Tamper-resistant secure methods, systems and apparatuses for credit and debit transactions
View Patent ↗An electronic payment transaction involves operating a gateway device in an electronic payment system to receive first encrypted transaction data from a merchant device, wherein the first encrypted transaction data is encrypted by means of a merchant device-specific encrypting key. Decrypted transaction data is produced by using a merchant device-specific decrypting key to decrypt the first encrypted transaction data. Second encrypted transaction data is derived from the decrypted transaction data, wherein the second encrypted transaction data is encrypted by means of a gateway device-specific encrypting key. The gateway device communicates the second encrypted transaction data to another electronic payment system server. A key transmission block received from the merchant device includes information that enables the gateway device to derive the merchant device-specific decryption key.
1. A method of securely communicating data in a communication network, the method comprising:
a gateway device receiving a key transmission block from a first device, wherein the key transmission block includes an encrypted copy of a first device-specific decrypting key and one or more key-related parameters;
the gateway device using the one or more key-related parameters to derive a decrypting key that is associated with the gateway device;
the gateway device using the decrypting key that is associated with the gateway device to decrypt the encrypted copy of the first device-specific decrypting key;
the gateway device receiving first encrypted transaction data from the first device, wherein the first encrypted transaction data is encrypted by means of a first device-specific encrypting key;
the gateway device producing decrypted transaction data by using the first device-specific decrypting key to decrypt the first encrypted transaction data;
the gateway device deriving second encrypted transaction data from at least a portion of the decrypted transaction data, wherein the second encrypted transaction data is encrypted by means of a host-specific encrypting key; and
the gateway device communicating the second encrypted transaction data to another host device.
2. The method of claim 1 , wherein the decrypting key associated with the gateway device is an asymmetric private key of the gateway device.
3. The method of claim 1 , wherein the first device-specific encrypting key is the same as the first device-specific decrypting key.
4. A gateway server for securely communicating data in a communication network, the gateway server comprising:
circuitry configured to receive a key transmission block from a first device, wherein the key transmission block includes an encrypted copy of a first device-specific decrypting key and one or more key-related parameters;
circuitry configured to use the one or more key-related parameters to derive a decrypting key that is associated with the gateway server;
circuitry configured to use the decrypting key that is associated with the gateway server to decrypt the encrypted copy of the first device-specific decrypting key;
circuitry configured to receive first encrypted transaction data from the first device, wherein the first encrypted transaction data is encrypted by means of a first device-specific encrypting key;
circuitry configured to produce decrypted transaction data by using the first device-specific decrypting key to decrypt the first encrypted transaction data;
circuitry configured to derive second encrypted transaction data from at least a portion of the decrypted transaction data, wherein the second encrypted transaction data is encrypted by means of a host-specific encrypting key; and
circuitry configured to communicate the second encrypted transaction data to another server of the communication network.
5. The gateway server of claim 4 , wherein the decrypting key associated with the gateway server is an asymmetric private key of the gateway server.
6. The gateway server of claim 4 , wherein the first device-specific encrypting key is the same as the first device-specific decrypting key.