Virtual Terminal Encryption Using a Secure Element for Data Transfer
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data transmission methods in electronic devices lack robust encryption and decryption mechanisms to secure sensitive data, particularly in multipurpose devices like smartphones and tablets, exposing transaction data to potential unauthorized access.
Innovation Solution
A virtual terminal system integrated into multipurpose devices, utilizing a secure element and encryption keys to encrypt transaction data, ensuring secure data transfer through multiple layers of encryption and decryption, involving a PAN server public key, transport server public key, and a key encryption key (KEK), with separate backends for verification and reencryption to maintain data privacy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If data is transmitted without robust encryption mechanisms, then data transmission speed and simplicity are improved, but security and protection of sensitive data deteriorate
Solution Approach 1:
The encryption process is segmented into multiple distinct stages: initial encryption of transaction data, encryption of the encryption key itself, and transmission of both encrypted components separately. This segmentation allows security operations to be distributed and optimized without compromising transmission speed.
Solution Approach 2:
Encryption operations are performed preliminarily before data transmission occurs. The transaction data is encrypted and the encryption key is encrypted in advance, so that during actual transmission only encrypted data needs to be moved, maintaining speed while ensuring security is already in place.
2Reliability
If multiple layers of encryption are applied to secure data, then data security is improved, but system complexity increases
Solution Approach 1:
A secure element acts as an intermediary component that handles the complex encryption operations. This dedicated security module isolates the complexity of multi-layer encryption from the main system, providing robust security while keeping the overall system architecture clean and manageable.
Solution Approach 2:
The encryption system is designed to handle multiple types of data (transaction data, encryption keys, authentication information) through a unified multi-layer encryption approach. This universal encryption framework secures various data types without requiring separate complex systems for each.
3Reliability
If encryption keys are stored securely, then data protection is improved, but access time and processing overhead increase
Solution Approach 1:
The encryption key is extracted and encrypted separately from the transaction data, and both are processed independently through the encryption pipeline. This extraction allows the key to be handled with specialized security measures without delaying the overall encryption process, as key encryption occurs in parallel with data encryption preparation.
Data Source
AI summary
Techniques for using a virtual terminal on a device to process a data transfer are described herein. These techniques provide the use of a virtual terminal for transfer of data, encryption of the data, and rewrapping the data. A virtual terminal receives virtual terminal kernel configuration data, configuring the terminal with a first public encryption key. The virtual terminal generates a second encryption key only known by the virtual terminal. The virtual terminal encrypts the second encryption key with the first public encryption key. The second encryption key is used to encrypt data for data transfer. The virtual terminal is associated with a secure element of a device that is outside the normal processor of the device. The secure element is designed for encryption.