Embedding cloud-based functionalities in a communication device
Techniques for enhancing the security of a communication device may include providing an application agent and a transaction application that executes on a communication device. The application agent may receive, from the application, a cryptogram key generated by a remote computer, and store the cryptogram key on the communication device. When the application agent receives a request to conduct a transaction from the application, the application agent may generate a transaction cryptogram using the cryptogram key, and provides the transaction cryptogram to an access device.
1. A communication device for enhancing security of a portable communication device comprising:
a hardware processor; and
a memory having multiple memory regions and storing application code implementing user interface logic and security code implementing transaction logic, wherein the multiple memory regions includes a separate first memory region and a second memory region,
wherein the transaction logic is configured to receive from a remote computer a first cryptogram key, store the first cryptogram key in the second memory region, receive a request to conduct a transaction from the user interface logic, generate a transaction cryptogram using the first cryptogram key, and transmit the transaction cryptogram to an access device to conduct the transaction, and
wherein the transaction logic is further configured to send a replenishment request for a different second cryptogram key to the remote computer, the replenishment request including transaction log information derived from a transaction log stored in the second memory region, receive from the remote computer the requested second cryptogram key when the transaction log information in the replenishment request is successfully verified in response to matching with transaction log information stored at the remote computer, and store the second cryptogram key in the second memory region of the portable communication device.
2. The communication device of claim 1 , wherein the second memory region is part of a trusted execution environment.
3. The communication device of claim 1 , wherein the first memory region is part of a normal execution environment.
4. The communication device of claim 3 , wherein the application code is stored in the first memory region.
5. The communication device of claim 1 , wherein the application code is part of a first application, and the security code is part of a second application.
6. The communication device of claim 5 , wherein the transaction logic is further configured to receive another request to conduct another transaction from a third application installed on the communication device, and generate another transaction cryptogram by using the first cryptogram key or the second cryptogram key.
7. The communication device of claim 1 , wherein the security code is part of an operating system.
8. The communication device of claim 1 , wherein the application code and the security code are integrated as part of one application.
9. The communication device of claim 1 , wherein the second memory region is part of a normal execution environment.
10. The communication device of claim 1 , wherein the security code is obfuscated.
11. The communication device of claim 1 , wherein the transaction logic is further configured to perform an integrity check of the application code.
12. The communication device of claim 1 , wherein the first cryptogram key is stored encrypted in the second memory region.
13. A method for enhancing security of a portable communication device comprising:
receiving, by transaction logic of a communication device, a first cryptogram key from a remote computer, wherein the communication device includes a memory having a separate first memory region and a second memory region;
storing, by the transaction logic, the first cryptogram key in the second memory region;
receiving, by the transaction logic, a request to conduct a transaction from user interface logic;
generating, by the transaction logic, a transaction cryptogram using the first cryptogram key;
transmitting, by the transaction logic, the transaction cryptogram to an access device to conduct the transaction;
sending, by the transaction logic, a replenishment request for a different second cryptogram key to the remote computer, the replenishment request including transaction log information derived from a transaction log stored in the second memory region;
receiving, by the transaction logic, the requested second cryptogram key from the remote computer when the transaction log information in the replenishment request is successfully verified in response to matching with transaction log information stored at the remote computer; and
storing, by the transaction logic, the second cryptogram key in the second memory region of the portable communication device.
14. The method of claim 13 , wherein the user interface logic is implemented in a first application, and the transaction logic is implemented in a second application.
15. The method of claim 14 , further comprising:
receive, by the transaction logic, another request to conduct another transaction from a third application installed on the communication device; and
generating another transaction cryptogram by using the first cryptogram key or the second cryptogram key.
16. The method of claim 14 , wherein the second application is configured to perform an integrity check of the first application.
17. The method of claim 13 , wherein the transaction logic is part of an operating system.
18. The method of claim 13 , wherein the transaction logic and the user interface logic are implemented in one application.
19. The method of claim 13 , wherein the transaction logic is executed in a trusted execution environment.
20. The method of claim 13 , wherein the first cryptogram key is stored encrypted in the second memory region.