Patent Description:
Conventionally a lot of electronic payment transactions between a merchant and a customer, who wants to pay, for instance, for goods or services of the merchant, often involve an interaction between a point-of-sale (POS) terminal of the merchant and a payment card (e.g. credit card or debit card) of the customer. After the customer interfaces the payment card with the POS terminal, and the POS terminal reads the account number from the payment card, the POS terminal may generate an online authorization request (e.g. authorization amount, and account number), and transmit the authorization request to a payment server. If the customer's account has a credit or balance that is sufficient to process the payment, the payment server generally settles the authorized amount with the customer's account, generates an authorization response message, and transmits the authorization response message to the POS terminal.

Due to the widespread adoption of mobile phones, tablet computers and other types of COTS (commercial-off-the-shelf) devices in more and more electronic payment transactions POS terminals are being replaced, for instance, by mobile phones in that for processing a payment transaction a merchant mobile phone interacts with a payment card and/or a mobile phone of the customer. Often the authorization of the payment transaction requires the customer to enter a PIN or the like, i.e. security relevant data of the customer, into a virtual or physical PIN pad of the merchant mobile phone. Therefore, it has to be ensured that the security relevant data of the customer for authorizing the payment transaction are processed by the merchant mobile phone in a secure manner, i.e. that the security status of the merchant mobile phone is integer and the merchant can be trusted.

<CIT> discloses a method for registering a mobile POS.

It is an object of the invention to provide improved devices, methods and a system for enabling secure electronic payment transactions involving a mobile merchant communication device, in particular a merchant mobile phone.

According to a first aspect a mobile merchant communication device is provided, wherein the mobile merchant communication device is configured to be enrolled by a personalization server for performing a payment transaction with a mobile consumer communication device using a payment server. The mobile merchant communication device may be, for instance, a mobile phone, a tablet computer or another type of COTS device of a merchant.

The mobile merchant communication device comprises a user interface configured to receive an authentication request from a merchant, wherein the authentication request comprises a first electronic secret, in particular a human-readable secret, such as a PIN. The mobile merchant communication device further comprises a security enclave configured to, in response to the authentication request, obtain a second electronic secret, in particular an electronic key, for the mobile merchant communication device and a communication interface configured to transmit an enrollment request to the personalization server, wherein the enrollment request comprises the first electronic secret and the second electronic secret. The communication interface is further configured, in response to the enrollment request, to receive personalization data from the personalization server, wherein the personalization data enables the mobile merchant communication device to perform the payment transaction with the mobile consumer communication device. The enrollment process implemented by the personalization server allows having a better control about the mobile merchant communication devices allowed to make payment transactions.

In a further embodiment, the security enclave comprises a hardware security enclave and/or a software security enclave implemented by a processing circuitry of the mobile merchant communication device.

In a further embodiment, the security enclave is further configured to store the second electronic secret and/or the personalization data.

In a further embodiment, the personalization data comprises one or more cryptographic keys, in particular one or more symmetric keys, for enabling the mobile merchant communication device to perform the payment transaction with the mobile consumer communication device. Thus, in an embodiment, only by means of the one or more symmetric keys the mobile merchant communication device will be able to perform the payment transaction with the mobile consumer communication device, which may further involve an interaction with a payment server.

In a further embodiment, the communication interface is configured to receive the personalization data from the personalization server in encrypted form and wherein the security enclave is configured to decrypt the personalization data. In an embodiment, the personalization server may share the personalization data securely with the payment server.

In a further embodiment, the security enclave is further configured to verify a digital signature of the personalization data using a public key of the personalization server. In a further embodiment, the first electronic secret is a human-readable PIN, which may be transmitted to the merchant and/or the mobile merchant communication device via a secure channel, such as secure email, paper letter, secure text message and the like.

In a further embodiment, the security enclave is configured to generate the second electronic secret based on the first electronic secret. For instance, in an embodiment, the first electronic seed may be a seed value for a secret generation mechanism implemented by the mobile merchant communication device, in particular the security enclave, for generating the second electronic secret. In a further embodiment, the second electronic secret may be generated before transmitting the first electronic secret.

In a further embodiment, the second electronic secret is a public key of the mobile merchant communication device with the corresponding private key of the mobile merchant communication device securely stored in the memory of the mobile merchant communication device.

In a further embodiment, the security enclave is further configured to perform the payment transaction with the mobile consumer communication device and the payment server based on the personalization data.

According to a second aspect an electronic payment system is provided, wherein the electronic payment system comprises a mobile merchant communication device according to the first aspect and a personalization server configured to enroll the mobile merchant communication device for performing a payment transaction with a mobile consumer communication device.

In a further embodiment, the electronic payment system further comprises a payment server, wherein the payment server is configured to authorize the payment transaction between the mobile merchant communication device and the mobile consumer communication device based on the personalization data shared by the personalization server.

According to a third aspect a method of enrolling a mobile merchant communication device with a personalization server for performing a payment transaction with a mobile consumer communication device is provided. The method comprises the steps of: receiving an authentication request from a merchant, wherein the authentication request comprises a first electronic secret;.

In an embodiment, the method further comprises performing the payment transaction with the mobile consumer communication device and a payment server based on the personalization data.

The method according to the third aspect of the present invention can be performed by the mobile merchant communication device according to the first aspect of the present invention. Thus, further features of the method according to the third aspect of the present invention result directly from the functionality of the mobile merchant communication device according to the first aspect of the present invention as well as its different embodiments described above and below.

According to a fourth aspect, a computer program product comprising a non-transitory computer-readable storage medium for storing program code which causes a computer or a processor to perform the method according to the third aspect, when the program code is executed by the computer or the processor, is provided.

Embodiments of the invention can be implemented in hardware and/or software.

In the figures, identical reference signs will be used for identical or at least functionally equivalent features.

In the following detailed description, reference is made to the accompanying drawings, which form part of the disclosure, and in which are shown, by way of illustration, specific aspects in which the present invention may be implemented. It is understood that other aspects may be utilized and structural or logical changes may be made without departing from the scope of the present invention. The following detailed description, therefore, is not to be taken in a limiting sense, as the scope of the present invention is defined by the appended claims.

<FIG> shows a schematic diagram illustrating an electronic payment system <NUM> according to an embodiment for processing an electronic payment transaction between a mobile merchant communication device <NUM> operated by a merchant 120a and a customer payment device. The mobile merchant communication device <NUM> may be, for instance, a mobile phone, tablet computer or the like operated by the merchant 120a. As illustrated in <FIG>, the mobile merchant communication device <NUM> may comprise a processor <NUM> for processing data, a communication interface <NUM> for communicating with the other components of the electronic payment system <NUM> via a communication network <NUM> and a memory <NUM> for storing data, in particular cryptographic keys which may be stored in a secure area 125a of the memory <NUM>. The mobile merchant communication device <NUM> may further comprise a user interface, such as a physical or virtual PIN pad allowing the customer to enter data, such as a secret PIN for authorizing the payment transaction. The customer payment device may be an electronic chip card, i.e. a payment card 110a of a customer, or a mobile customer communication device <NUM>, e.g. a mobile phone <NUM> of the customer. In an embodiment, the communication interface <NUM> of the mobile merchant communication device <NUM> may comprise an NFC interface for communicating with the mobile customer communication device <NUM>. Alternatively or additionally, the mobile merchant communication device <NUM> and/or the mobile customer communication device <NUM> may comprise a camera for scanning a QR code for processing the payment transaction.

In addition to the mobile merchant communication device <NUM> and the mobile customer communication device <NUM> the electronic payment system <NUM> illustrated in <FIG> further comprises a personalization server <NUM> for enrolling the mobile merchant communication device <NUM> for enabling the mobile merchant communication device <NUM> to perform the payment transaction with the mobile consumer communication device <NUM> and a payment server <NUM>. In the embodiment shown in <FIG>, the electronic payment system <NUM> further comprises an attestation server <NUM> with a processing circuitry <NUM> and a communication interface <NUM>, which processing circuitry <NUM> is configured, once the mobile merchant communication device <NUM> has been enrolled by the personalization server <NUM>, to periodically or intermittently verify via the communication interface <NUM> that the mobile merchant communication device <NUM> has been enrolled. As illustrated in <FIG>, the personalization server <NUM> and the attestation sever <NUM> may be part of a backend system <NUM> for personalizing/enrolling and monitoring the mobile merchant communication device <NUM>.

As illustrated in <FIG>, the mobile merchant communication device <NUM> comprises a user interface configured to receive an authentication request from a merchant 120a. The authentication request comprises a first electronic secret, in particular a human-readable secret. In an embodiment, the merchant 120a may enter the first human-readable secret via a virtual keypad of the mobile merchant communication device <NUM>.

The mobile merchant communication device <NUM> further comprises a security enclave 121a, which may be implemented by a processor <NUM> of the mobile merchant communication device <NUM>. The security enclave 121a is configured to, in response to the authentication request, obtain a second electronic secret, in particular an electronic key (also referred to as cryptographic key), for the mobile merchant communication device <NUM>. The mobile merchant communication device <NUM> further comprises a communication interface <NUM> configured to transmit an enrollment request to the personalization server <NUM>, wherein the enrollment request comprises the first electronic secret and the second electronic secret. The communication interface <NUM> is further configured, in response to the enrollment request, to receive personalization data from the personalization server <NUM>, wherein the personalization data enables the mobile merchant communication device <NUM> to perform the payment transaction with the mobile consumer communication device <NUM>.

Likewise, the personalization server <NUM> may comprise a processing circuitry <NUM> configured to generate the first electronic secret, in particular a human-readable secret, for the mobile merchant communication device <NUM> and a communication interface <NUM> configured to receive the enrollment request from the mobile merchant communication device <NUM>. The processing circuitry <NUM> may be further configured, if the enrollment request is successful, to generate the personalization data for the mobile merchant communication device <NUM>. The communication interface <NUM> may be further configured to transmit the personalization data to the mobile merchant communication device <NUM>.

In an embodiment, the security enclave 121a comprises a hardware security enclave 121a and/or a software security enclave 121a implemented by the processing circuitry <NUM> of the mobile merchant communication device <NUM>. In an embodiment, the security enclave 121a may be implemented using virtualization techniques. In an embodiment, the security enclave 121a may use a different partition of a RAM of the mobile merchant communication device <NUM> and/or data access using "memory mapped I/O". As will be appreciated, the main purpose of the security enclave 121a is to isolate the processing of security critical tasks from standard processing tasks of the mobile merchant communication device <NUM>. This can be achieved by using a single processor-core <NUM> having two execution modes, one secure mode and another mode for standard processes. In this case the RAM and registers assigned to the single core are duplicated and one set is assigned to the normal mode and the other set to the secure execution mode. According to another embodiment, the security enclave 121a may be implemented using a multi-processor-core architecture with at least one secure-core with an own RAM, which is dedicated to executing only security-critical processes.

In an embodiment, the security enclave 121a is further configured to store the second electronic secret and/or the personalization data. Thus, in an embodiment, the secure area 125a of the memory <NUM> may be part or under the control of the security enclave 121a.

In an embodiment, the processing circuitry <NUM> is configured to generate the first electronic secret, in particular human-readable secret, and to trigger a transmission of the first electronic secret to the merchant 120a operating the mobile merchant communication device <NUM>. In an embodiment, once generated, the human-readable first secret may be transmitted to the merchant 120a and/or the mobile merchant communication device <NUM> via a secure channel, such as secure email, paper letter, secure text message and the like so that the merchant 120a may enroll the mobile merchant communication device <NUM> using the human-readable first secret.

In an embodiment, the personalization server <NUM> further comprises a memory <NUM> configured to store the second electronic secret, in particular an electronic key, generated by the mobile merchant communication device <NUM> for identifying the mobile merchant communication device <NUM>. The personalization server <NUM> may be configured to share the second electronic secret, in particular the electronic key, with the attestation server <NUM>, which may be configured to store the second electronic secret in a memory <NUM> of the attestation server <NUM>.

In an embodiment, the personalization data comprises one or more cryptographic keys, in particular one or more symmetric keys, for enabling the mobile merchant communication device <NUM> to perform the payment transaction with the mobile consumer communication device <NUM>.

In an embodiment, the communication interface <NUM> is configured to transmit the personalization data to the mobile merchant communication device <NUM> in encrypted form based on a public key of the mobile merchant communication device <NUM>.

In an embodiment, the communication interface <NUM> is configured to receive the personalization data from the personalization server <NUM> in the encrypted form and wherein the security enclave 121a is configured to decrypt the personalization data.

In an embodiment, the processing circuitry <NUM> is further configured to digitally sign the personalization data using a private key of the personalization server <NUM>.

In an embodiment, the security enclave 121a is further configured to verify a digital signature of the personalization data using a public key of the personalization server <NUM>.

In an embodiment, the security enclave 121a is configured to generate the second electronic secret based on the first electronic secret.

In an embodiment, the second electronic secret is a public key of the mobile merchant communication device <NUM>.

In an embodiment, the security enclave 121a is further configured to perform the payment transaction with the mobile consumer communication device <NUM> and the payment server <NUM> based on the personalization data.

<FIG> shows a signaling diagram illustrating the interaction of the mobile merchant communication device <NUM> and the personalization server <NUM> according to an embodiment for enrolling the mobile merchant communication device <NUM>. In <FIG> the following steps are illustrated, some of which already have been described in the context of <FIG> above.

In step 200a of <FIG>, the security enclave 121a of the mobile merchant communication device <NUM> may generate a secret for accessing the user interface, in particular an API, of the mobile merchant communication device <NUM>, which may then be transmitted to the processing circuitry <NUM> of the personalization server <NUM>.

In step <NUM> of <FIG>, the processing circuitry <NUM> of the personalization server <NUM> generates the human-readable first secret for the merchant 120a, which may be associated with a merchant identifier.

In step <NUM> of <FIG>, the human-readable first secret, and in an embodiment additionally the secret for accessing the user interface of the mobile merchant communication device <NUM>, is transmitted via a secure channel to the merchant 120a, for instance, electronically, such as by email or text message, and/or by paper letter and may be stored in the database of the memory <NUM> of the personalization server <NUM> together with the merchant identifier.

In step <NUM> of <FIG>, the merchant 120a, who has securely received the human-readable first secret, triggers the enrollment process by authenticating himself vis-à-vis the mobile merchant communication device <NUM>, for instance, by manually entering the human-readable first secret, which may be a PIN, via a virtual keypad of the mobile merchant communication device <NUM>. Additionally, the merchant 120a may be required to provide the secret for accessing the user interface of the mobile merchant communication device <NUM>. This authentication request and the further enrollment process may be handled by an enrollment application running on the mobile merchant communication device <NUM>.

In step <NUM> the processing circuitry <NUM> of the mobile merchant communication device <NUM> forwards the authentication request to the security enclave 121a.

In response to a successful authentication of the merchant 120a using the human-readable first secret, the security enclave 121a generates in step <NUM> of <FIG> the second electronic secret. In an embodiment, the security enclave 121a may generate the second electronic secret based on the first electronic secret. For instance, the first electronic secret may be a seed value for generating the second electronic secret.

In step <NUM> of <FIG>, the security enclave 121a of the mobile merchant communication device <NUM> initiates an enrollment request for the personalization server <NUM> and forwards the enrollment request to the processing circuitry <NUM> of the mobile merchant communication device <NUM>. In addition to the first secret and the second secret the enrollment request may comprise a device identifier of the mobile merchant communication device <NUM>, such as a hardware ID number.

In step <NUM> of <FIG>, the processing circuitry <NUM> of the mobile merchant communication device <NUM> sends the enrollment request to the personalization server <NUM> via the communication interface <NUM> in response to receiving the enrollment request from the security enclave 121a.

In step <NUM> of <FIG>, the processing circuitry <NUM> of the personalization server <NUM> is configured to verify whether the enrollment request contains the first secret, i.e. whether the mobile merchant communication device <NUM>, i.e. the merchant 120a is authenticated by the first secret.

If the authentication in step <NUM> is successful, in step <NUM> of <FIG> the second secret may be stored together with the device identifier and personalization data in the database of the memory <NUM> of the personalization server <NUM>. In an embodiment, the personalization data may be retrieved by the processing circuitry <NUM> from the memory <NUM> of the personalization server <NUM> and/or generated on the fly.

In step <NUM> of <FIG>, the personalization data is transmitted securely to the mobile merchant communication device <NUM>. The personalization data enables the mobile merchant communication device <NUM> to perform a payment transaction with the mobile consumer communication device <NUM> and the payment server <NUM>.

In step <NUM> of <FIG>, the personalization data is forwarded to the security enclave 121a by the processing circuitry <NUM> of the mobile merchant communication device <NUM>.

In step <NUM> of <FIG>, the personalization data is securely stored by the security enclave 121a for being accessible for future payment transactions with the mobile consumer communication device <NUM> and the payment server <NUM>.

<FIG> shows a signaling diagram illustrating a further embodiment of the interaction between the mobile merchant communication device <NUM> and the personalization server <NUM> shown in <FIG> for enrolling the mobile merchant communication device <NUM> based on asymmetric cryptography. To this end, as illustrated in <FIG>, both the personalization server <NUM> and the mobile merchant communication device <NUM> may comprise and/or generate a respective public and private key pair. In the following only the differences between the steps shown in <FIG> and <FIG> will be described in more detail.

In step 200b of <FIG>, via the communication interface <NUM> the processing circuitry <NUM> of the personalization server <NUM> transmits the public key of the personalization server <NUM> to the mobile merchant communication device <NUM>, which may securely store the public key of the personalization server <NUM> using the security enclave 121a.

In step <NUM> of <FIG>, the mobile merchant communication device <NUM> generates or obtains a public private key pair, wherein the public key of the mobile merchant communication device <NUM> constitutes the second electronic secret.

In step <NUM> of <FIG>, the security enclave 121a of the mobile merchant communication device <NUM> initiates the enrollment request for the personalization server <NUM> and forwards the enrollment request to the processing circuitry <NUM> of the mobile merchant communication device <NUM>. In this embodiment, the enrollment request comprises the public key of the mobile merchant communication device <NUM> as the second secret in addition to the first secret and the device identifier of the mobile merchant communication device <NUM>. The security enclave 121a of the mobile merchant communication device <NUM> may encrypt this data using the public key of the personalization server <NUM>.

In step <NUM> of <FIG>, the personalization data is transmitted securely from the personalization server <NUM> to the mobile merchant communication device <NUM>. As illustrated in <FIG>, the personalization data, for instance, one or more symmetric payment keys, may be encrypted with the public key of the mobile merchant communication device <NUM> (which was part of the enrollment request in step <NUM>) and digitally signed using the private key of the personalization server <NUM>. These symmetric payment keys may be shared by the personalization server <NUM> with the payment server <NUM> so that the mobile merchant communication device <NUM> may use these keys for future payment transactions involving the mobile consumer communication device <NUM> and the payment server <NUM>.

In step <NUM> of <FIG>, the processing circuitry <NUM> of the mobile merchant communication device <NUM> may forward the personalization data to the security enclave 121a.

In step <NUM> of <FIG>, the security enclave 121a securely stores the personalization data.

<FIG> shows a flow diagram illustrating steps of a method <NUM> of enrolling a mobile merchant communication device <NUM> with a personalization server <NUM> for performing a payment transaction with a mobile consumer communication device <NUM>.

The method <NUM> can be performed by the mobile merchant communication device <NUM>. Thus, further features of the method <NUM> result directly from the functionality of the mobile merchant communication device <NUM> as well as its different embodiments described above and below.

While a particular feature or aspect of the disclosure may have been disclosed with respect to only one of several implementations or embodiments, such feature or aspect may be combined with one or more other features or aspects of the other implementations or embodiments as may be desired and advantageous for any given or particular application.

Furthermore, to the extent that the terms "include", "have", "with", or other variants thereof are used in either the detailed description or the claims, such terms are intended to be inclusive in a manner similar to the term "comprise". Also, the terms "exemplary", "for example" and "e.g." are merely meant as an example, rather than the best or optimal. The terms "coupled" and "connected", along with derivatives may have been used. It should be understood that these terms may have been used to indicate that two elements cooperate or interact with each other regardless whether they are in direct physical or electrical contact, or they are not in direct contact with each other.

Although the elements in the following claims are recited in a particular sequence, unless the claim recitations otherwise imply a particular sequence for implementing some or all of those elements, those elements are not necessarily intended to be limited to being implemented in that particular sequence.

Claim 1:
A mobile merchant communication device (<NUM>) configured to be enrolled by a personalization server (<NUM>) for performing a payment transaction with a mobile consumer communication device (<NUM>) using a payment server (<NUM>), wherein the mobile merchant communication device (<NUM>) comprises:
a user interface configured to receive an authentication request from a merchant (120a), wherein the authentication request comprises a first electronic secret;
a security enclave (121a) configured to, in response to the authentication request, obtain a second electronic secret for the mobile merchant communication device (<NUM>); and
a communication interface (<NUM>) configured to transmit an enrollment request to the personalization server (<NUM>), wherein the enrollment request comprises the first electronic secret and the second electronic secret;
wherein the communication interface (<NUM>) is further configured, in response to the enrollment request, to receive personalization data from the personalization server (<NUM>), wherein the personalization data enables the mobile merchant communication device (<NUM>) to perform the payment transaction with the mobile consumer communication device (<NUM>).