Patent NZ-721223-A (NZ)
Title: Method and system for generating an advanced storage key in a mobile device without secure elements
Inventor: COLLINGE MEHDI
IPC: H04W12/04
Filed: 2014-12-02
Abstract: Advances in mobile and communication technologies have created tremendous opportunities, one of which is providing the user of a mobile computing device with the ability to initiate and pay for payment transactions using their mobile device. One such approach to enable such actions on a mobile device has been the use of near field communication (NFC) technology to securely transmit payment details from the mobile device to a nearby contactless point of sale (POS) terminal. In order to achieve this, mobile phones with secure element hardware, such as a secure element (SE) chip, are used to securely store the payment credentials. A secure element is a special that may be included in some NFC-enabled devices that is a temper-resistant platform that may securely host applications and their confidential data. However, not all mobile devices have secure elements. In addition, some financial institutions may not have access to secure elements on mobile devices, even if the mobile device is equipped with such an element. As a result, many consumers with mobile devices that possess the required hardware for conducting contactless or other types of remote payment transactions may be unable to actually utilize this capability. Because of such difficulties, there is a need for a technical solution to enable mobile computing devices to initiate and conduct payment transactions without the use of secure elements. Some methods and systems for conducting payment transactions using mobile devices lacking secure elements, or without the use of secure elements in mobile devices equipped with them, can be found in U.S. Patent Application No. 13/827,042, entitled “Systems and Methods for Processing Mobile Payments by Provisioning Credentials to Mobile Devices Without Secure Elements,” by Mehdi Collinge et al., filed on March 14, 2013, which is herein incorporated by reference in its entirety. While such methods and systems can be suitable for conducting payment transactions via a mobile device without using a secure element, many consumers, merchants, and financial institutions may be wary of participating in such transactions due to a desire for even greater security. As a result, there is a need for technical solutions to provide even more security for the receipt and storage of payment credentials in a mobile device lacking a secure element, as well as providing increased security for in the transmission of payment credentials to a point of sale from the mobile device during conducting of a financial transaction. Increased security in these processes can result in increased peace of mind for all entities involved, which can result in an increase in the use of mobile devices for contactless or remote payment transactions, which can provide a vast number of benefits to consumers over traditional payment methods. As a solution, or a useful alternative, to one or more to the above described technical problems, the present invention provides a method for building an advanced storage key includes: storing, in a memory of a mobile device, at least (i) device information associated with the mobile device, (ii) program code associated with a first program, the code including an instance identifier, and (iii) program code associated with a second program, the code including a first key; generating a device fingerprint associated with the mobile device based on the device information via execution of the code associated with the first program; generating a random value via execution of the code associated with the first program; building a diversifier value based on the generated device fingerprint, the generated random value, and the instance identifier included in the code associated with the first program; and decrypting the built diversifier value using the first key stored in the code associated with the second program via execution of the code associated with the second program to obtain a storage key.