Secure sharing of credential information
AssigneeApple Inc.
InventorsMorgan J. Grainger, Russell Fenenga, Brandon K. Leventhal, Sourabh Dugar
Life of this patent
Estimating the term…
Abstract
A first user device may be used to request provisioning of a secure credential on a second user device. A provisioning system may facilitate the provisioning in a manner that ensures security and privacy of the requesting parties. The provisioning requests may be made using an application on the first user device such as a third-party application or using a web application via a browser. The credential may be added to a digital wallet on the second user device. The credential may be useable by the second user device to perform one or more contactless transactions.
Claims18
One or more computer-readable media comprising computer-executable instructions that, when executed by one or more processors, cause the one or more processors to perform operations comprising:
- responsive to a first request from a first user device, providing a nonce and a provisioning certificate to the first user device, the nonce and the provisioning certificate relating to a provisioning request initiated by the first user device for provisioning a credential for use on a second user device, wherein the nonce and the provisioning certificate are configured to enable the first user device to generate a provisioning target package and use the nonce to encrypt the provisioning target package to define an encrypted provisioning target package;
- receiving the encrypted provisioning target package from the first user device, the encrypted provisioning target package comprising the nonce and provisioning information for provisioning the credential for use on the second user device;
- extracting at least a portion of the provisioning information from the encrypted provisioning target package;
- and
- provisioning the credential for use on the second user device based at least in part on the portion of the provisioning information.
A system, comprising:
- a memory comprising computer-executable instructions;
- and
- a processor configured to access the memory and execute the computer-executable instructions to at least:
- receive an indication that a user account has successfully logged into a web application associated with a provisioning system;
- receive an encrypted provisioning target package from an external computer system, the encrypted provisioning target package comprising provisioning information for provisioning a credential for use on a user device associated with the user account, wherein the encrypted provisioning target package is generated based at least in part on information from the web application obtained when the user account successfully logged into the web application;
- determine a list of user devices capable of receiving the credential based at least in part on the provisioning information, individual user devices of the list of user devices being associated with the user account;
- receive a selection of a particular user device from the list of user devices;
- and
- provision the credential for use on the particular user device based at least in part on the provisioning information.
A computer-implemented method, comprising:
- providing a nonce and a provisioning certificate to a first user device, wherein the first user device is configured to generate a provisioning target package and use the nonce to encrypt the provisioning target package;
- receiving, via a messaging system and from the first user device, a request to provision a credential for use on a second user device, the request comprising the provisioning target package that comprises provisioning information;
- validating, using the messaging system, a user account associated with the second user device based at least in part on the provisioning information in the provisioning target package;
- storing, using a cloud storage and compute system, the provisioning target package in a remote storage location associated with the user account;
- validating, using a provisioning system, credential information associated with the credential based at least in part on the provisioning information in the provisioning target package;
- and
- provisioning the credential for use on the second user device based at least in part on validating the credential information.
Dependencies are inferred from the claim text.