System, device, and method of transaction verification based on challenge and response messages

Abstract

Computerized method for verification of user identity and transaction data authenticity, usable in systems having an electronic device that communicates with a remote server. The method includes: (a) receiving user interactions at a non-secure execution environment of the electronic device, reflecting transaction data entered by a user; and transmitting transaction data from the non-secure execution environment to the server; (b) locally authenticating the transaction data and user identity in a secure execution environment of the electronic device; and encrypting transaction data in that secure execution environment, by utilizing a Cryptographic Private Key of the electronic device as encryption key; and transmitting encrypted version of locally-authenticated transaction data from the electronic device to the server. Then, at the server: (c1) receiving the transaction data that was sent in step (a) from the non-secure execution environment to the server, and delaying transaction execution until arrival and verification processing of the encrypted version; (c2) receiving the encrypted version, and decrypting it by utilizing a Cryptographic Public Key of the electronic device as decryption key; (c3) checking whether or not transaction data obtained in step (c1), match transaction data obtained in step (c2); and if they do no match, then: generating a signal that voids or cancels the transaction.