Efficient authentic communication system and method

1. A method comprising:

transmitting, by an access device to a communication device, a resource provider certificate and an access device certificate;

establishing a secure channel between the access device and the communication device using data from the resource provider certificate and the access device certificate; and

transmitting to or receiving data from the communication device using the secure channel,

wherein before the secure channel is established, the communication device:

determines a resource provider public key using data in the resource provider certificate and a certificate authority public key;

determines an access device public key using data in the access device certificate and the resource provider public key; and

derives a first session key using the access device public key and a communication device private key, wherein the first session key is used to form the secure channel.

2. The method of claim 1 , further comprising:

receiving, by the access device, a communication device public key; and

determining a second session key corresponding to the first session key using an access device private key and the communication device public key.

3. The method of claim 2 , wherein the communication device public key is a blinded public key.

4. The method of claim 3 , wherein the first and second session key are also each determined using an unpredictable number and a random number.

5. The method of claim 3 , wherein after the secure channel is established, the method further comprises:

receiving, by the access device, the communication device public key and a blinding factor; and

verifying, by the access device, that the blinded public key is equal to the communication device public key blinded with the blinding factor.

6. The method of claim 1 , further comprising:

receiving, by the access device from a resource provider computer, the resource provider certificate and the access device certificate.

7. The method of claim 6 , wherein the resource provider certificate was received from a certificate authority computer, before the resource provider certificate was received by the access device.

8. The method of claim 1 , wherein the access device and the communication device form the secure channel without authenticating each other.

9. The method of claim 1 further comprising:

receiving, by the access device, at least one certificate from the communication device; and

verifying, by the access device, the least one certificate, thereby verifying the authenticity of data received from the communication device.

10. An access device comprising:

a processor;

a memory device; and

a computer-readable medium coupled to the processor, the computer-readable medium comprising code executable by the processor for implementing a method comprising:

transmitting, to a communication device, a resource provider certificate and an access device certificate;

establishing a secure channel between the access device and the communication device using data from the resource provider certificate and the access device certificate; and

transmitting to or receiving data from the communication device using the secure channel,

wherein before the secure channel is established, the communication device:

determines a resource provider public key using data in the resource provider certificate and a certificate authority public key;

determines an access device public key using data in the access device certificate and the resource provider public key; and

derives a first session key using the access device public key and a communication device private key, wherein the first session key is used to form the secure channel.

11. A method comprising:

receiving, by a communication device from an access device, a resource provider certificate and an access device certificate;

establishing a secure channel between the access device and the communication device using data from the resource provider certificate and the access device certificate; and

transmitting to or receiving data from the access device using the secure channel,

wherein before the secure channel is established, the method further comprises:

determining, by the communication device, a resource provider public key using data in the resource provider certificate and a certificate authority public key;

determining, by the communication device, an access device public key using data in the access device certificate and the resource provider public key; and

deriving, by the communication device, a first session key using the access device public key and a communication device private key, wherein the first session key is used to form the secure channel.

12. The method of claim 11 , wherein before the secure channel is established, the access device:

receives a communication device public key; and

determines a second session key corresponding to the first session key using an access device private key and the communication device public key.

13. The method of claim 12 , wherein the communication device public key is a blinded public key.

14. The method of claim 13 , wherein the first and second session key are also each determined using an unpredictable number and a random number.

15. The method of claim 11 , wherein the access device:

receives, from a resource provider computer, the resource provider certificate and the access device certificate.

16. The method of claim 11 , wherein the access device and the communication device form the secure channel without authenticating each other.

17. The method of claim 11 further comprising:

providing, by the communication device, at least one certificate to the access device, wherein the access device:

verifies the at least one certificate, thereby verifying the authenticity of data received from the communication device.

18. The method of claim 11 , wherein the communication device is a mobile phone.