Data transfer using a virtual terminal
Techniques for using a virtual terminal on a device to process a data transfer are described herein. These techniques provide the configuring of a virtual terminal for transfer of data, encryption of the data, and rewrapping the data. A server transmits virtual terminal kernel configuration data to the virtual terminal, configuring the terminal with a first public encryption key used to encrypt a second encryption key only known by the terminal. The second encryption key is used to encrypt data for data transfer. The server device is able to decrypt the second encryption key by using a third private encryption key that corresponds to the first public encryption key.
1. A method, comprising:
transmitting, by a first server device and to a secure element of a user device, virtual terminal kernel configuration data, the virtual terminal kernel configuration data used to configure a virtual terminal with a first public encryption key, the virtual terminal associated with the secure element, the first public encryption key used to generate an encrypted second encryption key by encrypting a second encryption key, and the second encryption key used to generate an encrypted data payload by encrypting a data payload;
receiving, by the first server device and from a second server device, a request for the data payload, the request including an encrypted data payload and the encrypted second encryption key;
decrypting, by the first server device, the encrypted second encryption key using a third private encryption key corresponding to the first public encryption key;
generating, by the first server device, a rewrapped second encryption key by encrypting the second encryption key using a fourth encryption key which corresponds to a fifth encryption key associated with the second server device; and
transmitting, by the first server device and to the second server device, the rewrapped second encryption key and the encrypted data payload.
2. The method of claim 1 , wherein the fourth encryption key and the fifth encryption key are associated symmetric encryption keys.
3. The method of claim 1 , wherein decrypting the encrypted second encryption key using a third private encryption key is done on a hardware secure module.
4. The method of claim 3 , wherein the hardware secure module is configured to be physically secured from electronic and physical interference.
5. The method of claim 1 , wherein the second encryption key is generated by the virtual terminal on the user device.
6. The method of claim 1 , further comprising receiving, from the user device, a kernel token, the kernel token indicative that the second server device has authorized the user device to generate one or more data payloads.
7. The method of claim 6 , further comprising:
receiving a reader token from the user device, the reader token including a first data associated with the device and a second data associated with the second server device;
determining the reader token is valid by checking the first data and second data;
generating the kernel token based at least in part one or more of the first data and the second data; and
sending the kernel token to the user device.
8. The method of claim 1 , further comprising:
sending, to the user device, a session token, the session token indicative that the second server device has authorized the user device to generate the data payload, the data payload to be processed by the second server device; and
validating the session token, the request for the data payload from the second server device further including the session token.
9. A computing device, comprising:
one or more memories; and
one or more processors in communication with the one or more memories and configured to execute instructions stored in the one or more memories to cause the computing device to:
transmit, by a first server device and to a secure element of a user device, virtual terminal kernel configuration data, the virtual terminal kernel configuration data used to configure a virtual terminal with a first public encryption key, the virtual terminal associated with the secure element, the first public encryption key used to generate an encrypted second encryption key by encrypting a second encryption key, and the second encryption key used to generate an encrypted data payload by encrypting a data payload;
receive, by the first server device and from a second server device, a request for the data payload, the request including an encrypted data payload and the encrypted second encryption key;
decrypt, by the first server device, the encrypted second encryption key using a third private encryption key corresponding to the first public encryption key;
generate, by the first server device, a rewrapped second encryption key by encrypting the second encryption key using a fourth encryption key which corresponds to a fifth encryption key associated with the second server device; and
transmit, by the first server device and to the second server device, the rewrapped second encryption key and the encrypted data payload.
10. The computing device of claim 9 , wherein the fourth encryption key and the fifth encryption key are associated symmetric encryption keys.
11. The computing device of claim 9 , wherein decrypting the encrypted second encryption key using a third private encryption key is done on a hardware secure module.
12. The computing device of claim 11 , wherein the hardware secure module is configured to be physically secured from electronic and physical interference.
13. The computing device of claim 9 , wherein the second encryption key is generated by the virtual terminal on the user device.
14. The computing device of claim 9 , wherein the one or more processors are further configured to receive, from the user device, a kernel token, the kernel token indicative that the second server device has authorized the user device to generate one or more data payloads.
15. The computing device of claim 14 , wherein the one or more processors are further configured to:
receive a reader token from the user device, the reader token including a first data associated with the device and a second data associated with the second server device;
determine the reader token is valid by checking the first data and second data;
generate the kernel token based at least in part one or more of the first data and the second data; and
send the kernel token to the user device.
16. The computing device of claim 9 , wherein the one or more processors are further configured to:
sending, to the user device, a session token, the session token indicative that the second server device has authorized the user device to generate the data payload, the data payload to be processed by the second server device; and
validating the session token, the request for the data payload from the second server device further including the session token.
17. A non-transitory computer-readable storage medium having stored thereon program instructions that, when executed by one or more processors of a first controller device, cause the first controller device to perform operations comprising:
transmitting, by a first server device and to a secure element of a user device, virtual terminal kernel configuration data, the virtual terminal kernel configuration data used to configure a virtual terminal with a first public encryption key, the virtual terminal associated with the secure element, the first public encryption key used to generate an encrypted second encryption key by encrypting a second encryption key, and the second encryption key used to generate an encrypted data payload by encrypting a data payload;
receiving, by the first server device and from a second server device, a request for the data payload, the request including an encrypted data payload and the encrypted second encryption key;
decrypting, by the first server device, the encrypted second encryption key using a third private encryption key corresponding to the first public encryption key;
generating, by the first server device, a rewrapped second encryption key by encrypting the second encryption key using a fourth encryption key which corresponds to a fifth encryption key associated with the second server device; and
transmitting, by the first server device and to the second server device, the rewrapped second encryption key and the encrypted data payload.
18. The non-transitory computer-readable storage medium of claim 17 , wherein operations further comprise receiving, from the user device, a kernel token, the kernel token indicative that the second server device has authorized the user device to generate one or more data payloads.
19. The non-transitory computer-readable storage medium of claim 18 , wherein operations further comprise:
receiving a reader token from the user device, the reader token including a first data associated with the device and a second data associated with the second server device;
determining the reader token is valid by checking the first data and second data;
generating the kernel token based at least in part one or more of the first data and the second data; and
sending the kernel token to the user device.
20. The non-transitory computer-readable storage medium of claim 17 , wherein operations further comprise:
sending, to the user device, a session token, the session token indicative that the second server device has authorized the user device to generate the data payload, the data payload to be processed by the second server device; and
validating the session token, the request for the data payload from the second server device further including the session token.