Systems, methods, and computer program products for securely managing data on a secure element

• US 9,608,979 B2
• Filed: 03/25/2016
• Issued: 03/28/2017
• Est. Priority Date: 09/30/2013
• Status: Active Grant

• Current Assignee: Google LLC (Alphabet Inc.)
• Original Assignee: Google Inc. (Alphabet Inc.)
• Inventors: Watson, Curtis W.
• Primary Examiner(s): Chai, Longbit
• Application Number:
  US15/081,819
• Publication Number:
  US 20160212117A1
• Time in Patent Office: 368 Days
• Field of Search: 726/26
• US Class Current: 1/1
• CPC Class Codes: G06F 21/35 communicating wirelessly
• CPC Class Codes: G06F 21/60 Protecting data
• CPC Class Codes: G06Q 20/3226 Use of secure elements separate from M-devices
• CPC Class Codes: G06Q 20/3229 Use of the SIM of a M-device as secure element
• CPC Class Codes: G06Q 20/3278 RFID or NFC payments by means of M-devices
• CPC Class Codes: G06Q 20/3563 Software being resident on card
• CPC Class Codes: G06Q 20/36 using electronic wallets or electronic money safes
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04W 12/00 Security arrangements; Authentication; Protecting privacy or anonymity
• CPC Class Codes: H04W 12/35 Protecting application or service provisioning, e.g. securing SIM application provisioning
• CPC Class Codes: H04W 12/37 Managing security policies for mobile devices or for controlling mobile applications

Abstract

Systems, methods, and computer program products are provided for managing applets. A first request to personalize the first applet is received over a communications network. A second request including a command requesting at least a portion of the second applet data is communicated to the second applet. At least a portion of the second applet data is communicated to the first applet. One or more values of the first applet data are replaced with one or more values of at least the portion of the second applet data.

Claims

1. A system to manage applets of mobile wallet applications, comprising:

at least one memory operable to store a first applet including first applet data and a second applet including particular applet data; and

a hardware processor coupled to the at least one memory, the processor executing application code instructions to;

transmit, by the first applet to the second applet, the particular applet data;

store, by the second applet, the particular applet data;

delete the first applet;

receive, over a communications network, a new first applet;

receive, over the communications network, a first request to personalize the new first applet, wherein the new first applet comprises new first applet data;

communicate, in response to receiving the request to personalize the new first applet, a second request to the second applet, the second request including a command requesting at least a portion of the previously stored particular applet data;

communicate at least the portion of the particular applet data to the new first applet upon the second applet being authenticated to the new first applet; and

replace one or more values of the new first applet data of the new first applet with one or more values of at least a portion of the particular applet data of the second applet.

2. The system of claim 1, wherein the first applet data and the particular applet data each comprise cryptographic parameters including at least one of:

(1) a passcode, and (2) a mobile wallet client unique code.

3. The system of claim 2, wherein the new first applet is a set of instructions stored on the at least one memory, which when executed by the processor, cause the processor to manage the new first applet data.

4. The system of claim 2, wherein the second applet is a set of instructions stored on the at least one memory, which when executed by the processor, cause the processor to manage the particular applet data.

5. The system of claim 1, wherein the system is included in a secure element associated with a mobile device.

6. The system of claim 1, wherein the processor is further operable to:

communicate a notification to the first applet including information indicating that the particular applet data is incomplete;

determine incomplete data of the particular applet data;

communicate, from the first applet to the second applet, third applet data corresponding to the incomplete data of the particular applet data; and

replace values of the particular applet data with values of the third applet data.

7. The system of claim 1, wherein the first applet data and the particular applet data are exclusively stored and managed by the first applet and the second applet, respectively.

8. The system of claim 1, wherein the particular applet data comprises critical data.

9. The system of claim 1, wherein the particular applet data comprises one or more of personal data, security keys, passcodes, credentials, and identifiers.

10. A computer-implemented method to manage applets of mobile wallet applications, comprising:

transmitting, by a first applet and to a second applet, particular applet data;

storing, by the second applet, the particular applet data;

deleting the first applet;

receiving, over a communications network, a new first applet;

receiving, over the communications network, a first request to personalize the new first applet, wherein the new first applet includes new first applet data;

communicating, in response to receiving the request to personalize the new first applet, a second request to the second applet, the second request including a command requesting at least a portion of particular applet data;

communicating at least the portion of the particular applet data to the new first applet upon the second applet being authenticated to the new first applet; and

replacing one or more values of the new first applet data of the new first applet with one or more values of at least the portion of the particular applet data of the second applet.

11. The method of claim 10, wherein the new first applet data and the particular applet data each comprise cryptographic parameters including at least one of:

(1) a passcode, and (2) a mobile wallet client unique code.

12. The method of claim 11, wherein the new first applet is a set of instructions stored on the at least one memory, which when executed by a processor, cause the processor to manage the new first applet data.

13. The method of claim 11, wherein the second applet is a set of instructions stored on the at least one memory, which when executed by the processor, cause the processor to manage the particular applet data.

14. The method of claim 10, wherein the first applet and the second applet are stored in a secure element associated with a mobile device.

15. The method of claim 10, further comprising the steps of:

communicating a notification to the first applet including information indicating that the particular applet data is incomplete;

determining incomplete data of the particular applet data;

communicating, from the first applet to the second applet, third applet data corresponding to the incomplete data of the particular applet data; and

replacing values of the particular applet data with values of the third applet data.

16. The method of claim 10, wherein the new first applet data and the particular applet data are exclusively stored and managed by the new first applet and the second applet, respectively.

17. A non-transitory computer-readable medium having stored thereon sequences of instructions for managing applets of mobile wallet applications that, when executed by a computer hardware processor, cause the processor to:

transmit, by a first applet and to a second applet, particular applet data;

store, by the second applet, the particular applet data;

delete the first applet;

receive, over a communications network, a new first applet;

receive, over a communications network, a first request to personalize the new first applet, wherein the new first applet includes new first applet data;

communicate, in response to receiving the request to personalize the new first applet, a second request to a second applet, the second request including a command requesting at least a portion of particular applet data;

communicate at least a portion of the critical applet data to the new first applet upon the second applet being authenticated by the new first applet; and

replace one or more values of the new first applet data of the new first applet with one or more values of the at least a portion of the particular applet data of the second applet.

18. The non-transitory computer-readable medium of claim 17, wherein the new first applet data and the particular applet data each comprise cryptographic parameters including at least one of:

(1) a passcode, and (2) a mobile wallet client unique code.

19. The non-transitory computer-readable medium of claim 18, wherein the new first applet is a set of instructions stored on a memory, which when executed by the computer processor, cause the computer processor to manage the new first applet data.

20. The non-transitory computer-readable medium of claim 18, wherein the second applet is a set of instructions stored on a memory, which when executed by the computer processor, cause the computer processor to manage the particular applet data.

21. The non-transitory computer-readable medium of claim 17, wherein the first applet and the second applet are included in a secure element associated with a mobile device.

22. The non-transitory computer-readable medium of claim 17, wherein the sequences of instructions, when executed by the computer processor, further cause the processor to:

communicate a notification to the first applet including information indicating that the particular applet data is incomplete;

determine incomplete data of the particular applet data;

communicate, from the first applet to the second applet, third applet data corresponding to the incomplete data of the particular applet data; and

replace values of the particular applet data with values of the third applet data.

23. The non-transitory computer-readable medium of claim 17, wherein the new first applet data and the particular applet data are exclusively stored and managed by the new first applet and second applet, respectively.