System and method for key management for issuer security domain using global platform specifications

A method comprising:

• sending, from a server to a client, an authorization to update a first Issuer Security Domain encryption keyset;
• receiving, at the server, an encrypted second Issuer Security Domain keyset, generated by a client within a client-side Secure Element;
• and
• updating the first Issuer Security Domain encryption keyset with the encrypted second Issuer Security Domain keyset.

A system comprising:

• a processor;
• a memory storing instructions for controlling the processor to perform a method comprising:
• generating, at a vendor, an Issuer Security Domain encryption keyset;
• sending the Issuer Security Domain encryption keyset and a server public key to a Secure Element at a client, wherein the Secure Element implements at least a portion of Global Platform Card specifications;
• encrypting, at the vendor, the Issuer Security Domain encryption keyset with the server public key to yield an encrypted keyset;
• and
• sending the encrypted keyset to the server.

A non-transitory computer-readable storage medium storing instructions which, when executed by a computing device, cause the computing device to perform steps comprising:

• generating an Issuer Security Domain encryption keyset;
• sending the Issuer Security Domain encryption keyset and a server public key to a Secure Element embedded within a client;
• encrypting the Issuer Security Domain encryption keyset with the server public key to yield an encrypted keyset;
• and
• sending the encrypted keyset to the server.