Dynamic Offline TrustZone Virtual Credit Card Generator for Financial Transactions

Mobile devices are utilized in every aspect of our lives. They are commonly used for mobile payments which save the cardholder form carrying credit cards everywhere they go. Unfortunately, mobile devices operating systems are quite vulnerable as developers push more features which introduce security issues. Most mobile devices run on ARM architecture which supports TrustZone hardware-based security. TrustZone is used in many operations, e.g., fingerprint authentication, cryptography, etc. but it is still limited to the vendor will and some authorized third-party developers. In earlier works we secured merchant-presented (buyer-scanned) QR payments using the TrustZone. Other works have previously secured buyer-presented QR codes and such solutions work well for static QR codes which only need be generated once. In this work, we designed a novel virtual credit card generation algorithm which works offline and under the TrustZone environment. Virtual credit cards can protect users from credit card information theft which can happen in both physical and digital means. It is common to hear about hacked merchant databases which lead to massive leak of credit card information. This risk can be eliminated by the design we set in this work. Combining this design with mobile phones yields high protection for users’ data. Meanwhile, it is important that the normal-world operating system on the mobile phone never gets this information since it can be under a remote attacker’s control. Hence this is why we designed the algorithm to work under the TrustZone environment securely. We have proven the system’s correctness by sending the data over, a simulated network to ensure the proper verification of the generated data. In addition, the level of protection can reach near complete security where any fraudulent act can be foiled. Some options can ensure no one can breach the operations beyond intentional bank or user actions in the TrustZone.