Method, device and secure element for conducting a secured financial transaction on a device
A device and a secure element for conducting a secured financial transaction are disclosed. The device comprises a central processing unit; a communication interface for establishing a communication between the device and a financial institution related to a financial account; an interface for acquiring data relating to the financial account; the secure element for processing at least a portion of the data relating to the financial account acquired by the interface; and control logic for acquiring a purchase amount to be debited from the financial account and for obtaining a transaction authorization from the financial institution related to the financial account, the transaction authorization being based, at least partially, on data processed solely by the secure element independently of data processed by the central processing unit. A method of conducting the secured financial transaction, and a computer program product for execution by the secure element are also disclosed.
1. A method for managing a mobile device used as a payment terminal, the mobile device being distinct from a dedicated payment terminal, the mobile device implementing Point of Sale (POS) functionality provided by a secure element coupled to the mobile device, the secure element being configured to execute a payment acceptance applet, the method comprising:
receiving, by a remote system via a network between the remote system and the mobile device, credentials from a payment application being executed by a central processing unit (CPU) of the mobile device;
validating, by the remote system, the credentials received from the payment application;
establishing, by the remote system via the network, a secure communication between the remote system and a security domain of the secure element corresponding to the remote system based on the credentials being validated, the secure communication to enable loading of payment acceptance applets, wherein the secure element prevents the remote system from accessing other security domains of the secure element, and wherein the payment application is prevented from accessing data transmitted via the secure communication;
loading, by the remote system via the secure communication, the payment acceptance applet on the secure element, the payment acceptance applet selected based on a configuration of the mobile device;
activating, by the remote system via the secure communication, the payment acceptance applet;
performing a mutual authentication between the remote system and the payment acceptance applet; and
loading, by the remote system, at least one of a cryptographic certificate or a private key in the payment acceptance applet.
2. The method of claim 1 , wherein the secure communication is established prior to loading, by the remote system, the payment acceptance applet on the secure element.
3. The method of claim 1 , wherein the remote system is at least one of a trusted service manager, a financial institution server or a third party server.
4. The method of claim 1 , further comprising loading, by the remote system, in the payment acceptance applet, configuration data specific to a user of the mobile device.
5. The method of claim 4 , wherein the configuration data comprises at least one of a remote system's hostname, connection credentials, custom tags, activated payment modules, country codes or currencies.
6. The method of claim 1 , wherein establishing the secure communication includes:
establishing the secure communication via a non-secured communication channel or a partially-secured communication channel; and
securing the secure communication via usage of encryption keys or certificates.
7. The method of claim 1 , wherein the network is a cellular data network.
8. The method of claim 1 , wherein the security domain is isolated from the other security domains.
9. A method for operating a mobile device used as a payment terminal, the mobile device being distinct from a dedicated payment terminal, the mobile device implementing Point of Sale (POS) functionality provided by a secure element coupled to the mobile device, the secure element being configured to execute a payment acceptance applet, the method comprising:
transmitting, to a remote system via a network between the remote system and the mobile device, credentials from a payment application being executed by a central processing unit (CPU) of the mobile device;
establishing, via a network between the remote system and the mobile device, a secure communication between the remote system and a security domain of the secure element corresponding to the remote system based on the credentials being validated, the secure communication to enable loading of payment acceptance applets, wherein the secure element prevents the remote system from accessing other security domains of the secure element, and wherein the payment application is prevented from accessing data transmitted via the secure communication;
loading the payment acceptance applet on the secure element via the secure communication, the payment acceptance applet having been selected from a plurality of payment acceptance applets based on a configuration of the mobile device;
activating the payment acceptance applet via the secure communication;
performing a mutual authentication between the remote system and the payment acceptance applet; and
loading at least one of a cryptographic certificate or a private key in the payment acceptance applet.
10. The method of claim 9 , wherein the secure communication is established prior to loading the payment acceptance applet on the secure element.
11. The method of claim 9 , wherein the remote system is at least one of a trusted service manager, a financial institution server or a third party server.
12. The method of claim 9 , further comprising loading, in the payment acceptance applet, configuration data specific to a user of the mobile device.
13. The method of claim 12 , wherein the configuration data comprises at least one of a remote system's hostname, connection credentials, custom tags, activated payment modules, country codes or currencies.
14. The method of claim 12 , wherein the secure communication is based on encryption keys.
15. A system for remotely managing a mobile device used as a payment terminal, the mobile device being distinct from a dedicated payment terminal, the mobile device implementing Point of Sale (POS) functionality provided by a secure element, the secure element being configured to execute a payment acceptance applet, the system comprising a non-transitory computer readable storage medium comprising computer-executable instructions, a central processing unit and a communication interface, the computer-executable instructions, upon execution, causing to execute:
receiving, by the system via a network between the system and the mobile device, credentials from a payment application being executed by a central processing unit (CPU) of the mobile device;
validating, by the system, the credentials received from the payment application;
selecting, based on a configuration of the mobile device, from a plurality of payment acceptance applets, the payment acceptance applet;
establishing, via a network between the system and the mobile device, a secure communication between the system and a security domain of the secure element corresponding to the system based on the credentials being validated, the secure communication to enable loading of payment acceptance applets, wherein the secure element prevents the remote system from accessing other security domains of the secure element, and wherein the payment application is prevented from accessing data transmitted via the secure communication;
loading the selected payment acceptance applet on the secure element via the secure communication;
activating the payment acceptance applet via the secure communication;
performing a mutual authentication between the system and the payment acceptance applet; and
loading at least one of a cryptographic certificate or a private key in the payment acceptance applet.
16. The system of claim 15 , wherein the secure communication is established prior to loading the payment acceptance applet on the secure element.
17. The system of claim 15 , wherein the system is at least one of a trusted service manager, a financial institution server or a third party server.
18. A mobile device used as a payment terminal, the mobile device being distinct from a dedicated payment terminal, the mobile device being configured to run a point of sale (POS) application and to operate a secure element, the mobile device comprising a non-transitory computer readable storage medium comprising computer-executable instructions, a central processing unit, a contactless interface and a communication interface, the computer-executable instructions, upon execution, causing to execute:
transmitting, to a remote system via a network between the remote system and the mobile device, credentials from a payment application being executed by the central processing unit of the mobile device;
establishing, via a network between the remote system and the mobile device, a secure communication between the remote system and a security domain of the secure element corresponding to the remote system based on the credentials being validated, the secure communication to enable loading of payment acceptance applets, wherein the secure element prevents the remote system from accessing other security domains of the secure element, and wherein the payment application is prevented from accessing data transmitted via the secure communication;
loading a payment acceptance applet on the secure element via the secure communication, the payment acceptance applet having been selected from a plurality of payment acceptance applets based on a configuration of the mobile device;
activating the payment acceptance applet via the secure communication;
performing a mutual authentication between the remote system and the payment acceptance applet; and
loading at least one of a cryptographic certificate or a private key in the payment acceptance applet.
19. The mobile device of claim 18 , wherein the secure communication is established prior to loading the payment acceptance applet on the secure element.
20. The mobile device of claim 18 , further comprising loading, in the payment acceptance applet, configuration data specific to a user of the mobile device.