DEVICE PROVISIONING USING PARTIAL PERSONALIZATION SCRIPTS

• US 20140337236A1
• Filed: 05/12/2014
• Published: 11/13/2014
• Est. Priority Date: 05/10/2013
• Status: Active Grant

• Current Assignee: Visa International Service Association (Visa, Inc.)
• Original Assignee: Visa International Service Association (Visa, Inc.)
• Inventors: Makhotin, Oleg, Wong, Erick
• Granted Patent: US 9,760,886 B2
• Time in Patent Office: Days
• US Class Current: 705/71
• CPC Class Codes: G06Q 20/3227 using secure elements embedded in M-devices
• CPC Class Codes: G06Q 20/3265 characterised by personalisation for use
• CPC Class Codes: G06Q 20/3278 RFID or NFC payments by means of M-devices
• CPC Class Codes: G06Q 20/354 Card activation or deactivation
• CPC Class Codes: G06Q 20/3552 Downloading or loading of personalisation data
• CPC Class Codes: G06Q 20/363 with the personal data of a user
• CPC Class Codes: G06Q 20/38215 Use of certificates or encrypted proofs of transaction rights
• CPC Class Codes: G06Q 20/3829 involving key management

Abstract

Embodiments of the invention relate to systems and methods for efficiently provisioning mobile devices with personalization data. For some embodiments, a method is disclosed comprising receiving a request for provisioning comprising device information for a mobile device and user authentication information for a user, generating a partial personalization script, an activation script, and a deletion script using the device information, sending the partial personalization script, the activation script, and the deletion script to an application provider computer, wherein the application provider computer initiates execution of the partial personalization script on the mobile device, authenticating the user authentication information, and sending an activation message to the application provider computer, wherein the application provider computer initiates execution of the activation script.

Claims

1. A service provider computer comprising:

a processor; and

a non-transitory computer-readable medium comprising code executable by the process for implementing a method comprising;

receiving a request for provisioning comprising device information for a mobile device and user authentication information for a user;

generating a partial personalization script, an activation script, and a deletion script using the device information;

sending the partial personalization script, the activation script, and the deletion script to an application provider computer, wherein the application provider computer initiates execution of the partial personalization script on the mobile device;

authenticating the user using the user authentication information; and

sending an activation message to the application provider computer, wherein the application provider computer initiates execution of the activation script.

2. The service provider computer of claim 1, wherein execution of the partial personalization script stores personalization data onto the mobile device in an inaccessible form, and wherein execution of the activation script enables access to the personalization data.

3. The service provider computer of claim 1, wherein authenticating the user and executing the partial personalization script are performed in parallel.

4. The service provider computer of claim 2, wherein the application provider computer is a wallet provider computer, and wherein the personalization data comprises payment data.

5. The service provider computer of claim 2, wherein generating the partial personalization script comprises:

retrieving a personalization master key;

generating a personalization session key using the device information and the personalization master key;

generating store data commands comprising the personalization data; and

encrypting the store data commands using the personalization session key.

6. The service provider computer of claim 5, further comprising:

determining that the personalization session key is expired;

establishing a new session associated with a new personalization session key;

generating the new activation script using the new personalization session key; and

sending the new activation script.

7. The service provider computer of claim 1, wherein the device information comprises a device cryptogram, and wherein authenticating the user comprises:

retrieving a personalization master key;

generating a personalization session key using the device information and the personalization master key; and

validating the device cryptogram using the personalization session key.

8. The service provider computer of claim 4, wherein the user authentication information comprises a primary account number (PAN), wherein the personalization data comprises a payment token, and wherein the method further comprises sending the PAN and the payment token to an issuer upon execution of the activation script.

9. A computer-implemented method comprising:

receiving, by a processor, a request for provisioning comprising device information for a mobile device and user authentication information for a user;

generating, by the processor, a partial personalization script, an activation script, and a deletion script using the device information;

sending, by the processor, the partial personalization script, the activation script, and the deletion script to an application provider computer, wherein the application provider computer initiates execution of the partial personalization script on the mobile device;

authenticating, by the processor, the user using the user authentication information; and

sending, by the processor, an activation message to the application provider computer, wherein the application provider computer initiates execution of the activation script.

10. The method of claim 9, wherein execution of the partial personalization script stores personalization data onto the mobile device in an inaccessible form, and wherein execution of the activation script enables access to the personalization data.

11. The method of claim 9, wherein authenticating the user and executing the partial personalization script are performed in parallel.

12. The method of claim 10, wherein the application provider computer is a wallet provider computer, and wherein the personalization data comprises payment data.

13. The method of claim 10, wherein generating the partial personalization script comprises:

retrieving, by the processor, a personalization master key;

generating, by the processor, a personalization session key using the device information and the personalization master key;

generating, by the processor, store data commands comprising the personalization data; and

encrypting, by the processor, the store data commands using the personalization session key.

14. The method of claim 13, further comprising:

determining, by the processor, that the personalization session key is expired;

establishing, by the processor, a new session associated with a new personalization session key;

generating, by the processor, the new activation script using the new personalization session key; and

sending, by the processor, the new activation script.

15. The method of claim 9, wherein the device information comprises a device cryptogram, and wherein authenticating the user comprises:

retrieving, by the processor, a personalization master key;

generating, by the processor, a personalization session key using the device information and the personalization master key; and

validating, by the processor, the device cryptogram using the personalization session key.

16. The method of claim 12, wherein the user authentication information comprises a primary account number (PAN), wherein the personalization data comprises a payment token, and wherein the method further comprises sending , by the processor, the PAN and the payment token to an issuer upon execution of the activation script.

17. An application provider computer comprising:

a processor; and

a non-transitory computer-readable medium comprising code executable by the process for implementing a method comprising;

sending a request for provisioning comprising device information for a mobile device and user authentication information for a user, wherein the user is authenticated using the user authentication information;

receiving a partial personalization script, an activation script, and a deletion script based on the request for provisioning;

initiating execution of the partial personalization script on the mobile device;

receiving an activation message; and

initiating execution of the activation script on the mobile device.

18. The application provider computer of claim 17, wherein execution of the partial personalization script stores personalization data onto the mobile device in an inaccessible form, and wherein execution of the activation script enables access to the personalization data.

19. The application provider computer of claim 17, wherein authenticating the user and executing the partial personalization script are performed in parallel.

20. The application provider computer of claim 18, wherein the application provider computer is a wallet provider computer, and wherein the personalization data comprises payment data.