# US 2021/0241268 A1 · Apparatuses and Methods for Using a Primary User Device to Provision Credentials onto a Secondary User Device

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2021/0241268 A1
- Document ID: US20210241268A1
- Status: Published application
- Kind: A1
- Application number: 17/238,805
- Filed: 2021-04-23
- Published: 2021-08-05
- Earliest claimed: 2014-05-29
- Assignees: Apple Inc.
- Applicants: Apple Inc.
- Inventors: Jeremy T. Brown; George R. Dicker; Glen W. Steele; Morgan J. Grainger; Zachary A. Rosen
- Web page: https://patentgrep.com/patent/US20210241268A1

## CPC

- G06Q 20/3821: {Electronic credentials}
- G06Q 20/12: specially adapted for electronic shopping systems
- G06Q 20/20: Point-of-sale [POS] network systems
- G06Q 20/321: {using wearable devices}
- G06Q 20/3227: {using secure elements embedded in M-devices}
- G06Q 20/3278: {RFID or NFC payments by means of M-devices}
- G06Q 20/351: {Virtual cards}
- G06Q 20/354: {Card activation or deactivation}
- G06Q 20/367: {involving electronic purses or money safes}
- G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR

## Abstract

A system for provisioning credentials onto an electronic device is provided. The system may include a payment network subsystem, a service provider subsystem, a primary user device, and a secondary user device. The user may select a particular payment card to provision onto the secondary user device by providing an input at the primary user device. A broker module running on the service provider subsystem may then transfer a disabled pass to the secondary user device. Concurrently, the payment network subsystem may direct a trusted service manager module on the service provider subsystem to write credential information onto a secure element within the secondary user device. Once the secure element has been updated, the broker module may provide an activated pass to the secondary user device so that the secondary user device can be used to perform NFC-based financial transactions at a merchant terminal.

## Claims

### Claim 1

A method for operating a first user device to provision a commerce credential onto a second user device, the method comprising:
receiving information indicating a current state of the second user device and receiving a token that identifies the second user device;
registering the second user device with a service provider subsystem by forwarding the token and the information indicating the current state of the second user device to the service provider subsystem;
sending messages from the service provider subsystem to the second user device using the token;
with the first user device, receiving the commerce credential from the service provider subsystem;
with the first user device, forwarding the received commerce credential to the second user device; and
provisioning the commerce credential onto the second user device at least in part by forming a new payment applet associated with a payment card on the second user device.

### Claim 2 (depends on 1)

The method defined in claim 1, wherein receiving the commerce credential comprises receiving a virtual credential that is linked to an actual credential of the payment card via a linking table, and wherein the virtual credential is stored on a secure element of the second user device.

### Claim 3 (depends on 2)

The method defined in claim 2, further comprising:
forwarding a digital wallet pass from the service provider subsystem to the second user device, the digital wallet pass having a virtual credential identifier that identifies the virtual credential stored on the secure element.

### Claim 4 (depends on 1)

The method defined in claim 1, wherein receiving the commerce credential from the service provider subsystem comprises receiving the commerce credential from the service provider subsystem after providing, at the first user device, an opportunity to select the payment card to provision onto the second user device.

### Claim 5 (depends on 1)

The method defined in claim 1, wherein the second user device includes a secure element, and wherein receiving the information indicating the current state of the second user device comprises receiving information from the second user device indicating a current state of the secure element.

### Claim 6 (depends on 5)

The method defined in claim 5, further comprising:
forwarding a push notification from the service provider subsystem to the second user device; and
in response to the second user device receiving the push notification, forwarding commands to the second user device that update the current state of the secure element.

### Claim 7

A system, comprising:
a primary device; and
a secondary device that includes a secure element, wherein:
the primary device includes control circuitry configured to request state information for one or more applets stored in the secure element and to provision a commerce credential onto the secure element of the secondary device at least in part by providing a digital wallet pass that includes an applet identifier to the secondary device, the applet identifier identifying a container on the secure element in which an applet associated with the commerce credential is to be located,
the state information includes at least information indicative of applets stored in the secure element, and
the secondary device includes control circuitry configured to perform secondary device registration based at least in part on the information indicative of the applets stored in the secure element, and to store the applet associated with the commerce credential in the container on the secure element based at least in part on the applet identifier.

### Claim 8 (depends on 7)

The system defined in claim 7, wherein the control circuitry in the secondary device is configured to only communicate through the primary device when provisioning the commerce credential onto the secondary device.

### Claim 9 (depends on 7)

The system defined in claim 7, wherein the control circuitry in the secondary device is configured to process one or more commands received through the primary device to update the applet in the container identified by the applet identifier, and wherein the control circuitry in the primary device is configured to provision the commerce credential onto the secure element of the secondary device at least in part by providing an activated version of the digital wallet pass after the one or more commands have been processed.

### Claim 10 (depends on 7)

The system defined in claim 7, wherein the control circuitry in the primary device is configured to receive a selected payment card associated with the commerce credential to provision onto the secondary device and to receive security information associated with the selected payment card, and wherein the digital wallet pass received by the secondary device comprises a pass that corresponds to the selected payment card.

### Claim 11 (depends on 7)

The system defined in claim 7, wherein the primary device comprises a cellular telephone, and wherein the secondary device comprises a wrist-watch device.

### Claim 12 (depends on 7)

The system defined in claim 7, wherein the digital wallet pass is disabled for payment.

### Claim 13

A method for provisioning, based on a first user device, a commerce credential onto a second user device, the method comprising:
receiving an identifier that identifies a secure element of the second user device and receiving a push token that identifies the second user device;
with the first user device, registering the second user device to a service provider subsystem by forwarding the identifier and the push token to the service provider subsystem;
based on a pairing between the identifier and the push token, using the push token to send commands to the second user device that update the secure element; and
while updating the secure element, with the first user device, forwarding commerce credential information from the service provider subsystem to the second user device to activate a payment applet associated with the commerce credential for payment.

### Claim 14 (depends on 13)

The method defined in claim 13, wherein forwarding the commerce credential information comprises forwarding a virtual credential that is linked to an actual credential of a payment card via a linking table stored on a payment network subsystem, and wherein the virtual credential is stored on the secure element.

### Claim 15 (depends on 14)

The method defined in claim 14, further comprising:
with the first user device, forwarding, from the service provider subsystem to the second user device, an applet identifier that identifies the payment applet; and
identifying a container on the secure element at which the virtual credential is stored using the applet identifier.

### Claim 16 (depends on 13)

The method defined in claim 13, further comprising:
after registering the second user device to the first user device and before updating the secure element, performing a payment card verification process for a payment card associated with the commerce credential.

### Claim 17 (depends on 16)

The method defined in claim 16, further comprising:
after performing the payment card verification process, forwarding a digital wallet pass from the service provider subsystem to the second user device, the digital wallet pass including metadata for displaying payment card information at the second user device.

### Claim 18 (depends on 17)

The method defined in claim 17, wherein the metadata for display payment card information comprises information for a payment network logo.

### Claim 19 (depends on 17)

The method defined in claim 17, wherein the payment applet associated with the digital wallet pass is not payment-ready, and wherein the payment applet, when activated, is payment-ready.

### Claim 20 (depends on 16)

The method defined in claim 16, wherein performing the payment card verification process comprises, at the first user device, providing an opportunity to enter security information associated with the payment card.