Systems and methods for terminal device attestation for contactless payments

A non-transitory machine readable medium having instructions stored thereon, which when executed by a computer system, cause the computer system to perform operations for validating integrity of an environment of a terminal device in which an application is installed and running on the terminal device remote to the computer system, the operations comprising:

• validating integrity of an environment of the terminal device in which an instance of the application is installed and running on the terminal device, wherein validation is based at least in part on validation of a signature generated by a trusted execution environment of the terminal device using a first private encryption key and a second private encryption key;
• receiving a device attestation request comprising terminal device identification data, encrypted signal data generated by the trusted execution environment of the terminal device using a third encryption key that encrypts one or more terminal device signal data, and a signature generated from the terminal device identification data and encrypted signal data using the first private encryption key;
• accessing a first public encryption key that is associated with the terminal device identification data from a data store;
• verifying the signature using the first public encryption key;
• after verifying the signature, accessing a third decryption key from a data store that is associated with the terminal device identification data;
• decrypting the encrypted signal data using the third decryption key to obtain plaintext signal data;
• matching the plaintext signal data with known signal data that is associated with the terminal device identification data;
• after matching, generating an attestation cryptogram that includes an identifier of a second public encryption key;
• and
• transmitting, to the terminal device, the attestation cryptogram as a response to the device attestation request, the attestation cryptogram validating integrity of the terminal device when the terminal device submits processing requests to the computer system with the attestation cryptogram.

A computer system for validating integrity of an environment of a terminal device in which an application is installed and running on the terminal device remote to the computer system, comprising:

• a memory;
• and
• a processor coupled with the memory and configured to:
• validate integrity of an environment of the terminal device in which an instance of the application is installed and running on the terminal device, wherein validation is based at least in part on validation of a signature generated by a trusted execution environment of the terminal device using a first private encryption key and a second private encryption key,
• receive a device attestation request comprising terminal device identification data, encrypted signal data generated by the trusted execution environment of the terminal device using a third encryption key that encrypts one or more terminal device signal data, and a signature generated from the terminal device identification data and encrypted signal data using the first private encryption key,
• access a first public encryption key that is associated with the terminal device identification data from a data store,
• verify the signature using the first public encryption key,
• after verifying the signature, access a third decryption key from a data store that is associated with the terminal device identification data,
• decrypt the encrypted signal data using the third decryption key to obtain plaintext signal data,
• match the plaintext signal data with known signal data that is associated with the terminal device identification data,
• after matching, generate an attestation cryptogram that includes an identifier of a second public encryption key, and
• transmit, to the terminal device, the attestation cryptogram as a response to the device attestation request, the attestation cryptogram validating integrity of the terminal device when the terminal device submits processing requests to the computer system with the attestation cryptogram.