Device provisioning using partial personalization scripts

Patent metadata

Field	Value
Publication number	US-9760886-B2
Application number	US-201414275404-A
Country	US
Kind code	B2
Filing date	May 12, 2014
Priority date	May 10, 2013
Publication date	Sep 12, 2017
Grant date	Sep 12, 2017

Abstract

Embodiments of the invention relate to systems and methods for efficiently provisioning mobile devices with personalization data. For some embodiments, a method is disclosed comprising receiving a request for provisioning comprising device information for a mobile device and user authentication information for a user, generating a partial personalization script, an activation script, and a deletion script using the device information, sending the partial personalization script, the activation script, and the deletion script to an application provider computer, wherein the application provider computer initiates execution of the partial personalization script on the mobile device, authenticating the user authentication information, and sending an activation message to the application provider computer, wherein the application provider computer initiates execution of the activation script.

First claim

What is claimed is:

1. A service provider computer comprising:
a processor; and
a non-transitory computer-readable medium comprising code executable by the processor for implementing a method comprising:
receiving a request for provisioning comprising device information for a mobile device and user authentication information for a user;
generating a partial personalization script, an activation script, and a deletion script using the device information;
sending the partial personalization script, the activation script, and the deletion script to an application provider computer, wherein the application provider computer initiates execution of the partial personalization script on the mobile device, and execution of the partial personalization script stores personalization data including payment data onto the mobile device in a secured form, and wherein the application provider computer is a wallet provider computer and is different from the mobile device;
authenticating the user using the user authentication information, wherein authenticating the user and executing the partial personalization script are performed in parallel;
in response to a successful authentication of the user and a successful execution of the partial personalization script, sending an activation message to the application provider computer which causes the application provider computer to initiate execution of the activation script, wherein execution of the activation script enables the mobile device with access to the personalization data and provisions the personalization data onto the mobile device prior to initiating a transaction using the personalization data; and
in response to an unsuccessful authentication of the user or an unsuccessful execution of the partial personalization script, sending a deletion message to the application provider computer which causes the application provider computer to initiate execution of the deletion script to delete the personalization data from the mobile device.

2. The service provider computer of claim 1 , wherein generating the partial personalization script comprises:
retrieving a personalization master key;
generating a personalization session key using the device information and the personalization master key;
generating store data commands comprising the personalization data; and
encrypting the store data commands using the personalization session key.

3. The service provider computer of claim 2 , further comprising:
determining that the personalization session key is expired;
establishing a new session associated with a new personalization session key;
generating a new activation script using the new personalization session key; and sending the new activation script.

4. The service provider computer of claim 1 , wherein the device information comprises a device cryptogram, and wherein authenticating the user comprises:
retrieving a personalization master key;
generating a personalization session key using the device information and the personalization master key; and
validating the device cryptogram using the personalization session key.

5. The service provider computer of claim 1 , wherein the user authentication information comprises a primary account number (PAN), wherein the personalization data comprises a payment token, and wherein the method further comprises sending the PAN and the payment token to an issuer upon execution of the activation script.

6. A computer-implemented method comprising:
receiving, by a processor, a request for provisioning comprising device information for a mobile device and user authentication information for a user;
generating, by the processor, a partial personalization script, an activation script, and a deletion script using the device information;
sending, by the processor, the partial personalization script, the activation script, and the deletion script to an application provider computer, wherein the application provider computer initiates execution of the partial personalization script on the mobile device, and execution of the partial personalization script stores personalization data including payment data onto the mobile device in a secured form, and wherein the application provider computer is a wallet provider computer and is different from the mobile device;
authenticating, by the processor, the user using the user authentication information, wherein authenticating the user and executing the partial personalization script are performed in parallel;
in response to a successful authentication of the user and a successful execution of the partial personalization script, sending, by the processor, an activation message to the application provider computer which causes the application provider computer to initiate execution of the activation script, wherein execution of the activation script enables the mobile device with access to the personalization data and provisions the personalization data onto the mobile device prior to initiating a transaction using the personalization data; and
in response to an unsuccessful authentication of the user or an unsuccessful execution of the partial personalization script, sending, by the processor, a deletion message to the application provider computer which causes the application provider computer to initiate execution of the deletion script to delete the personalization data from the mobile device.

7. The method of claim 6 , wherein generating the partial personalization script comprises:
retrieving, by the processor, a personalization master key;
generating, by the processor, a personalization session key using the device information and the personalization master key;
generating, by the processor, store data commands comprising the personalization data; and
encrypting, by the processor, the store data commands using the personalization session key.

8. The method of claim 7 , further comprising:
determining, by the processor, that the personalization session key is expired;
establishing, by the processor, a new session associated with a new personalization session key;
generating, by the processor, a new activation script using the new personalization session key; and sending, by the processor, the new activation script.

9. The method of claim 6 , wherein the device information comprises a device cryptogram, and wherein authenticating the user comprises:
retrieving, by the processor, a personalization master key;
generating, by the processor, a personalization session key using the device information and the personalization master key; and
validating, by the processor, the device cryptogram using the personalization session key.

10. The method of claim 6 , wherein the user authentication information comprises a primary account number (PAN), wherein the personalization data comprises a payment token, and wherein the method further comprises sending , by the processor, the PAN and the payment token to an issuer upon execution of the activation script.

11. An application provider computer comprising:
a processor; and
a non-transitory computer-readable medium comprising code executable by the processor for implementing a method comprising:
sending a request for provisioning comprising device information for a mobile device and user authentication information for a user, wherein the user is authenticated using the user authentication information;
receiving a partial personalization script, an activation script, and a deletion script based on the request for provisioning;
initiating execution of the partial personalization script on the mobile device, wherein execution of the partial personalization script stores personalization data including paym

Assignees

• Visa Int Service Ass

Inventors

• Wong Erick
• Makhotin Oleg

Classifications

• G06Q20/38215

  Use of certificates or encrypted proofs of transaction rights · CPC title

• G06Q20/3278

  RFID or NFC payments by means of M-devices · CPC title

• G06Q20/363 Primary

  with the personal data of a user · CPC title

• G06Q20/354

  Card activation or deactivation · CPC title

• G06Q20/3552

  Downloading or loading of personalisation data · CPC title