Apparatuses and Methods for Using a Primary User Device to Provision Credentials onto a Secondary User Device

• US 20150348025A1
• Filed: 09/02/2014
• Published: 12/03/2015
• Est. Priority Date: 05/29/2014
• Status: Active Grant

• Current Assignee: Apple Inc.
• Original Assignee: Apple Inc.
• Inventors: Brown, Jeremy T., Dicker, George R., Steele, Glen W., Grainger, Morgan J., Rosen, Zachary A.
• Granted Patent: US 11,017,384 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06Q 20/12 specially adapted for electronic shopping systems
• CPC Class Codes: G06Q 20/20 Point-of-sale [POS] network systems
• CPC Class Codes: G06Q 20/321 using wearable devices
• CPC Class Codes: G06Q 20/3227 using secure elements embedded in M-devices
• CPC Class Codes: G06Q 20/3278 RFID or NFC payments by means of M-devices
• CPC Class Codes: G06Q 20/351 Virtual cards
• CPC Class Codes: G06Q 20/354 Card activation or deactivation
• CPC Class Codes: G06Q 20/367 involving electronic purses or money safes
• CPC Class Codes: G06Q 20/3821 Electronic credentials

Abstract

A system for provisioning credentials onto an electronic device is provided. The system may include a payment network subsystem, a service provider subsystem, a primary user device, and a secondary user device. The user may select a particular payment card to provision onto the secondary user device by providing an input at the primary user device. A broker module running on the service provider subsystem may then transfer a disabled pass to the secondary user device. Concurrently, the payment network subsystem may direct a trusted service manager module on the service provider subsystem to write credential information onto a secure element within the secondary user device. Once the secure element has been updated, the broker module may provide an activated pass to the secondary user device so that the secondary user device can be used to perform NFC-based financial transactions at a merchant terminal.

Claims

1. A method for using a service provider subsystem to provision a payment card onto a secondary device via a primary device, comprising:

at the service provider subsystem, receiving information associated with the secondary device from the primary device; and

at the service provider subsystem, sending a digital wallet pass corresponding to the payment card to the secondary device through the primary device.

2. The method defined in claim 1, wherein the secondary device includes a secure element, and wherein receiving the information associated with the secondary device comprises receiving information reflective of a current state of the secure element in the secondary device.

3. The method defined in claim 1, wherein the secondary device includes a secure element having a unique secure element identifier (ID), and wherein receiving the information associated with the secondary device comprises receiving the secure element ID and receiving a push token associated with only that particular secondary device and, the method further comprising:

pairing the secure element ID with the push token using a broker module at the service provider subsystem, wherein sending the digital wallet pass to the secondary device comprises sending the digital wallet pass to the secondary device using the broker module.

4. The method defined in claim 3, further comprising:

with the broker module, providing the primary device with a list of payment cards from which a user is given an opportunity to select a payment card; and

in response to receiving user input from the primary device, forwarding the user input to a payment network subsystem to determine whether the user is valid.

5. The method defined in claim 4, wherein sending the digital wallet pass to the secondary device comprises sending a disabled digital wallet pass to the secondary device, and wherein the disabled digital wallet pass is visible to the user at the secondary device but cannot be selected for payment at a merchant terminal.

6. The method defined in claim 3, further comprising:

with a trusted service manager module at the service provider subsystem, receiving the push token from the broker module.

7. The method defined in claim 6, further comprising:

with the trusted service manager module, receiving a secure element personalization script from a payment network subsystem; and

in response to received the secure element personalization script from the payment network subsystem, sending a trusted service manager push notification to the secondary device using the push token received from the broker module.

8. The method defined in claim 7, further comprising:

sending commands from the trusted service manager module to the secondary device, wherein the commands serve to instantiate a payment applet running on the secure element.

9. The method defined in claim 8, further comprising:

with the trusted service manager module, sending a state update notification to the broker module after the commands have been executed; and

in response to receiving the state update notification from the trusted service manager module, using the broker module to send a broker push notification to the secondary device.

10. The method defined in claim 9, further comprising:

with the broker module, receiving a fetch pass request from the primary device; and

in response to receiving the fetch pass request from the primary device, using the broker module to send an activated digital wallet pass to the secondary device, wherein the activated digital wallet pass can be selected for payment at a merchant terminal.

11. The method defined in claim 1, wherein sending the digital wallet pass to the secondary device comprises sending a pass that includes a payment applet identifier that identifies a particular slot on the secure element that a new payment applet corresponding to the payment card is to be installed.

12. A method for operating a first user device to provision a commerce credential onto a second user device, comprising:

providing a user with an opportunity to select a payment card to provision onto the second user device;

receiving the commerce credential from a service provider subsystem; and

forwarding the received commerce credential to the second user device.

13. The method defined in claim 12, wherein receiving the commerce credential comprises receiving a virtual credential that is linked to an actual credential of the payment card selected by the user via a linking table stored on a payment network subsystem, and wherein the virtual credential is only stored on a secure element within the second user device.

14. The method defined in claim 12, further comprising:

providing the user with an opportunity to enter security information associated with the selected payment card.

15. The method defined in claim 12, wherein the second user device includes a secure element, the method further comprising:

receiving information from the second user device that is reflective of a current state of the secure element.

16. The method defined in claim 15, further comprising:

receiving a push notification from a trusted service manager at the service provider subsystem; and

in response to receiving the push notification from trusted service manager, forwarding commands to the second user device that update the current state of the secure element.

17. The method defined in claim 13, further comprising:

receiving a passbook pass from a broker at the service provider subsystem, wherein the passbook pass includes a virtual credential identifier that is associated with the virtual credential stored on the secure element.

18. A system, comprising:

a primary device; and

a secondary device that includes a secure element, wherein the primary device is used to provision commerce credentials onto the secure element of the secondary user device so that the secondary device is operable at a merchant terminal to conduct mobile financial transactions.

19. The system defined in claim 18, further comprising:

a service provider subsystem configured to communicate with the secondary device only through the primary device when provisioning the commerce credentials onto the secondary device.

20. The system defined in claim 19, further comprising:

with a broker module at the service provider subsystem, sending a digital wallet pass to the secondary device via the primary device.

21. The system defined in claim 20, further comprising:

with a trusted service manager at the service provider subsystem, sending commands to the secondary device through the primary device to update the secure element on the secondary device.

22. The system defined in claim 21, wherein the primary device is configured to receive a selected payment card to provision onto the secondary user device and to receive security information associated with the selected payment card, and wherein the digital wallet pass that is sent from the broker module to the secondary device comprises a pass that corresponds to the selected payment card.

23. The system defined in claim 22, further comprising:

a payment network subsystem that receives the security information entered at the primary user device and that sends a personalization script to the trusted service manager to initiate the sending of the commands.

24. The system defined in claim 18, wherein the primary device comprises a cellular telephone, and wherein the secondary user device comprises a wrist-watch device.