Data security
Systems and methods for managing data security are described. In an embodiment, the method comprises receiving a data access request from a first application that runs in a first operating environment of a mobile device, wherein the authentication request contains credentials of the first application, communicating with a second application that runs in a second operating environment in parallel to the first environment of the mobile device, wherein the second application is a trusted application that runs in a secure environment, and wherein the communicating includes transferring the credentials of the first application to the second application, and receiving data from the trusted application responsive to the data access request, based on the credentials of the first application.
1. A method, comprising:
generating a data request at a first application that runs in a first operating environment of a mobile device, wherein the data request contains data identifying the first application;
communicating with a second application that runs in a second operating environment in parallel to the first environment of the mobile device, wherein the second application is a trusted application that runs in a secure environment, and wherein the communicating includes transferring the data request identifying the first application to the second application, and wherein receipt of the data request causes the second application to:
identify a subset of a plurality of data types based on the identifying data; and
retrieve a subset of data associated with a user from a database on a remote server, the subset selected based on the identified subset of the plurality of data types; and
receiving data from the trusted application responsive to the data request.
2. The method of claim 1 , wherein data request handling functionality of the second application cannot be accessed until the secure environment is established.
3. The method of claim 2 , wherein the secure environment is established immediately upon execution of the second application, by verifying the identity of the user.
4. The method of claim 3 , wherein data to verify the identity of the user is generated and stored when the second application is configured for initial use.
5. The method of claim 1 , wherein the second application encrypts the data communicated to the first application.
6. The method of claim 1 , wherein the trusted application communicates a further subset of the received data to the first application responsive to the data request.
7. The method of claim 6 , wherein the further subset of data is determined from user input.
8. The method of claim 1 , wherein the received data comprises data identifying a tokenised payment card or encrypted payment information or encrypted payment account details.
9. The method of claim 8 , wherein the tokenised or encrypted payment instrument data includes data identifying an entity associated with the trusted application.
10. The method of claim 9 , wherein the data request further identifies one or more data entities to be verified, and wherein the trusted application processes the retrieved data to verify said one or more data entities.
11. The method of claim 10 , wherein the data request comprises a payment request token.
12. The method of claim 1 , wherein the first application is a web browser or a native mobile application.
13. The method of claim 1 , wherein the first application is a software program from a third party developer and the second application is a trusted software program from a payment provider.
14. The method of claim 1 , wherein the first application includes a software module from a payment provider to communicate with the second application.
15. The method of claim 14 , wherein the software module is an API of a software development kit.
16. A method, comprising:
receiving a data request from a first application that operates in a first environment of a mobile device, wherein the data request contains data identifying the first application, the data request received by a second application that operates in a second environment in parallel to the first environment of the mobile device, wherein the second application is a trusted application that operates in a secure environment;
identifying a subset of a plurality of data types based on the identifying data;
retrieving a subset of data associated with a user from a database on a remote server responsive to the data request, the subset selected based on the identified subset of the plurality of data types; and
communicating data from the trusted application to the first application.
17. A mobile device comprising:
means for generating a data request at a first application that runs in a first operating environment of a mobile device, wherein the data request contains data identifying the first application;
means for communicating with a second application that runs in a second operating environment in parallel to the first environment of the mobile device, wherein the second application is a trusted application that runs in a secure environment, wherein the communicating includes transferring the data request identifying the first application to the second application, and wherein receipt of the data request causes the second application to:
identify a subset of a plurality of data types based on the identifying data; and
retrieve a subset of data associated with a user from a database on a remote server, the subset selected based on the identified subset of the plurality of data types; and
means for receiving data from the trusted application responsive to the data request.
18. A mobile device comprising:
means for receiving a data request from a first application that operates in a first environment of a mobile device, wherein the data request contains data identifying the first application, the data request received by a second application that operates in a second environment in parallel to the first environment of the mobile device, wherein the second application is a trusted application that operates in a secure environment;
means for identifying a subset of a plurality of data types based on the identifying data;
means for retrieving a subset of data associated with a user from a database on a remote server responsive to the data request, the subset selected based on the identified subset of the plurality of data types; and
means for communicating data from the trusted application to the first application.
19. A non-transitory computer-readable medium comprising machine readable instructions stored thereon, that when executed perform a method of claim 1 .
20. A non-transitory computer-readable medium comprising machine readable instructions stored thereon, that when executed perform a method of claim 16 .
21. The method of claim 16 , wherein communicating the data from the trusted application to the first application comprises communicating the retrieved data or a token granting the first application access to the retrieved data.