# US 2019/0318342 A1 · Method and System for Contactless Transmissions Using Off-the-Shelf Devices > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2019/0318342 A1 - Document ID: US20190318342A1 - Status: Published application - Kind: A1 - Application number: 16/382,338 - Filed: 2019-04-12 - Published: 2019-10-17 - Earliest claimed: 2018-04-13 - Assignees: Mastercard International Incorporated - Applicants: Mastercard International Incorporated - Inventors: Alan Mushing; Fernando Lourenco; Bruce John Rutherford - Web page: https://patentgrep.com/patent/US20190318342A1 ## CPC - G06Q 20/3278: {RFID or NFC payments by means of M-devices} - G06Q 20/4014: {Identity check for transactions} - G06Q 20/20: Point-of-sale [POS] network systems - G06Q 20/206: {comprising security or operator identification provisions, e.g. password entry} - G06Q 20/227: {characterised in that multiple accounts are available, e.g. to the payer} - G06Q 20/36: using electronic wallets or electronic money safes - G06Q 20/3821: {Electronic credentials} - G06Q 20/388: {using mutual authentication without cards, e.g. challenge-response} - G06Q 20/409: {Device specific authentication in transaction processing} - H04L 9/30: Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy - G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A method for secured receipt and usage of payment credentials using a commercial-off-the-shelf (COTS) device includes: storing, in the COTS device, a secure application program and cryptographic keys; establishing, by the program, a secure communication channel with a back-end system inaccessible by any application program or component in the COTS device; exchanging attestation data between the program and the back-end system using the communication channel; receiving payment credentials from a payment card by a near field communication (NFC) interface in the COTS device; transmitting the payment credentials to the program by the NFC interface; enciphering, by the program, the payment credentials; and transmitting, by the program of the COTS device, the enciphered payment credentials to the back-end system using the secure communication channel. ## Claims ### Claim 1 A method for secured receipt and usage of payment credentials using a commercial-off-the-shelf (COTS) device, comprising: storing, in a memory of the COTS device, a secure application program and one or more cryptographic keys, where the cryptographic keys are accessible using the secure application program and inaccessible by any other application program or component in the COTS device; establishing, by the secure application program in the COTS device, a secure communication channel with a back-end system, where the secure communication channel is inaccessible by any other application program or component in the COTS device; exchanging, by the secure application program in the COTS device, attestation data with the back-end system using the communication channel; receiving, by a near field communication interface of the COTS device, payment credentials from a payment card position within a predetermined distance of the COTS device; transmitting, by the near field communication interface of the COTS device, the payment credentials to the secure application program; enciphering, by the secure application program of the COTS device, the payment credentials; and transmitting, by the secure application program of the COTS device, the enciphered payment credentials to the back-end system using the secure communication channel. ### Claim 2 (depends on 1) The method of claim 1, wherein the payment credentials are enciphered using at least one of the one or more cryptographic keys. ### Claim 3 (depends on 1) The method of claim 1, wherein the secure application program does not cache the received and enciphered payment credentials. ### Claim 4 (depends on 1) The method of claim 1, further comprising: monitoring, by the secure application program in the COTS device, for an interruption event in the COTS device; and terminating, by the secure application program in the COTS device, an executed instance of the secure application program upon detection of the interruption event, where termination of the executed instance includes deletion of received payment credentials and enciphered payment credentials. ### Claim 5 (depends on 4) The method of claim 4, wherein the interruption event is at least one of: loss of focus of the secure application program, pausing of the secure application program, screen capture of the COTS device, interaction with the near field communication interface of the COTS device by any other application program or component in the COTS device; and activation of a sensor in the COTS device. ### Claim 6 (depends on 1) The method of claim 1, further comprising: storing, in the memory of the COTS device, an audit log for the secure application program; and updating, by the secure application program of the COTS device, the audit log for the establishing, exchanging, transmitting, and enciphering steps. ### Claim 7 (depends on 1) The method of claim 1, wherein the secure application program is stored in a trusted execution environment in the memory of the COTS. ### Claim 8 (depends on 1) The method of claim 1, wherein the near field communication interface is only accessible using the secure application program and inaccessible by any other application program or component in the COTS device. ### Claim 9 A system for secured receipt and usage of payment credentials using a commercial-off-the-shelf (COTS) device, comprising: a back-end system; and the COTS device, where the COTS device includes a memory and a near field communication interface, wherein the memory of the COTS device stores a secure application program and one or more cryptographic keys, where the cryptographic keys are accessible using the secure application program and inaccessible by any other application program or component in the COTS device, the secure application program in the COTS device establishes a secure communication channel with a back-end system, where the secure communication channel is inaccessible by any other application program or component in the COTS device, and exchanges attestation data with the back-end system using the communication channel, the near field communication interface of the COTS device receives payment credentials from a payment card position within a predetermined distance of the COTS device, and transmits the payment credentials to the secure application program, and the secure application program of the COTS device enciphers the payment credentials, and transmits the enciphered payment credentials to the back-end system using the secure communication channel. ### Claim 10 (depends on 9) The system of claim 9, wherein the payment credentials are enciphered using at least one of the one or more cryptographic keys. ### Claim 11 (depends on 9) The system of claim 9, wherein the secure application program does not cache the received and enciphered payment credentials. ### Claim 12 (depends on 9) The system of claim 9, wherein the secure application program in the COTS device monitors for an interruption event in the COTS device, and terminates an executed instance of the secure application program upon detection of the interruption event, where termination of the executed instance includes deletion of received payment credentials and enciphered payment credentials. ### Claim 13 (depends on 12) The system of claim 12, wherein the interruption event is at least one of: loss of focus of the secure application program, pausing of the secure application program, screen capture of the COTS device, interaction with the near field communication interface of the COTS device by any other application program or component in the COTS device; and activation of a sensor in the COTS device. ### Claim 14 (depends on 9) The system of claim 9, wherein the memory of the COTS device stores an audit log for the secure application program, and the secure application program of the COTS device updates the audit log for the establishing, exchanging, transmitting, and enciphering steps. ### Claim 15 (depends on 9) The system of claim 9, wherein the secure application program is stored in a trusted execution environment in the memory of the COTS. ### Claim 16 (depends on 9) The system of claim 9, wherein the near field communication interface is only accessible using the secure application program and inaccessible by any other application program or component in the COTS device.