Local trusted services manager for a contactless smart card
Systems, methods, computer programs, and devices are disclosed herein for deploying a local trusted service manager within a secure element of a contactless smart card device. The secure element is a component of a contactless smart card incorporated into a contactless smart card device. An asymmetric cryptography algorithm is used to generate public-private key pairs. The private keys are stored in the secure element and are accessible by a trusted service manager (TSM) software application or a control software application in the secure element. A non-TSM computer with access to the public key encrypts and then transmits encrypted application data or software applications to the secure element, where the TSM software application decrypts and installs the software application to the secure element for transaction purposes.
1. A computer-implemented method for implementing a trusted service manager (TSM) locally within a secure element of a smart card device used for a contactless communication, the method comprising:
storing, in a TSM software application in the secure element of the smart card device, a private encryption key assigned to the TSM software application and a corresponding public encryption key, wherein the TSM software application comprises computer code for executing a transmitting function to request application data, a decrypting function to decrypt an encrypted form of received application data, and an installation function for selecting at least one memory block in the secure element and writing the received application data to the selected at least one memory block;
transmitting, by the transmitting function of the TSM software application, a request for application data to a registered remote non-TSM computer configured to access the public key;
receiving, in the smart card device from the remote non-TSM computer, the requested application data for installation in the secure element of the smart card device, the requested application data comprising at least one of a software application, other than the TSM application, executable in the secure element or data to support an existing software application, other than the TSM application, in the secure element, the received requested application data having been encrypted by the remote non-TSM computer using the public encryption key;
decrypting, by the decrypting function of the TSM software application, the encrypted received application data using the private key; and
writing, by the TSM software application, the decrypted application data to one or more memory blocks of the secure element selected by the TSM software application.
2. The method according to claim 1 , further comprising:
managing, by a user-interface software application on the smart card device and resident outside the secure element, the TSM software application in the secure element, thereby executing inputs at the user-interface software application for transmitting the request for application data to the remote computer, receiving the encrypted application data, and decrypting the encrypted form of the received application data.
3. The method according to claim 2 , wherein the user-interface software application transmits user inputs from a display or a keypad of the smart card device to the TSM software application in the secure element via a secure communication channel.
4. The method according to claim 1 , wherein the encrypted application data is received in the secure element or a secure memory outside the secure element of the smart card device, the secure memory connected to the secure element via a secure communication channel.
5. The method according to claim 1 , wherein the remote non-TSM computer is registered for deploying application data to the smart card device only when the remote computer is in possession of the public key.
6. The method according to claim 1 , wherein the TSM software application further comprises computer code for providing permissions for performing various life-cycle functions on the encrypted application data received in the smart card device, the life-cycle functions including at least one of an initialize function, a start function, a stop function, and a destroy function.
7. The method according to claim 1 , wherein the smart card device is one of a services identity module (SIM) card, a secure digital (SD) memory card, a universal integrated circuit card (UICC), or a mobile communication device having the secure element disposed therein.
8. A computer-implemented system for implementing a trusted service manager (TSM) locally within the secure element of a smart card device used for a contactless payment communication, the system comprising:
a smart card device;
a secure element resident on the device;
a TSM software application resident in the secure element, the TSM software application storing a private encryption key assigned to the TSM software application and a corresponding public encryption key, the TSM software application comprising computer code for executing a transmitting function to request application data, a decrypting function to decrypt an encrypted form of received application data, the received application data received at the smart card device in response to the request from the transmitting function, and an installation function for selecting at least one memory block in the secure element and writing the received application data to the selected at least one memory block, the application data comprising at least one of a software application, other than the TSM application, executable in the secure element or data to support an existing software application, other than the TSM application, in the secure element;
wherein the transmitting function of the TSM software application transmits, to one of a plurality of remote non-TSM computers, a request for application data;
wherein the device receives the encrypted application data in response to the transmitted request, the received application data having been encrypted by the remote non-TSM computer using the public encryption key,
wherein the decrypting function of the TSM software application decrypts the encrypted application data using the private key, and
wherein the installation function of the TSM software application writes the decrypted application data to one or more memory blocks of the secure element selected by the TSM software application.
9. The system according to claim 8 , further comprising:
a user-interface software application resident on the device and outside the secure element that manages the TSM software application in the secure element, thereby executing inputs at the user-interface software application to transmit a request for application data to the remote computer, receive the encrypted application data, and decrypt the encrypted form of the received application data.
10. The system according to claim 9 , wherein the user-interface software application transmits user inputs from a display or a keypad of the smart card device to the TSM software application in the secure element via a secure communication channel.
11. The system according to claim 8 , wherein the encrypted application data is received in the secure element or a secure memory outside the secure element of the smart card device, the secure memory connected to the secure element via a secure communication channel.
12. The system according to claim 8 , wherein each of the plurality of registered remote computers is registered for deploying application data to the smart card device only when the remote computer is in possession of the public key.
13. The system according to claim 8 , wherein the TSM software application further comprises computer code for providing permissions for performing various life-cycle functions on the encrypted application data received in the smart card device, the life-cycle functions including at least one of an initialize function, a start function, a stop function, and a destroy function.
14. The system according to claim 8 , wherein the smart card device is one of a services identity module (SIM) card, a secure digital (SD) memory card, a universal integrated circuit card (UICC), or a mobile communication device having the secure element disposed therein.