ISOLATING DISTINCT SERVICE PROVIDER WIDGETS WITHIN A WALLET CONTAINER

• US 20140089185A1
• Filed: 12/04/2013
• Published: 03/27/2014
• Est. Priority Date: 10/06/2005
• Status: Active Grant

• Current Assignee: Mastercard Mobile Transactions Solutions, Inc. (MasterCard Incorporated)
• Original Assignee: C-SAM Incorporated (MasterCard Incorporated)
• Inventors: Desai, Mehul, Pitroda, Satyan G., Maniar, Nehal
• Granted Patent: US 10,032,160 B2
• Time in Patent Office: Days
• US Class Current: 705/41
• CPC Class Codes: G05B 2219/25107 Pluggable card, magnetic or smart with configuration data, staying in device
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 3/08 from or to individual record carriers, e.g. punched card , memory card, integrated circuit [IC] card or smart card
• CPC Class Codes: G06K 7/0065 comprising keyboard or display, e.g. a pocket calculator sized casing suitable for off-line checking the remaining money on a smart banking card
• CPC Class Codes: G06Q 10/067 Enterprise or organisation modelling
• CPC Class Codes: G06Q 20/20 Point-of-sale [POS] network systems
• CPC Class Codes: G06Q 20/202 Interconnection or interaction of plural electronic cash registers [ECR] or to host computer, e.g. network details, transfer of information from host to ECR or from ECR to ECR
• CPC Class Codes: G06Q 20/322 Aspects of commerce using mobile devices [M-devices]
• CPC Class Codes: G06Q 20/3278 RFID or NFC payments by means of M-devices
• CPC Class Codes: G06Q 20/36 using electronic wallets or electronic money safes
• CPC Class Codes: G06Q 20/367 involving electronic purses or money safes
• CPC Class Codes: G06Q 20/3674 involving authentication
• CPC Class Codes: G06Q 30/06 Buying, selling or leasing transactions
• CPC Class Codes: G06Q 40/02 Banking, e.g. interest calculation or account maintenance credit or loans G06Q40/03

Abstract

Isolating distinct service provider widgets within a wallet container is accomplished by configuring a widget to provide access to an issuer-specific service group of services that are accessible in a service tier of a multi-tier platform for providing secure transactions, determining widget isolation requirements for operating the widget, configuring a widget descriptor with the isolation requirements, and communicating with the configured widget that has been deployed on a mobile device to provide at least one service from the issuer-specific service group.

Claims

1. An apparatus, comprising:

a plurality of widget modules accessible in a memory of a mobile device, wherein each widget module is associated with a service provider; and

a wallet container that is accessible in the memory, the wallet container operable on the mobile device to;

isolate a plurality of distinct electronic wallets that are accessible in the memory;

facilitate access to the plurality of distinct electronic wallets through the plurality of widget modules by authenticating a widget module to access a distinct electronic wallet based on wallet access rights of the service provider associated with the widget module; and

securely isolate access to mobile device resources that is allowed for each widget module.

2. The apparatus of claim 1, wherein the wallet container operates in cooperation with an enabling tier of a multi-tier platform for providing secure personalized transactions comprising at least enabling, service, and personalization tiers so that widget isolation from device resources is effected by the enabling tier.

3. The apparatus of claim 2, wherein the enabling tier abstracts device resources from widget execution to facilitate securely controlling widget access within the mobile device.

4. The apparatus of claim 2, wherein the enabling tier facilitates isolating first widget accessible device resources from a second widget.

5. The apparatus of claim 2, wherein access to a first widget accessible service in a group of services accessible in the service tier is isolated from access by a second widget by the enabling tier.

6. The apparatus of claim 2, wherein the enabling tier facilitates isolating a first widget accessible service in a group of services accessible in the service tier from a second widget.

7. The apparatus of claim 1, wherein wallet access rights of the service provider are determined from a widget access context object associated with a specific widget that is used by the wallet container to manage widget access, wherein the widget access context object is a runtime accessible data structure that is populated with information derived from a widget access record.

8. The apparatus of claim 1, wherein the wallet container comprises a runtime environment adapted to facilitate isolated execution of a plurality of separate widget modules and the plurality of distinct electronic wallets.

9. The apparatus of claim 8, wherein the runtime environment facilitates widget and wallet execution by interpreting the plurality of separate widget modules and the plurality of distinct electronic wallets.

10. The apparatus of claim 1, wherein the wallet container facilitates limiting access of service provider-specific workflows to widget modules associated with the service provider.

11. The apparatus of claim 1, wherein widget access to resources is controlled by service provider-specific security domain applets that are accessible in a memory of the mobile device, and the wallet container limits widget use of security domain applets to a security domain applet of the service provider associated with the widget.

12. The apparatus of claim 1, wherein widget mobile device resource access rights are determined from a widget descriptor associated with a specific widget.

13. The apparatus of claim 12, wherein a widget descriptor comprises a data structure that is signed by a service provider associated with the widget.

14. The apparatus of claim 1, wherein widget access rights to electronic wallets are determined from a widget access record that is referenced to authenticate a widget.

15. The apparatus of claim 14, wherein a widget access record is accessible in a secure element of a mobile device.

16. The apparatus of claim 13, wherein the widget access rights determined from a widget access record are used to populate a widget access context object that is used by the wallet container to manage widget access to actions, the mobile device display screen, external network resources, and secure element resources.

17. The apparatus of claim 1, wherein cooperation of two or more widgets that is required to perform certain secure transactions is coordinated by the wallet container.

18. The apparatus of claim 1, wherein a widget comprises executable code and data that is used to facilitate performing a secure transaction between an electronic wallet, to which the widget is authenticated for access, and a service provider, with which the widget is associated, over a network connection provided by the mobile device.

19. A method comprising:

configuring a widget, at least partially, by a networked server to provide access to an issuer-specific service group of services accessible in a service tier of a multi-tier platform for providing secure transactions, the platform comprising at least enabling, service, and personalization tiers;