Multi-path communication of electronic device secure element data for online payments
Systems, methods, and computer-readable media for communicating electronic device secure element data over multiple paths for online payments are provided. In one example embodiment, a method includes, inter alia, at a commercial entity subsystem, receiving, from an electronic device, device transaction data that includes credential data indicative of a payment credential on the electronic device for funding a transaction with a merchant subsystem, accessing a transaction identifier, deriving a transaction key based on transaction key data that includes the accessed transaction identifier, transmitting, to one of the merchant subsystem and the electronic device, merchant payment data that includes a first portion of the credential data and the accessed transaction identifier, and sharing, with a financial institution subsystem using the transaction key, commercial payment data that includes a second portion of the credential data that is different than the first portion of the credential data. Additional embodiments are also provided.
1 . A method comprising:
at a commercial entity subsystem:
receiving first data from an electronic device, wherein the first data comprises credential information that includes token information indicative of a payment credential and cryptographic information generated on a secure element of the electronic device, and merchant information indicative of a merchant subsystem;
decrypting the first data using an access key shared with the secure element;
identifying a merchant key based on the merchant information from the first data;
re-encrypting a first portion of the credential information comprising the token information using the identified merchant key; and
transmitting second data to at least one of the merchant subsystem and the electronic device, wherein the second data comprises the first portion of the credential information re-encrypted with the identified merchant key and that omits the cryptographic information; and
providing, to a financial institution subsystem, a second portion of the credential information including the cryptographic information, such that the financial institution subsystem validates a transaction by comparing independently derived cryptographic information to the second portion.
2 . The method of claim 1 , further comprising the commercial entity subsystem sharing the access key with the electronic device.
3 . The method of claim 2 , wherein the sharing comprises the commercial entity subsystem sharing the access key with the secure element of the electronic device.
4 . The method of claim 1 , further comprising the commercial entity subsystem sharing the merchant key with the merchant subsystem.
5 . The method of claim 1 , wherein the identifying the merchant key comprises the commercial entity subsystem comparing the merchant information to a table of data that comprises a plurality of merchant keys.
6 . The method of claim 5 , wherein:
at least a first merchant key of the plurality of merchant keys is associated with a first merchant;
at least a second merchant key of the plurality of merchant keys is associated with a second merchant; and
the first merchant is different than the second merchant.
7 . The method of claim 1 , wherein the merchant key is not accessible by the electronic device.
8 . The method of claim 1 , wherein the access key is not accessible by the merchant subsystem.
9 . The method of claim 1 , wherein the first data comprises the credential information encrypted by a credential key.
10 . The method of claim 9 , wherein the credential key is not accessible by the commercial entity subsystem.
11 . The method of claim 1 , wherein the cryptographic information is generated using a shared secret between the secure element and the financial institution subsystem.
12 . The method of claim 1 , wherein a first communication path for transmitting the second data to the merchant subsystem is different from a second communication path for providing the second portion of the credential information to the financial institution subsystem.
13 . The method of claim 1 , wherein the second portion of the credential information including the cryptographic information is provided to the financial institution subsystem without being transmitted to the merchant subsystem.
14 . A non-transitory machine-readable medium comprising instructions that, when executed by one or more processors of a commercial entity server, cause the one or more processors to perform operations comprising:
receiving first data and second data from an electronic device, wherein:
the first data comprises credential information that includes token information indicative of a payment credential and cryptographic information generated on a secure element of the electronic device, and a first merchant identifier encrypted by an access key shared with the secure element; and
the second data comprises a second merchant identifier; and
decrypting the first data using the access key;
identifying a merchant key based on at least one of the first merchant identifier and the second merchant identifier;
re-encrypting a first portion of the credential information comprising the token information using the identified merchant key;
transmitting third data to at least one of a merchant server and the electronic device, wherein the third data comprises the first portion of the credential information re-encrypted with the identified merchant key and that omits the cryptographic information; and
providing, to a financial institution subsystem, a second portion of the credential information including the cryptographic information, such that the financial institution subsystem validates a transaction by comparing independently derived cryptographic information to the second portion.
15 . The non-transitory machine-readable medium of claim 14 , wherein the cryptographic information is generated using a shared secret between the secure element and the financial institution subsystem.
16 . The non-transitory machine-readable medium of claim 14 , wherein a first communication path for transmitting the third data to the merchant server is different from a second communication path for providing the second portion of the credential information to the financial institution subsystem.
17 . The non-transitory machine-readable medium of claim 14 , wherein the second portion of the credential information including the cryptographic information is provided to the financial institution subsystem without being transmitted to the merchant server.
18 . A device comprising:
a memory; and
at least one processor configured to:
receive first data from an electronic device, wherein the first data comprises credential information that includes token information indicative of a payment credential and cryptographic information generated on a secure element of the electronic device, and merchant information indicative of a merchant subsystem;
decrypt the first data using an access key shared with the secure element;
identify a merchant key based on the merchant information from the first data;
re-encrypt a first portion of the credential information comprising the token information using the identified merchant key; and
transmit second data to at least one of the merchant subsystem and the electronic device, wherein the second data comprises the first portion of the credential information re-encrypted with the identified merchant key and that omits the cryptographic information; and
provide, to a financial institution subsystem, a second portion of the credential information including the cryptographic information, such that the financial institution subsystem validates a transaction by comparing independently derived cryptographic information to the second portion.
19 . The device of claim 18 , wherein the at least one processor is further configured to:
provide the access key to the electronic device.
20 . The device of claim 18 , wherein the at least one processor is further configured to:
provide the access key to the secure element of the electronic device.