METHOD AND SYSTEM FOR SECURING A PAYMENT TRANSACTION WITH A TRUSTED CODE BASE
A mobile payment device 130 provides a trusted code base which obtains a password from a customer for processing a payment transaction and encrypts the password using a public key. Access to the trusted code base by unauthorized processes is prevented to protect the password while unencrypted. The mobile payment device 130 transmits the encrypted password over a network 140 to a transaction host 160 . The transaction host 160 decrypts the encrypted password and applies the decrypted password to process the payment transaction.
1 . A method for obtaining a secure payment transaction, the method performed by a mobile device and comprising the steps of:
(a) providing a trusted code base for obtaining a password from a customer and encrypting the password with a public key;
(b) preventing access to the trusted code base by unauthorized processes; and
(c) transmitting the public key encrypted password via a network to a cryptographic conversion host that decrypts the public key encrypted password with a private key, encrypts the decrypted password with a secret key and provides the secret key encrypted password to a transaction host that decrypts the secret key encrypted password with an identical secret key and applies the decrypted password to process the payment transaction.
2 . The method of claim 1 wherein the payment transaction is an electronic benefit transfer transaction.
3 . The method of claim 1 wherein the step of (a) providing a trusted code base comprises storing the password in a volatile memory and, after encrypting the password, erasing the password in volatile memory.
4 . The method of claim 1 , further comprising the step of digitally signing the trusted code base.
5 . The method of claim 4 wherein the step of providing a trusted code base comprises providing a digital certificate of the cryptographic conversion host and compiling the digital certificate into the trusted code base before digitally signing the trusted code base.
6 . The method of claim 1 wherein the mobile device is a mobile phone
7 . The method of claim 1 wherein the mobile device is a personal digital assistant.
8 . The method of claim 1 wherein the password is a personal identification number associated with the customer.
9 . The method of claim 1 wherein step (a) comprises disabling tone emissions in the mobile device during entry of the password.
10 . The method of claim 1 wherein step (a) comprises encrypting the password with an RSA public key.
11 . A mobile device for obtaining a secure payment transaction, the mobile payment device comprising:
(d) a trusted code base to which access by unauthorized processes is prevented, the trusted code base obtaining a password from a customer, storing the password, and encrypting the password with a public key; and
(e) means for transmitting the public key encrypted password via a network to a cryptographic conversion host that decrypts the public key encrypted password with a private key, encrypts the decrypted password with a secret key and provides the secret key encrypted password to a transaction host that decrypts the secret key encrypted password with an identical secret key and applies the decrypted password to process the payment transaction.
12 . The mobile device of claim 11 wherein the payment transaction is an electronic benefit transfer transaction.
13 . The mobile device of claim 11 , further comprising a volatile memory, and wherein the trusted code base comprises means for storing the password in the volatile memory and, after encrypting the password, erasing the password in volatile memory.
14 . The mobile device of claim 11 , further comprising the step of digitally signing the trusted code base.
15 . The mobile device of claim 14 wherein the step of providing a trusted code base comprises providing a digital certificate of the cryptographic conversion host and compiling the digital certificate into the trusted code base before digitally signing the trusted code base.
16 . The mobile device of claim 11 wherein the mobile device is a mobile phone.
17 . The mobile device of claim 11 wherein the mobile device is a personal digital assistant.
18 . The mobile device of claim 11 wherein the password is a personal identification number associated with the customer.
19 . The mobile device of claim 11 wherein the trusted code base disables tone emissions in the mobile device during entry of the password.
20 . The mobile device of claim 11 wherein the trusted code base encrypts the password with an RSA public key.