a device unique private key that is pre-stored on the electronic device. The method also includes sending the one or more device certificates to a server of a token service provider (TSP). The method further includes receiving one or more TSP certificates from the TSP server. The method includes identifying one or more TSP public keys of the TSP server based on the one or more received TSP certificates. Additionally, the method includes transmitting a message including the information encrypted based on the one or more identified TSP public keys and a signature of the electronic device.