Mutual mobile authentication using a key management center

1. A method of authentication, comprising:

sending a challenge message from a mobile gateway to a consumer device, the challenge message being sent in response to a communication request message, wherein the consumer device is configured for use as a payment device;

receiving a challenge response message from the consumer device at the mobile gateway in response to the challenge message; and

sending the challenge response message from the mobile gateway to a key management center, wherein the key management center is configured to manage session keys for communication with the consumer device, wherein the key management center verifies the challenge response message and allows a communication transaction between a first entity and the consumer device if the challenge response message is valid, wherein the key management center sends a session key to the mobile gateway and to the consumer device, the session key allowing communication between the first entity and the consumer device, and wherein the first entity is not contacted until the challenge response message is verified.

2. The method of claim 1 , wherein the session key sent to the mobile gateway is encrypted differently than the session key sent to the consumer device.

3. The method of claim 1 , wherein the first entity is an issuer associated with the consumer device.

4. The method of claim 3 , wherein the communication transaction between the first entity and the consumer device includes issuer updates for the consumer device.

5. The method of claim 3 , wherein the issuer updates include updating parameters for the consumer device, blocking a payment application on the consumer device, unblocking the payment application, disabling payment, unblocking a passcode on the consumer device, changing the passcode on the consumer device, or setting the passcode to a default passcode.

6. The method of claim 3 , wherein the consumer device is associated with a prepaid payment account and wherein the communication transaction between the first entity and the consumer device includes adding funds to the prepaid payment account using a funding account linked to the prepaid payment account.

7. A method of authentication, comprising:

receiving a challenge response message at a key management center from a consumer device via a mobile gateway, the challenge response message being received in response to a challenge message sent by the mobile gateway to the consumer device, wherein the consumer device is configured for use as a payment device;

determining whether the challenge response message is valid; and

sending a secure channel response message from the key management center to the consumer device if the challenge response message is valid, the secure channel response message allowing communication between the consumer device and a first entity, wherein the key management center sends a session key to the mobile gateway and to the consumer device, the session key allowing communication between the first entity and the consumer device, and wherein the first entity is not contacted until the challenge response message is verified.

8. The method of claim 7 , further comprising sending a session key to the mobile gateway and to the consumer device, the session key allowing communication between the first entity and the consumer device.

9. The method of claim 7 , wherein the first entity is an issuer associated with the consumer device, the communication between first entity and the consumer device including issuer updates for the consumer device.

10. The method of claim 7 , wherein the consumer device is associated with a prepaid payment account and wherein the communication between the first entity and the consumer device includes adding funds to the prepaid payment account using a funding account linked to the prepaid payment account.

11. A system, comprising:

a mobile gateway, the mobile gateway being configured to send a challenge message to a consumer device and receive a challenge response message from the consumer device in response to the challenge message, wherein the consumer device is configured for use as a payment device; and

a key management center in communication with the mobile gateway, the key management center being configured to receive the challenge response message from the mobile gateway, determine whether the challenge response message is valid, and send a secure channel response message to the consumer device if the challenge response message is valid, the secure channel response message allowing communication between the consumer device and a first entity, wherein the key management center sends a session key to the mobile gateway and to the consumer device, and wherein the first entity is not contacted until the challenge response message is verified.

12. The system of claim 11 , wherein the key management center manages session keys for creating secure channels.

13. The system of claim 11 , wherein the session key sent to the mobile gateway is encrypted differently than the session key sent to the consumer device.

14. The system of claim 11 , wherein the first entity is an issuer associated with the consumer device and wherein the communication between the consumer device and the first entity includes updating parameters for the consumer device, blocking a payment application on the consumer device, unblocking the payment application, disabling payment, unblocking a passcode on the consumer device, changing the passcode on the consumer device, or setting the passcode to a default passcode.

15. A server computer, comprising:

a processor; and

a computer-readable storage medium having code embodied thereon, the code being configured to cause the processor to perform a method comprising:

receiving a challenge response message from a consumer device via a mobile gateway, the challenge response message being received in response to a challenge message sent by the mobile gateway to the consumer device, wherein the consumer device is configured for use as a payment device;

determining whether the challenge response message is valid;

sending a secure channel response message to the consumer device if the challenge response message is valid, the secure channel response message allowing communication between the consumer device and a first entity; and

sending a session key to the mobile gateway and to the consumer device, the session key allowing communication between the first entity and the consumer, and wherein the first entity is not contacted until the challenge response message is verified.

16. The server computer of claim 15 , wherein the first entity is an issuer associated with the consumer device, the communication between the first entity and the consumer device including issuer updates for the consumer device.

17. The server computer of claim 15 , wherein the consumer device is associated with a prepaid payment account and wherein the communication between the first entity and the consumer device includes adding funds to the prepaid payment account using a funding account linked to the prepaid payment account.

18. The server computer of claim 15 , wherein the first entity is an issuer associated with the consumer device and wherein the communication between the consumer device and the first entity includes updating parameters for the consumer device, blocking a payment application on the consumer device, unblocking the payment application, disabling payment, unblocking a passcode on the consumer device, changing the passcode on the consumer device, or setting the passcode to a default passcode.

19. The method of claim 1 , wherein the mobile gateway communicates with the consumer device over a first network and wherein the mobile gateway communicates with the first entity over a second network, wherein the first network and the second network are different, and wherein the first network is a mobile network.

20. The method of claim 3 , wherein the session key is derived from a master key associated with the issuer and stored at the key management center.

21. The method of claim 1 , wherein the consumer device comprises a mobile application that is provisioned by a trusted service manager associated with an issuer.