# US 2014/0195429 A1 · Method for protecting cardholder data in a mobile device that performs secure payment transactions and which enables the mobile device to function as a secure payment terminal > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2014/0195429 A1 - Document ID: US20140195429A1 - Status: Published application - Kind: A1 - Application number: 14/150,313 - Filed: 2014-01-08 - Published: 2014-07-10 - Earliest claimed: 2013-01-08 - Assignees: Cirque Corporation - Applicants: Cirque Corporation - Inventors: Keith L. Paulsen - Web page: https://patentgrep.com/patent/US20140195429A1 ## CPC - G06Q 20/382: {insuring higher security of transaction} - G06Q 20/322: {Aspects of commerce using mobile devices [M-devices]} - G06Q 20/3226: {Use of secure elements separate from M-devices} - G06Q 20/3227: {using secure elements embedded in M-devices} - G06Q 20/3229: {Use of the SIM of a M-device as secure element} - G06Q 20/3278: {RFID or NFC payments by means of M-devices} - G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR ## Abstract A system and method system and method for enabling a portable electronic appliance such as a mobile telephone or tablet computer to be able to function as a device that may store account information in order to make a secure payment, or to be able to use the portable electronic appliance as a secure payment terminal so that a credit card holder may use it to make a secure payment. ## Claims ### Claim 1 A system for making a secure payment using a secure element in a mobile device, said system comprised of: a mobile device; a secure element within the mobile device for securely storing financial data; a touch sensor for providing secure input to the secure element that is not accessible by an operating system of the mobile device; and a means for communicating with a host that processes a financial transaction. ### Claim 2 (depends on 1) The system as defined in claim 1 wherein the secure element is further comprised of a secure element CPU that may process financial information stored therein. ### Claim 3 (depends on 1) The system as defined in claim 1 wherein the means for communicating is further comprised of a near field communication system that is coupled to the mobile device to thereby provide wireless communication. ### Claim 4 A method for making a secure payment using a secure element in a mobile device, said method comprised of: 1) providing a mobile device, a secure element within the mobile device for securely storing financial data, a touch sensor for providing secure input to the secure element that is not accessible by an operating system of the mobile device, and a means for communicating with a host that processes a financial transaction; 2) receiving a personal identification number on the touch sensor; 3) transmitting the personal identification number to the secure element in a secure manner such that the operating system does not see the personal identification number; 4) creating a token that combines at least the personal identification number and a credit card account number; and 5) transmitting the token to the host. ### Claim 5 (depends on 4) The method as defined in claim 4 wherein the method further comprises: 1) providing a secure element CPU as the secure element in order to process data to create an encrypted token; and 2) encrypting the token. ### Claim 6 (depends on 5) The method as defined in claim 5 wherein the method further comprises: 1) transmitting the encrypted token from the host to a Host Security Module; 2) decrypting the token in the Host Security Module to obtain at least the personal identification number and the credit card account number; and 3) transmitting the decrypted personal identification number and the credit card account number to the host and completing the financial transaction. ### Claim 7 (depends on 4) The method as defined in claim 4 wherein the method further comprises: 1) providing a near field communication system for wireless communication; 2) receiving the credit card account information from the credit card using the near field communication system; and 3) transmitting the credit card account information from the near field communication system to the secure element. ### Claim 8 (depends on 7) The method as defined in claim 7 wherein the method further comprises transmitting the encrypted token from the host to the Host Security Module using an online connection or a near field communication system connection. ### Claim 9 (depends on 8) The method as defined in claim 8 wherein the method further comprises providing a software patch in the near field communication system that may be used to intercept a request for the credit card account information from the host. ### Claim 10 (depends on 9) The method as defined in claim 9 wherein the method further comprises storing the software patch in an EEPROM so that it may be updated as needed. ### Claim 11 (depends on 10) The method as defined in claim 10 wherein the method further comprises storing the software patch in memory of the secure element CPU to thereby verify the integrity of the software patch that is stored in the near field communication system. ### Claim 12 (depends on 11) The method as defined in claim 11 wherein the method further comprises providing a secure prompt in the mobile device that prevents access to data input to the secure prompt from an operating system of the mobile device. ### Claim 13 (depends on 12) The method as defined in claim 12 wherein the method further comprises using a digital rights management module to create the secure prompt on a display of the mobile device. ### Claim 14 (depends on 13) The method as defined in claim 13 wherein the method further comprises enabling the touch sensor to input data to the secure prompt created by the digital rights management module to thereby prevent the operation system from receiving input from the touch sensor that is input to the secure prompt. ### Claim 15 (depends on 4) The method as defined in claim 4 wherein the secure element is selected from the group of secure elements comprised of a subscriber identity module (SIM), a universal integrated circuit card (UICC), a SIM card, a microSD slot and a secure element CPU.