Patent ID: 11922384
Assignee: ORANGE
Field: IT methods for management (Electrical engineering)
Classification: CPC G  H | IPC G  H

Claim 9:
10. A system comprising:
a security token service provider device for use in electronic transactions;
a mobile terminal; and
a third-party device arranged to perform an electronic transaction with the mobile terminal;
the security token service provider device comprising a processor and a memory arranged to execute software modules, the security token service provider device comprising;
a first reception module arranged to receive from the mobile terminal a request to obtain at least one security token for use by the mobile terminal during an electronic transaction, the request including at least one identification value for the mobile terminal as generated by a secure element of the mobile terminal by using a first secret key shared between the secure element and the security token service provider device;
a first verification module configured to verify the at least one identification value by use of the first secret key;
a first generator module that is activated if the at least one identification value verified by the first verification module is valid and that is configured for generating at least one security token and a random number uniquely associated with the at least one security token for the mobile terminal, different security tokens generated by the security token service provider device being respectively associated with different random numbers;
a second generator module configured to generate, for each security token as generated by the first generator module, an encryption key from the random number associated with the respective security token and from a second secret key shared between the security token service provider device and the secure element of the mobile terminal;
an encryption module configured to encrypt each security token by using a symmetric encryption algorithm and the encryption key generated for the respective security token; and
a send module configured to send the at least one encrypted security token and the associated random number to the mobile terminal;

the mobile terminal having a processor and software including modules, the mobile terminal comprising:
the secure element;
an identification module configured to verify an identity of a user of the mobile terminal, wherein the identification module is also activated upon receiving a predetermined request coming from the third-party device and relating to an electronic transaction;
a first terminal generator module included in the secure element and activated upon successful verification of the identity of user by the identification module, the first generator module being configured to generate at least one identification value for the mobile terminal by using the first secret key shared between the secure element and the security token service provider device;
a first terminal send module configured to send the request to the security token service provider device to obtain at least one security token for use by the mobile terminal during an electronic transaction, the request including the generated at least one identification value for the mobile terminal;
a terminal reception module arranged to receive from the security token service provider device the at least one security token encrypted using a symmetric encryption algorithm, each security token being uniquely associated with a random number generated by the security token service provider device for the respective security token, different security tokens generated by the security token service provider device being respectively associated with different random numbers, and each security token encrypted by use of an encryption key generated for the respective security token from the random number associated with the respective security token and from the second secret key shared between the token service provider device and the secure element of the mobile terminal;
a selection module, activated upon successful verification of the identity of the user by the identification module, that is configured to select a security token from among the at least one encrypted security token stored in the mobile terminal by the storage module;
a second terminal generator module included in the secure element of the mobile terminal and configured to generate an encryption key for the selected security token from the random number associated with the selected security token and from the second secret key shared between the security token service provider device and the secure element;
a decryption module configured to decrypt the selected security token by use of the encryption key that has been generated; and
a second terminal send module configured to send a response including the decrypted security token to the request from the third-party device; and

the mobile terminal being configured to make use, during the electronic transaction with the third-party device, of a security token generated by the token service provider device.