# US 2022/0044237 A1 · Systems and methods for initialization and activation of secure elements > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2022/0044237 A1 - Document ID: US20220044237A1 - Status: Published application - Kind: A1 - Application number: 17/510,355 - Filed: 2021-10-25 - Published: 2022-02-10 - Earliest claimed: 2016-07-18 - Assignees: Dream Payments Corp. - Applicants: Dream Payments Corp. - Inventors: Long VAN; Sergey NEKIPELYY - Web page: https://patentgrep.com/patent/US20220044237A1 ## CPC - G06Q 20/3829: {involving key management} - G06Q 20/3552: {Downloading or loading of personalisation data} - G07F 7/0873: {Details of the card reader} - H04L 9/14: using a plurality of keys or algorithms - H04L 9/3234: {involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token (network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853)} - H04L 9/3263: {involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823)} - H04L 9/3265: {using certificate chains, trees or paths; Hierarchical trust model} - H04W 12/04: Key management, e.g. using generic bootstrapping architecture [GBA] - H04W 12/33: using wearable devices, e.g. using a smartwatch or smart-glasses - H04W 12/35: {Protecting application or service provisioning, e.g. securing SIM application provisioning} - H04L 9/08: Key distribution {or management, e.g. generation, sharing or updating, of cryptographic keys or passwords (network architectures or network communication protocols for supporting key management in a packet data network H04L63/06)} - H04L 9/3213: {using tickets or tokens, e.g. Kerberos (network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807)} - H04L 63/06: {for supporting key management in a packet data network (cryptographic mechanisms or cryptographic arrangements for key management H04L9/08)} - H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)} - H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)} - H04L 63/0869: {for achieving mutual authentication (cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273)} - H04W 4/70: Services for machine-to-machine communication [M2M] or machine type communication [MTC] - H04W 12/06: Authentication - G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR - G07F: COIN-FREED OR LIKE APPARATUS (coin sorting G07D3/00; coin testing G07D5/00; {handling coins or paper currencies apart from payment activated apparatus G07D; payment architectures, schemes or protocols G06Q20/00}) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Disclosed herein are secure transaction systems having secure elements that are initialized and activated independent from each other. The secure element is first initialized to make the secure element turn to a state in which the secure element can be packaged, sold within retail stores, and then injected with encryption keys. The initialization process of the secure element formulates the secure element to ensure trust between the secure elements and secure element activation servers. The process of independently initializing and activating the secure elements while still addressing the security protocols allows the secure element to be packaged and sold within retail stores after initialization, and then activating the secure element at a later date and time when the secure element is ready to be used by a merchant. ## Claims ### Claim 1 A method for initialization and activation of a secure element for use in a terminal device, the method comprising: transmitting, by at least one at least one service provider server, a service provider certificate, a set of encryption keys, and one or more attributes associated with the secure element to a processor of the secure element; receiving, by the at least one service provider server, an activation request from the secure element, the set of encryption keys, and the one or more attributes associated with the secure element; authenticating, by the at least one service provider server, an identity of the secure element by: extracting a public key from the secure element, the public key corresponding to the service provider certificate and the set of encryption keys, and determining whether the extracted public key corresponds to the service provider certificate; generating, by the at least one service provider server, a session with the secure element based on mutual authentication with the secure element using at least the service provider certificate; and in response to the processor of the secure element validating an activation certificate, loading, by the at least one service provider server, a master key and a working key into a memory of the secure element. ### Claim 2 (depends on 1) The method of claim 1, further comprising: generating, by the processor of the secure element, a public key corresponding to the service provider certificate and the set of encryption keys; ### Claim 3 (depends on 1) The method of claim 1, further comprising: validating, by the processor of the secure element, the activation certificate by determining that the activation certificate is associated with a certification authority server. ### Claim 4 (depends on 1) The method of claim 1, wherein the service provider server transmits the activation certificate to the secure element. ### Claim 5 (depends on 1) The method of claim 1, further comprising: determining, by the at least one service provider server, whether a firmware of a censor of the secure element stored in the memory of the secure element needs to be updates upon establishing a communication with the secure element. ### Claim 6 (depends on 1) The method of claim 1, wherein the one or more attributes associated with the secure element comprises a manufacture ID of a vendor of the secure element, whereby the at least one service provider server uses the one or more attributes to authenticate the secure element by comparing the manufacture ID of the vendor of the secure element with a manufacture ID of the vendor of the secure element stored within a database. ### Claim 7 (depends on 1) The method of claim 1, further comprising uploading, by the at least one service provider server, a firmware of a vendor of the secure element into the memory of the secure element. ### Claim 8 (depends on 1) The method of claim 1, wherein the activation certificate comprises a subject field with a one or more parameters associated with a service provider server, whereby the processor of the secure element validates the activation certificate by determining whether the subject field comprises a domain address associated with a certification authority server. ### Claim 9 (depends on 1) The method of claim 1, wherein the secure element is a printed circuit board of the terminal device, wherein the terminal device is selected from a group consisting of a card reader, a mobile phone, a vending machine, a wearable device, or an internet of things (IOT) device. ### Claim 10 (depends on 1) The method of claim 1, wherein the secure element is detachably connected to the terminal device. ### Claim 11 A system comprising a server comprising a processor and a non-transitory computer-readable medium containing instructions that when executed by the processor causes the processor to perform operations comprising: transmitting a service provider certificate, a set of encryption keys, and one or more attributes associated with the secure element to a processor of the secure element; receiving an activation request from the secure element, the set of encryption keys, and the one or more attributes associated with the secure element; authenticating an identity of the secure element by: extracting a public key from the secure element, the public key corresponding to the service provider certificate and the set of encryption keys, and determining whether the extracted public key corresponds to the service provider certificate; generating a session with the secure element based on mutual authentication with the secure element using at least the service provider certificate; and in response to the processor of the secure element validating an activation certificate, loading a master key and a working key into a memory of the secure element. ### Claim 12 (depends on 11) The system of claim 11, further comprising: generating, by the processor of the secure element, a public key corresponding to the service provider certificate and the set of encryption keys; ### Claim 13 (depends on 11) The system of claim 11, further comprising: validating, by the processor of the secure element, the activation certificate by determining that the activation certificate is associated with a certification authority server. ### Claim 14 (depends on 11) The system of claim 11, wherein the service provider server transmits the activation certificate to the secure element. ### Claim 15 (depends on 11) The system of claim 11, further comprising: determining, by the at least one service provider server, whether a firmware of a censor of the secure element stored in the memory of the secure element needs to be updates upon establishing a communication with the secure element. ### Claim 16 (depends on 11) The system of claim 11, wherein the one or more attributes associated with the secure element comprises a manufacture ID of a vendor of the secure element, whereby the at least one service provider server uses the one or more attributes to authenticate the secure element by comparing the manufacture ID of the vendor of the secure element with a manufacture ID of the vendor of the secure element stored within a database. ### Claim 17 (depends on 11) The system of claim 11, further comprising uploading, by the at least one service provider server, a firmware of a vendor of the secure element into the memory of the secure element. ### Claim 18 (depends on 11) The system of claim 11, wherein the activation certificate comprises a subject field with a one or more parameters associated with a service provider server, whereby the processor of the secure element validates the activation certificate by determining whether the subject field comprises a domain address associated with a certification authority server. ### Claim 19 (depends on 11) The system of claim 11, wherein the secure element is a printed circuit board of the terminal device, wherein the terminal device is selected from a group consisting of a card reader, a mobile phone, a vending machine, a wearable device, or an internet of things (IOT) device. ### Claim 20 (depends on 11) The system of claim 11, wherein the secure element is detachably connected to the terminal device.