Isolating distinct service provider widgets within a wallet container

1. An apparatus, comprising:

a plurality of widget modules accessible in a memory of a mobile device, wherein each widget module is associated with a service provider; and

a wallet container that is accessible in the memory, the wallet container operable on the mobile device to:

isolate a plurality of distinct electronic wallets that are accessible in the memory;

control access to the plurality of distinct electronic wallets through the plurality of widget modules by authenticating a widget module to access a distinct electronic wallet based on wallet access rights of the service provider associated with the widget module;

determine wallet access rights of the service provider by processing a widget access context object associated with a specific widget that is used by the wallet container to manage widget access, wherein the widget access context object is a runtime accessible data structure that is populated with information derived from a widget access record;

securely isolate access to mobile device resources that is allowed for each widget module via limiting access to at least one application programming interface;

control widget access to resources with service provider-specific security domain applets that are accessible in a memory of the mobile device;

limit, with the wallet container widget use of security domain applets to a security domain applet of the service provider associated with the widget; and

store at least one widget module of the plurality of widget modules associated with a service provider in a particular non-volatile service provider-specific security domain memory of a plurality of non-volatile service provider-specific security domain memories of a secure element of the mobile device, the particular security domain memory comprising the at least one widget module and the service provider-specific security domain applet; and

access the security domain and all applets disposed therein as a group using unique, security domain-specific security keys when accessing the secure element.

2. The apparatus of claim 1 , wherein the wallet container operates in cooperation with an enabling tier of a multi-tier platform for providing secure personalized transactions comprising at least enabling, service, and personalization tiers so that widget isolation from device resources is effected by the enabling tier.

3. The apparatus of claim 2 , wherein the enabling tier abstracts device resources from widget execution to facilitate securely controlling widget access within the mobile device.

4. The apparatus of claim 2 , wherein the enabling tier facilitates isolating first widget accessible device resources from a second widget.

5. The apparatus of claim 2 , wherein access to a first widget accessible service in a group of services accessible in the service tier is isolated from access by a second widget by the enabling tier.

6. The apparatus of claim 2 , wherein the enabling tier facilitates isolating a first widget accessible service in a group of services accessible in the service tier from a second widget.

7. The apparatus of claim 1 , wherein the wallet container comprises a runtime environment adapted to facilitate isolated execution of a plurality of separate widget modules and the plurality of distinct electronic wallets.

8. The apparatus of claim 7 , wherein the runtime environment facilitates widget and wallet execution by interpreting the plurality of separate widget modules and the plurality of distinct electronic wallets.

9. The apparatus of claim 1 , wherein the wallet container facilitates limiting access of service provider-specific workflows to widget modules associated with the service provider.

10. The apparatus of claim 1 , wherein widget mobile device resource access rights are determined from a widget descriptor associated with a specific widget.

11. The apparatus of claim 10 , wherein a widget descriptor comprises a data structure that is signed by a service provider associated with the widget.

12. The apparatus of claim 1 , wherein widget access rights to electronic wallets are determined from a widget access record that is referenced to authenticate a widget.

13. The apparatus of claim 12 , wherein a widget access record is accessible in a secure element of a mobile device.

14. The apparatus of claim 11 , wherein the widget access rights determined from a widget access record are used to populate a widget access context object that is used by the wallet container to manage widget access to actions, the mobile device display screen, external network resources, and secure element resources.

15. The apparatus of claim 1 , wherein cooperation of two or more widgets that is required to perform certain secure transactions is coordinated by the wallet container.

16. The apparatus of claim 1 , wherein a widget comprises executable code and data that is used to facilitate performing a secure transaction between an electronic wallet, to which the widget is authenticated for access, and a service provider, with which the widget is associated, over a network connection provided by the mobile device.