A Framework for TrustZone Encoding/Decoding for QR Buyer-Presented and VCC Offline Generated Payments

In earlier works we secured merchant-presented QR payments using the TrustZone. Other works have previously secured buyer-presented QR codes for static QR codes which only need be generated once. We have built a system that extends QR code decoding between Android systems and servers using Split-SSL. Decoding was tested for both cases of using split decoder installed within the TrustZone or made by the vendor server. The TrustZone decoding provided better protection, convenience, and performance. In addition, we have developed a system that generates virtual credit card numbers offline for full data security. In this work, we introduce the fourth component, namely, QR encoding from within the TrustZone, or a standalone device (TrustProvider) compatible with the TrustZone systems, with no overhead, while maintaining small Trusted Computing Base (TCB).Combining all four components in the TrustZone or TrustProvider can extend security and protection to a wide range of transactions including QR codes and VCC card generation. Feasibility and performance for the extended services are outlined at the end of the article. The system extends security for buyer-presented purchases with comprehensive protection when presented as virtual-based numbers. Applications in banking and QR trading are direct outcome. We are working on building a framework for an integrated system that can provide security well beyond exciting tokenization and VCC systems and enables a peer-to-peer transactions that encourage developers’ free access with open-source implementations and remove middleman threats or controls.