Description:FIELD OF THE INVENTION
The present invention relates to providing authentication and security features in mobile devices for operating in host card emulation mode.
BACKGROUND
With advancement in mobile technology, various features have been integrated into mobile devices that provide various serveries. In addition, proximity based payment or contactless payment such as near filed communication (NFC) based payment has gained wide popularity. Such contactless payments include various authentication and security features that enable secure transactions by the mobile device. The authentication and security features are adapted to replace conventional cards such as credit cards, debit cards, loyalty cards, and transportation cards.
In one technique of contactless payment, mobile wallet incorporating authentication and security features are implemented by saving card information directly into a Secure Element (SE) of the mobile device equipped with Near Field Communication (NFC) chipset. The SE may be a smart chip adapted to use NFC protocols for secure data communications. Additionally, the SE is capable of storing multiple applications, including of account specific information that may not be easily accessed by external parties.
In another technique of contactless payment, also known as Host Card Emulation (HCE), virtual and exact representation of the card is provided in the mobile device using only software. Thus, eliminating the need for tamper resistant hardware element (such as the above mentioned Secure Element) to secure information such as card details and PIN/Password. Further, to provide additional security during a transaction via HCE, the user is required to enter PIN/Passcode.
However, requiring the user to enter PIN/Passcode for every transaction or for predetermined number of transactions based on predefined rules affects user experience. On the contrary, eliminating PIN/Passcode necessarily requires tamper resistant hardware (i.e. the above mentioned Secure Element) on the mobile device. However, providing such tamper resistant hardware on mobile devices increases the deployment complexity as provisioning the authentication application will increase cost and involve additional players into the mobile transaction ecosystem. In another alternative, biometric information can be provided instead of entering PIN/Passcode. However, such entry of biometric information requires specific hardware equipment such as biometric sensors to be included/inbuilt in the mobile device, thereby increasing cost of the mobile devices.
In yet other alternative, electronic tokens are transferred between the NFC enabled devices instead of entering PIN/Passcode by the user. Transfer of such tokens limit the risk of exposure of critical account details. However, the tokens can be copied by a malware and a hacker phone can use the copied token for any other transaction as strong user identification is not tied with the token.
Thus, each of the present authentication techniques has an associated disadvantage as indicated below:
• Biometric based authentication – expensive
• Passcode/PIN authentication using secure element – expensive
• PIN/Passcode authentication of user on cloud – will introduce delay during payment operation (e.g.: tap time) affecting user experience
• Issuer requests authentication (one of the Card holder verification method - CVM) of PIN to be entered on the POS (Point of Sale Pin Entry Device) by user during the payment operation – introduces inconvenience on the part of the genuine user.
Thus, there is an unmet need to provide authentication in mobile devices interaction in host card emulation mode with a POS terminal.
SUMMARY OF THE INVENTION
The present invention provides a method implemented by a tokenization server for communicating electronic token to a mobile device operating in a host card emulation mode, in a networked environment. The electronic token can be leveraged by various entities such as users, merchants, acquirers, and payment processors that form part of the networked environment. As such, the electronic token can support interoperability and can be accepted, processed and routed by the various entities within the networked environment. Accordingly, the tokenization server first registers the mobile device. Upon registering and subsequently receiving an authentication request from the mobile device, the tokenization server generates a seed specific to a SIM card available in the mobile device. Thereafter, the tokenization server provides a time-bound authenticator and the seed to the mobile device. The time-bound authenticator and the seed are adapted to be stored on the SIM card, wherein the time-bound authenticator is adapted to periodically generate a time-bound authentication code based on the seed.
Subsequently, the tokenization server receives a request for an electronic token from the mobile device. In response, the tokenization server provides an encrypted first electronic token to the mobile device such that the mobile device is adapted to generate a second electronic token based on the first electronic token and the time-bound authentication code. The first electronic token is encrypted by an encryption technique pre-agreed with the mobile device.
The advantages of the present invention include, but not limited to, providing an authentication technique by way generating electronic tokens based on first encrypted token and a time-bound authentication code for completing a transaction via the host card emulation mode. As the time-bound authentication code is valid for a predetermined duration, the transaction period is limited and therefore chances of fraudulent transactions with copied tokens is eliminated. Further, the time-bound authentication code is generated using a built-in clock of the mobile device and a seed, which is saved in SIM card of the mobile device and which has been generated specific to the SIM card of the mobile device. This further increases the security of the tokens.
Furthermore, the seed and the time bound authenticator are provided to the mobile device upon authentication of the mobile device and are saved in the SIM card of the mobile device. Thus, the security of the tokens is greatly increased since only authenticated mobile device can receive the seed and the time bound authenticator and generate time-bound authentication code. In addition, the acknowledgment of authentication of the mobile device and the time bound authenticator are received via two different communication links, thereby eliminating the chances of copying sensitive information.
To further clarify advantages and features of the present invention, a more particular description of the invention will be rendered by reference to specific embodiments thereof, which is illustrated in the appended figures. It is appreciated that these figures depict only typical embodiments of the invention and are therefore not to be considered limiting of its scope. The invention will be described and explained with additional specificity and detail with the accompanying figures.

BRIEF DESCRIPTION OF THE ACCOMPANYING DRAWINGS:
These and other features, aspects, and advantages of the present invention will become better understood when the following detailed description is read with reference to the accompanying figures in which like characters represent like parts throughout the figures, wherein:
Figure 1 illustrates block diagram of a networked environment comprising of a mobile device operating in host card emulation mode and a tokenization server, in accordance with an embodiment of the present invention.
Figures 2a and 2b illustrate a method implemented by the tokenization server for communicating electronic token to the mobile device, in accordance with the embodiment of the present invention.
Figure 3 illustrates a block diagram of the tokenization server in accordance with the embodiment of the present invention.
Figure 4 illustrates a method implemented by the mobile device operating in a host card emulation mode for receiving an encrypted electronic token, in accordance with the embodiment of the present invention.
Figure 5 illustrates a method implemented by the mobile device for sharing the electronic token, in accordance with the embodiment of the present invention.
Figure 6 illustrates a block diagram of the mobile device operating in the host card emulation mode, in accordance with the embodiment of the present invention.
Further, skilled artisans will appreciate that elements in the figures are illustrated for simplicity and may not have been necessarily been drawn to scale. For example, the flow charts illustrate the method in terms of the most prominent steps involved to help to improve understanding of aspects of the present invention. Furthermore, in terms of the construction of the device, one or more components of the device may have been represented in the figures by conventional symbols, and the figures may show only those specific details that are pertinent to understanding the embodiments of the present invention so as not to obscure the figures with details that will be readily apparent to those of ordinary skill in the art having benefit of the description herein.
DETAILED DESCRIPTION
For the purpose of promoting an understanding of the principles of the invention, reference will now be made to the embodiment illustrated in the figures and specific language will be used to describe the same. It will nevertheless be understood that no limitation of the scope of the invention is thereby intended, such alterations and further modifications in the illustrated system, and such further applications of the principles of the invention as illustrated therein being contemplated as would normally occur to one skilled in the art to which the invention relates.
It will be understood by those skilled in the art that the foregoing general description and the following detailed description are exemplary and explanatory of the invention and are not intended to be restrictive thereof.
Reference throughout this specification to “an aspect”, “another aspect” or similar language means that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment of the present invention. Thus, appearances of the phrase “in an embodiment”, “in another embodiment” and similar language throughout this specification may, but do not necessarily, all refer to the same embodiment.
The terms "comprises", "comprising", or any other variations thereof, are intended to cover a non-exclusive inclusion, such that a process or method that comprises a list of steps does not include only those steps but may include other steps not expressly listed or inherent to such process or method. Similarly, one or more devices or sub-systems or elements or structures or components proceeded by "comprises... a" does not, without more constraints, preclude the existence of other devices or other sub-systems or other elements or other structures or other components or additional devices or additional sub-systems or additional elements or additional structures or additional components.
Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs. The system, methods, and examples provided herein are illustrative only and not intended to be limiting.
Embodiments of the present invention will be described below in detail with reference to the accompanying figures.
Figure 1 illustrates a networked environment (100) comprising of a mobile device (101) operating in host card emulation mode. Accordingly, the mobile device (101) includes a processor implementing a mobile wallet application (MWA) (102). The mobile device (101) further includes a Near Filed Communication (NFC) controller (103) capable of communicating with devices having NFC readers. Thus, the MWA provides a contactless payment (NFC-based payments) via the NFC controller (103). Further, the mobile device (102) includes a SIM card (104) for performing necessary functions of the mobile device (101). In one aspect of the invention, as illustrated in the figure, the SIM card (104) and the NFC controller (103) may be separate entities. In another aspect of the invention, the SIM card (104) may include the NFC controller (103) thereby creating a single entity.
Further, the mobile device (101) is in operative communication with a tokenization server (105) and a mobile network operator (106) over a network (not shown in the figure). In accordance with the present invention, the mobile device (101) is in operative communication with the tokenization server (105) via two different communication links. Accordingly, the mobile device (101) is in operative communication with the tokenization server (105) directly via a first communication link (107). The mobile device (101) is in operative communication with the tokenization server (105) via a second communication link (108) through the SIM card (104) and the mobile network operator (106). Thus, the tokenization server (105) is in communication with the processor implementing the MWA (102) via the two communication links (107) and (108).
Further, the mobile device (101) is in operative communication with a Point of Sale (POS) device (109). The POS device (109), according to the present invention, is adapted to use NFC communication for secure data communication. In one aspect, the POS device (109) may be a NFC-ready POS device. In another aspect, the POS device (109) may be integrated with a NFC-enabled device. Further, the POS device (109) is in operative communication with an acquirer device (110). The acquirer device (110) can be in further operative communication with an issuer device (111) corresponding to an issuer such as a bank and merchant. The issuer, among various other services, issues one or more cards to a user for conducting financial transactions such as purchase transactions and banking transactions. Examples of the issuer device (111) include systems employed by banks and merchants. Examples of the cards include a credit card, a debit card, an automated teller machine (ATM) card, a fleet card, stored-value card, prepaid card, and a gift card. Thus, the MWA stores virtual and exact representation of the card issued by the issuer when the mobile device (101) is operating in host card emulation mode.
Further, both the acquirer device (110) and the issuer device (111) can form a payment network (112). In addition, the issuer device (111) is in operative communication with the mobile device (101) via a third communication link (113). The functioning of the different components of the networked environment (100) taken individually and a whole, in accordance with the present invention, will be described in the later paragraphs.
In accordance with the present invention, Figure 2 illustrates a method (200) implemented by a tokenization server for communicating electronic token to a mobile device.
Accordingly, referring to Figure 2a, the method (200) comprises the steps of: receiving (201), from the mobile device via a first communication link, a registration request; providing (202) an acknowledgment message, to the mobile device via the first communication link, in case a first condition set is satisfied by the registration request; receiving (203), from the mobile device via a second communication link, an authentication request; generating (204) a seed specific to a SIM card available in the mobile device; providing (205) a time-bound authenticator and the seed to the mobile device via the second communication link, in case a second condition set is satisfied by the authentication request, the time-bound authenticator and the seed are being adapted to be stored on the SIM card, wherein the time-bound authenticator is adapted to periodically generate a time-bound authentication code based on the seed; receiving (206) a request for an electronic token from the mobile device via the first communication link; and providing (207) an encrypted first electronic token to the mobile device via the first communication link, wherein the first electronic token is encrypted by an encryption technique pre-agreed with the mobile device such that the mobile device is adapted to generate a second electronic token based on the first electronic token and the time-bound authentication code.
Similarly, referring to Figure 2b, the method (200) further comprises the steps of: receiving (208), from a designated intermediary device, the second electronic token and a cryptogram, as sent by the mobile device; verifying (209) the cryptogram thus received; validating (210) the authentication code received in the second token based on a copy of the seed available in a database; obtaining (211) an account identifier as per pre-stored mapping data; and transmitting (212) the account identifier to the designated intermediary device.
In an aspect of the invention, the time-bound authenticator is Common Security Toolkit (CST) application and is comprised within a SIM Application Toolkit (STK) or a Java card applet.
In an aspect of the invention, the seed is a random encrypted key.
In an aspect of the invention, the step of generating (204) the seed by the tokenization server further comprises: generating the seed based on information present in the authentication request; and storing a copy of the seed in a database (not shown in the figure).
In an aspect of the invention, the time-bound authentication code is valid for a predetermined duration.
In an aspect of the invention, the registration request includes one or more of an account identifier, a PIN number, a card number, a mobile number, and a personal account number (PAN).
In an aspect of the invention, the first condition set includes a card number or a PAN number being pre-mapped to a mobile number of the mobile device.
In an aspect of the invention, the acknowledgment message comprises a unique identifier enabling an automatic transmitting of the authentication request.
In an aspect of the invention, the authentication request comprises the unique identifier, SIM card identifier, a mobile number of the mobile device sending the authentication request, and a mobile number as appended by the second communication link to the authentication request.
In an aspect of the invention, the second condition set includes one or more conditions selected from the group comprising of:
a. the mobile number as contained in the authentication request matches with the mobile number as appended by the second communication link to the authentication request;
b. the unique number contained in the authentication request corresponds to the mobile number from which the authentication request is transmitted; and
c. the authentication request is received within a predetermined time period, the time period being calculated from the time of providing the acknowledgment.
In an aspect of the invention, the step of providing (207) the encrypted first electronic token by the tokenization server further comprises:
a. generating the first electronic token;
b. generating mapping data that maps the first electronic token to an account identifier as included in the request for electronic token; and
c. encrypting the first electronic token by the encryption technique pre-agreed with the mobile device.
In an aspect of the invention, the request for the electronic token comprises an account identifier which can include one or more of actual card number, a mobile number associated with the SIM card, and a personal account number (PAN).
In an aspect of the invention, the encryption technique is pre-agreed with the mobile device during the registration of the mobile device with the tokenization server.
Accordingly, Figure 3 illustrates the tokenization server (105) in accordance with the present invention. The tokenization server comprises a processor (301) in communication with a transceiver (302). In accordance with an aspect of the present invention, the transceiver (302) may comprise a first receiver (303), a first transmitter (304), a second receiver (305), and a second transmitter (306). Further, in accordance with an aspect of the present invention, the processor (301) may comprise a Registration unit (307), an Authentication and Provisioning unit (308), a Seed & Authenticator Generation and Transmission Unit (309), a Token Preparation & Transmission unit (310), and a Verification unit (311).
Although specific hardware components have been depicted in reference to the tokenization server (105), it is to be understood that the tokenization server (105) and the various units/components therein may include other hardware and/or software components as known in the art for performing necessary functions.
In operation, referring to Figures 1, 2, and 3, the first receiver (303) is operable in the first communication link (107) for receiving a registration request from the mobile device (101). The first receiver (303) is in operational communication with the Registration unit (307) in the processor (301). In an aspect of the invention, the registration request includes details of the card and a user pre-stored in the Mobile Wallet Application available in the mobile device (101). The registration request, therefore, may include one or more of an account identifier, a PIN number, a card number, a mobile number, and a personal account number (PAN).
Upon receiving the registration request, the Registration unit (307) is adapted to determine whether registration request satisfies the first condition set and in response thereto, generates an acknowledgment message. In an aspect of the invention, the first condition set includes a card number or a PAN number being pre-mapped to a mobile number of the mobile device. In such aspect, the pre-mapped details are stored in a database (not shown in the figure) coupled to the tokenization server (105). In one example, the database may be external to the tokenization server (105). In another example, the database may be internal to the tokenization server (105). In an example, the Registration unit (307) compares the card number received in the registration request with the card number stored in the database and generates the acknowledgement message upon determining a positive match.
The processor (401) and more particularly the registration unit (307) may be operational communication with the first transmitter (304), which is operable in the first communication link (107), for transmitting the acknowledgment message to the mobile device (101).
Further, the second receiver (305) is operable in the second communication link (102) for receiving an authentication request from the mobile device (101). The second receiver (305) is in operational communication with the Authentication and Provisioning unit (308) in the processor (301). In an aspect of the invention, the acknowledgment message transmitted by the registration unit (307) comprises a unique identifier enabling an automatic transmitting of the authentication request by the mobile device (101). In an aspect of the invention, the authentication request comprises the unique identifier, SIM card identifier, a mobile number of the mobile device (101), and a mobile number as appended by the second communication link (108) to the authentication request.
Upon receiving the authentication request, the Authentication and Provisioning unit (308) is adapted determine whether authentication request satisfies the second condition set. In an aspect of the invention, the second condition set includes one or more conditions or rules predefined for the tokenization server (105). In one example of the predefined condition, the mobile number as contained in the authentication request is compared with the mobile number as appended by the second communication link to the authentication request. In another example of the predefined condition, the unique number contained in the authentication request is compared with the mobile number from which the authentication request is transmitted. In one another example of the predefined condition, a determination is made if the authentication request is received within a predetermined time period. In such example, the time period is calculated from the time of providing the acknowledgment message to the mobile device (101).
Upon satisfying the second condition set, the Seed & Authenticator Generation and Transmission (309), in operational communication with the Authentication and Provisioning unit (308), is adapted to generate a seed specific to the SIM card (104) available in the mobile device (101). Further, the Authentication and Provisioning unit (308) may store a copy of the seed in the database.
In addition, the Seed & Authenticator Generation and Transmission (309) provides a time bound authenticator adapted to periodically generate a time-bound authentication code based on the seed. In one aspect of the invention, the time-bound authenticator is Common Security Toolkit (CST) application and is comprised within a SIM Application Toolkit (STK) or a Java card applet. The processor (301) and more particularly the Authentication and Provisioning unit (308) may be operational communication with the second transmitter (306), which is operable in the second communication link (108), for transmitting the time-bound authenticator and the seed to the mobile device (101) such that the time-bound authenticator and the seed are being adapted to be stored on the SIM card (104).
Thus, only an authenticated mobile device can receive the seed and the time bound authenticator, thereby increasing security. Further, the time bound authenticator periodically generates time-bound code based on the seed, which is specific to SIM. This greatly increases security, especially in case the mobile device is stolen and the SIM is destroyed or replaced.
Further, the first receiver (303) is adapted to receive a request for an electronic token from the mobile device (101). The first receiver (303) is in operational communication with the Token Preparation and Transmission unit (310) in the processor (301). Upon receiving the request for the electronic token, the Token Preparation and Transmission unit (310) is adapted to generate a first electronic token and encrypt the first electronic token by an encryption technique pre-agreed with the mobile device (101) to generate an encrypted first electronic token. The encryption technique is pre-agreed with the mobile device (101) during the registration process. In an example, the pre-agreed encryption technique is white box cryptography (WBC) encryption. The processor (301) and more particularly the Token Preparation and Transmission unit (310) may be in operational communication with the first transmitter (304) for transmitting the encrypted first electronic token to the mobile device (101). Thereafter, the mobile device (101) is adapted to generate a second electronic token based on the first electronic token and the time-bound authentication code. In one aspect of the invention, the processing of transmitting request for an electronic token and receiving an encrypted electronic token is periodic. Further, the encrypted first electronic token is saved in a memory of the mobile device (101).
Thus, the security of the second electronic token is greatly increased as the second electronic token is generated using a first electronic token and a time bound code, which itself is generated using a seed specific to SIM card of the mobile device.
When the mobile device (101) interacts with the POS device (109) during a transaction, the mobile device (101) can provide to the POS device (109) the second electronic token and a cryptogram for authorizing and completing the transaction. The POS device (109) may then generate an authorization request message including the second electronic token and the cryptogram, and send the same to the acquirer device (110). The acquirer device (110) may forward the authorization request message including the token (and other additional information as may be needed) to the issuer device (112). The issuer device (112) (acting as a designated intermediary device), may determine that the authorization request message comprises a token and may provide the authorization request message (as a whole) or the second electronic token and the cryptogram (i.e. relevant information) to the tokenization server (105).
Accordingly, the transceiver (302) of the tokenization server (105) further comprises a third receiver (312) and a third transmitter (313). The third receiver (312) is adapted receive from the designated intermediary device, the second electronic token and the cryptogram, as sent by the mobile device (101). The third receiver (312) may be in operational communication with the Verification unit (311) in the processor (301). Upon receiving the second electronic token and the cryptogram, the Verification unit (311) is adapted to verify the cryptogram. Further, the Verification unit (311) is adapted to access the database to obtain the copy of the seed and validate the authentication code received in the second token based on the copy of the seed. Thereafter, the Verification unit (311) obtains an account identifier as per pre-stored mapping data (de-tokenization process) from the database, when the authentication code is verified. The Verification unit (311) may be in further operational interconnection with the third transmitter (313) for transmitting the account identifier thus obtained to the designated intermediary device (authentication transmission) to enable the designated intermediary device to take appropriate action based thereupon. In one aspect of the invention, the Verification unit (311) may perform the various steps as described above in a manner as known in the art.
Thus, the tokenization server (105) may evaluate the cryptogram, may search for token record associated with the received token to determine an account identifier associated with the token and may provide the account identifier to the issuer device (106). The account identifier can include one or more of actual card number, a mobile number, a personal account number (PAN) or other suitable piece of information. Based on the account identifier, the issuer device (112) may perform additional steps of evaluation and based on the results of such evaluation send an appropriate response in respect of the authorization request message to the acquirer device (110). The acquirer device (110) may in turn communicate the response to the POS device (109).
While in the above paragraphs, the tokenization server (105) has been described in detail in terms of its construction and in terms of the process performed, in the following paragraphs, the details of the mobile device (105) will be provided.
In accordance with the present invention, Figure 4 illustrates a method (400) implemented by a mobile device for receiving an electronic token from a tokenization server. Accordingly, the method (400) comprises the steps of: transmitting (401), to a tokenization server via a first communication link, a registration request; receiving (402), from the tokenization server via the first communication link, an acknowledgement message upon successful registration; transmitting (403), to the tokenization server via a second communication link, an authentication request; receiving (404), from the tokenization server via the second communication link, a time-bound authenticator and a seed specific to a SIM card available in the mobile device, wherein the time-bound authenticator is adapted to periodically generate a time-bound authentication code based on the seed; storing (405) the time-bound authenticator and the seed on the SIM card by the mobile device; transmitting (406), to the tokenization server via the first communication link, a request for an electronic token; and receiving (407), from the tokenization server via the first communication link, a first electronic token encrypted with an encryption technique pre-agreed with the mobile device, wherein the mobile device generates a second electronic token based on the first electronic token and the time-bound authentication code.
In one aspect of the invention, the encrypted electronic token is stored on a memory associated with the mobile device.
In another aspect of the invention, the encrypted electronic token is stored on a non-secure portion of a memory associated with the mobile device.
In accordance with the present invention, Figure 5 illustrates a method (500) implemented by a mobile device for sharing an electronic token. Accordingly, the method (500) comprises the steps of: receiving (501), by a receiving unit, request for an electronic token; retrieving (502), by a processor, an encrypted first electronic token from a memory; decrypting (503), by the processor, the encrypted first electronic token; sending (504) a request for a time-bound authentication code, by the processor, to a time-bound authenticator stored on a SIM card available in the mobile device; receiving (505) from the time-bound authenticator, by the processor, the time-bound authentication code, wherein the time-bound authenticator generates the time-bound authentication code based on a seed specific to the SIM card, the seed being stored on the SIM card; generating (506) a second electronic token, by the processor, based on the decrypted first electronic token and the time-bound authentication code; and transmitting (507), by a transmitting unit, the second electronic token.
In one aspect of the invention, the request for the electronic token is received by a near field communication (NFC) unit incorporated in the mobile device.
In one aspect of the invention, the encrypted first electronic token is retrieved from a non-secure portion of the memory associated with the mobile device.
In one aspect of the invention, the encrypted first electronic token is decrypted by the processor adopting a pre-agreed decryption technique to obtain the decrypted first electronic token.
Accordingly, Figure 6 illustrates the mobile device (101) in accordance with the present invention. As discussed with reference to Figure 1, the mobile device (101) includes the processor implementing a mobile wallet application (MWA) (102), the NFC controller (103), and the SIM card (104). The mobile device (101) further includes a transceiver (601) and a memory (602) in operational communication with the processor (102). The transceiver (601) may further comprise a first transmitter (603), a first receiver (604), a second transmitter (605), and a second receiver (606). Further, in accordance with the present invention, the processor (102) may comprise a Registration Request Generator (607), an Authentication Request Generator (608), a Decryption Unit (609), an Electronic token Request Generator (610), and a Token & Cryptogram Generator (611). In addition, the mobile device (101) may include an I/O unit (612) and a display unit (613). Although specific hardware components have been depicted in reference to the mobile device (101), it is to be understood that the mobile device (101) and the various units/components therein may include other hardware and/or software components as known in the art for performing necessary functions. Further, it would be understood, that for communication between various units of the mobile device (101), a secure session is created and communication is made using APDU command/response format.
In operation, referring to Figures 1, 4, and 6, the Registration Request Generator (607) generates the registration request. Upon generation of the registration request, the first transmitter (603), being operable in the first communication link (107), transmits the registration request to the tokenization server (105). As discussed with reference to Figures 1-3, the tokenization server (105) validates the registration request and sends the acknowledgement message. Accordingly, the first receiver (604), operable in the first communication link (107), receives the acknowledgement message from the tokenization server via the first communication link (107).
Further, upon receiving the acknowledgement message, the Authentication Request Generator (608) generates the authentication request. Upon generating the authentication request, the second transmitter (605), being operable in the second communication link (108) for transmitting the authentication request to the tokenization server (105). As discussed with reference to Figures 1-3, the tokenization server (105) generates a seed (614) specific to the SIM card (104) available in the mobile device (101) and transmits a time-bound authenticator (615) and the seed (614) to the mobile device (101). The time-bound authenticator (615) is adapted to periodically generate a time-bound authentication code based on the seed (614). Accordingly, the second receiver (606), operable in the second communication link (108), receives the time-bound authenticator (615) and the seed (614). Upon receiving the time-bound authenticator (615) and the seed (614) from the tokenization server (105), the mobile device (101) stores the time-bound authenticator (615) and the seed (614) on the SIM card (104).
Further, the Electronic token Request Generator (610) generates the request for an electronic token to the tokenization server (105). Upon generating the request, the first transmitter (603) transmits the request to the tokenization server (105) via the first communication link (107). As discussed with reference to Figures 1-3, the tokenization server (105) generates first electronic token and encrypts the first electronic token encrypted with an encryption technique pre-agreed with the mobile device. In an example, the pre-agreed encryption technique is white box cryptography (WBC) encryption, which is agreed during the time of registration with the tokenization server (105). Thereafter, the tokenization server (105) transmits encrypted first electronic token (616) to the mobile device (104). Accordingly, the first receiver (604) receives the encrypted first electronic token (616) from the tokenization server (105) via the first communication link (107). Upon receiving the encrypted first electronic token (616), the mobile device (101) stores the encrypted first electronic token (616) in the memory (602). In one aspect of the invention, the process of transmitting request for an electronic token and receiving an encrypted electronic token is periodic.
During a transaction, the POS device (109) requests for an electronic token for authentication via the HCE mode. As described with reference to Figure 1-3 above, the POS device (109) request for the electronic token via the designated intermediary device. The NFC controller (103) receives the request for the electronic token from the designated intermediary device and provides the request to the processor (102). Upon receiving the request for the electronic token, the Decrypting unit (609) obtains the encrypted first electronic token (616) from the memory (602) and decrypts the first electronic token by a decryption technique pre-agreed with the tokenization server (105). In an example, the pre-agreed decryption technique is white box cryptography (WBC) decryption, which is agreed during the time of registration with the tokenization server (105). Upon decryption, the Decrypting unit (608) saves the decrypted first electronic token in the memory (602) and sends a request to the time-bound authenticator (615) stored in the SIM card (104) to generate a time-bound authentication code. Upon receiving the request, the time-bound authenticator (615) generates the time-bound authentication based on the seed (614) and a built-in clock (not shown in the figure) of the mobile device (101). As described earlier, the time-bound authentication code is valid for a predetermined duration. In an example, the predetermined duration is 60 seconds.
Upon generating the time-bound authentication code, the time-bound authenticator (615) transmits the time-bound authentication code to the Token & Cryptogram Generator (611). Upon receiving the time-bound authentication code, the Token & Cryptogram Generator (610) generates the second electronic token using the decrypted first electronic token and the time-bound authentication code. The Token & Cryptogram Generator (610) further generates a cryptogram. Upon generating, the Token & Cryptogram Generator (610) shares the second electronic token and the cryptogram with the designated intermediary device. As described earlier with reference to the Figure 1-3, the designated intermediary device shares the second electronic token and the cryptogram with the tokenization server (105) for verification and takes further actions as necessary.
Thus, the security of the electronic token is greatly increased and the chances of copying sensitive information from the electronic token are greatly reduced, as the electronic token being shared with the POS device is very specific to the SIM card of the mobile device and is valid for a predetermined time only. As such, the security of the process of authenticating the mobile device involved in contactless payments is greatly increased and correspondingly user-experience is greatly enhanced.
While specific language has been used to describe the disclosure, any limitations arising on account of the same are not intended. As would be apparent to a person in the art, various working modifications may be made to the method in order to implement the inventive concept as taught herein.
The figures and the forgoing description give examples of embodiments. Those skilled in the art will appreciate that one or more of the described elements may well be combined into a single functional element. Alternatively, certain elements may be split into multiple functional elements. Elements from one embodiment may be added to another embodiment. For example, orders of processes described herein may be changed and are not limited to the manner described herein. Moreover, the actions of any flow diagram need not be implemented in the order shown; nor do all of the acts necessarily need to be performed. Also, those acts that are not dependent on other acts may be performed in parallel with the other acts. The scope of embodiments is by no means limited by these specific examples. Numerous variations, whether explicitly given in the specification or not, such as differences in structure, dimension, and use of material, are possible. The scope of embodiments is at least as broad as given by the following claims.

Claims:We Claim:

1. A method implemented by a tokenization server for communicating electronic token to a mobile device, said method comprising:
- receiving, from the mobile device via a first communication link, a registration request;
- providing an acknowledgment message, to the mobile device via the first communication link, in case a first condition set is satisfied by the registration request;
- receiving, from the mobile device via a second communication link, an authentication request;
- generating a seed specific to a SIM card available in the mobile device;
- providing a time-bound authenticator and the seed to the mobile device via the second communication link, in case a second condition set is satisfied by the authentication request, the time-bound authenticator and the seed are being adapted to be stored on the SIM card, wherein the time-bound authenticator is adapted to periodically generate a time-bound authentication code based on the seed;
- receiving a request for an electronic token from the mobile device via the first communication link; and
- providing an encrypted first electronic token to the mobile device via the first communication link, wherein the first electronic token is encrypted by an encryption technique pre-agreed with the mobile device such that the mobile device is adapted to generate a second electronic token based on the first electronic token and the time-bound authentication code.

2. The method as claimed in claim 1, wherein the time-bound authenticator is Common Security Toolkit (CST) application and is comprised within a SIM Application Toolkit (STK) or a Java card applet.

3. The method as claimed in claim 1, wherein the seed is a random encrypted key.

4. The method as claimed in claim 1, wherein generating the seed further comprises:
- generating the seed based on information present in the authentication request; and
- storing a copy of the seed in a database.

5. The method as claimed in claim 1, wherein the time-bound authentication code is valid for a predetermined duration.

6. The method as claimed in claim 1, wherein the first communication link connects the mobile device and the tokenization server directly.

7. The method as claimed in claim 1, wherein the second communication link connects the mobile device and the tokenization server via the SIM card and a network operator corresponding to the mobile device.

8. The method as claimed in claim 1, wherein the registration request includes one or more of an account identifier, a PIN number, a card number, a mobile number, and a personal account number (PAN).

9. The method as claimed in claim 1, wherein the first condition set includes a card number or a PAN number being pre-mapped to a mobile number of the mobile device.

10. The method as claimed in claim 1, wherein the acknowledgment message comprises a unique identifier enabling an automatic transmitting of the authentication request.

11. The method as claimed in claim 10, wherein the authentication request comprises the unique identifier, SIM card identifier, a mobile number of the mobile device sending the authentication request, and a mobile number as appended by the second communication link to the authentication request.

12. The method as claimed in claim 12, wherein the second condition set includes one or more conditions selected from the group comprising of:
a. the mobile number as contained in the authentication request matches with the mobile number as appended by the second communication link to the authentication request;
b. the unique number contained in the authentication request corresponds to the mobile number from which the authentication request is transmitted; and
c. the authentication request is received within a predetermined time period, the time period being calculated from the time of providing the acknowledgment.

13. The method as claimed in claim 1, wherein providing the encrypted first electronic token comprises:
a. generating the first electronic token;
b. generating mapping data that maps the first electronic token to an account identifier as included in the request for electronic token; and
c. encrypting the first electronic token by the encryption technique pre-agreed with the mobile device.

14. The method as claimed in claim 1, wherein the request for the electronic token comprises an account identifier which can include one or more of actual card number, a mobile number associated with the SIM card, and a personal account number (PAN).

15. The method as claimed in claim 1, wherein the encryption technique is pre-agreed with the mobile device during the registration of the mobile device with the tokenization server.

16. The method as claimed in claim 1 further comprising: receiving, from a designated intermediary device, the second electronic token and a cryptogram, as sent by the mobile device.

17. The method as claimed in claim 16 further comprising:
a. verifying the cryptogram thus received;
b. validating the authentication code received in the second token based on a copy of the seed available in a database;
c. obtaining an account identifier as per pre-stored mapping data; and
d. transmitting the account identifier to the designated intermediary device.

18. A method for receiving an electronic token implemented by a mobile device, the method comprising:
- transmitting, to a tokenization server via a first communication link, a registration request;
- receiving, from the tokenization server via the first communication link, an acknowledgement message upon successful registration;
- transmitting, to the tokenization server via a second communication link, an authentication request;
- receiving, from the tokenization server via the second communication link, a time-bound authenticator and a seed specific to a SIM card available in the mobile device, wherein the time-bound authenticator is adapted to periodically generate a time-bound authentication code based on the seed;
- storing the time-bound authenticator and the seed on the SIM card by the mobile device;
- transmitting, to the tokenization server via the first communication link, a request for an electronic token; and
- receiving, from the tokenization server via the first communication link, a first electronic token encrypted with an encryption technique pre-agreed with the mobile device, wherein the mobile device generates a second electronic token based on the first electronic token and the time-bound authentication code.

19. The method as claimed in claim 18, wherein the encrypted electronic token is stored on a memory associated with the mobile device.

20. The method as claimed in claim 18, wherein the encrypted electronic token is stored on a non-secure portion of a memory associated with the mobile device.

21. A method for sharing an electronic token implemented by a mobile device, the method comprising:
- receiving, by a receiving unit, request for an electronic token;
- retrieving, by a processor, an encrypted first electronic token from a memory;
- decrypting, by the processor, the encrypted first electronic token;
- sending a request for a time-bound authentication code, by the processor, to a time-bound authenticator stored on a SIM card available in the mobile device;
- receiving from the time-bound authenticator, by the processor, the time-bound authentication code, wherein the time-bound authenticator generates the time-bound authentication code based on a seed specific to the SIM card, the seed being stored on the SIM card;
- generating a second electronic token, by the processor, based on the decrypted first electronic token and the time-bound authentication code; and
- transmitting, by a transmitting unit, the second electronic token.

22. The method as claimed in claim 21, wherein the request for the electronic token is received by a near field communication (NFC) unit incorporated in the mobile device.

23. The method as claimed in claim 21, wherein the encrypted first electronic token is retrieved from a non-secure portion of the memory associated with the mobile device.

24. The method as claimed in claim 21, wherein the encrypted first electronic token is decrypted by the processor adopting a pre-agreed decryption technique to obtain the decrypted first electronic token.

25. A tokenization server for communicating electronic token to a mobile device, said tokenization server comprising:
- a first receiver operable in a first communication link for receiving a registration request from the mobile device;
- a processor for determining whether registration request satisfies a first condition set and in response thereto, generating an acknowledgment message;
- a first transmitter operable in the first communication link for transmitting the acknowledgment message to the mobile device;
- a second receiver operable in a second communication link for receiving an authentication request from the mobile device;
- the processor being further adapted to determine whether authentication request satisfies a second condition set and in response thereto generating a seed specific to a SIM card available in the mobile device;
- a second transmitter operable in the second communication ink for transmitting a time-bound authenticator and the seed to the mobile device, the time-bound authenticator and the seed are being adapted to be stored on the SIM card, wherein the time-bound authenticator is adapted to periodically generate a time-bound authentication code based on the seed;
- the first receiver being further adapted to receive a request for an electronic token from the mobile device; and
- the first transmitter being further adapted to transmit an encrypted first electronic token to the mobile device, wherein the first electronic token is encrypted by an encryption technique pre-agreed with the mobile device such that the mobile device is adapted to generate a second electronic token based on the first electronic token and the time-bound authentication code.

26. The tokenization server as claimed in claim 25 further comprising: a third receiver being adapted to receive from a designated intermediary device, the second electronic token and a cryptogram, as sent by the mobile device.

27. The tokenization server as claimed in claim 26, wherein the processor is further adapted to:
- access a database to obtain a copy of the seed;
- validate the authentication code received in the second token based on a copy of the seed; and
- obtain therefrom account identifier as per pre-stored mapping data, when the authentication code is verified.

28. The tokenization server as claimed in claim 27 further comprising: a third transmitter being adapted to transmit the account identifier to the designated intermediary device.

29. A mobile device for sharing an electronic token, said mobile device comprising:
- a memory storing thereupon an encrypted first electronic token;
- a receiving unit to receive a request for an electronic token;
- a processor in operational communication with the receiving unit and the memory, the processor being adapted to:
- retrieve the encrypted first electronic token from the memory in response to the request for the electronic token;
- decrypt the encrypted first electronic token;
- send a request for a time-bound authentication code to a time-bound authenticator stored on a SIM card available in the mobile device;
- receive the time-bound authentication code from the time-bound authenticator, wherein the time-bound authenticator generates the time-bound authentication code based on a seed specific to the SIM card, the seed being stored on the SIM card; and
- generate a second electronic token based on the decrypted first electronic token and the time-bound authentication code; and
- a transmitting unit adapted to transmit the second electronic token.