Apparatus and methods for secure element transactions and management of assets
Methods and apparatus for the deployment of financial instruments and other assets are disclosed. In one embodiment, a security software protocol is disclosed that guarantees that the asset is always securely encrypted, that one and only one copy of an asset exists, and the asset is delivered to an authenticated and/or authorized customer. Additionally, exemplary embodiments of provisioning systems are disclosed that are capable of, among other things, handling large bursts of traffic (such as can occur on a so-called “launch day” of a device).
1. A client device configured to request a financial asset from a remote server, the client device comprising:
an application processor;
a storage device configured to store instructions that, when executed by the application processor, cause the client device to:
transmit, to the remote server, a request to provision the financial asset to an account,
transmit, to the remote server, a device identifier that uniquely identifies the client device, wherein the device identifier is used to authenticate the request to provision the financial asset,
obtain a challenge from a secure element of the client device, wherein the challenge is used to associate the financial asset with the secure element, and
transmit the challenge to the remote server; and
the secure element comprising:
a secure processor; and
a secure memory configured to store instructions that, when executed by the secure processor, cause the secure element to:
perform a session handshake with the remote server,
generate the challenge after performing the session handshake with the remote server,
receive, from the remote server, the financial asset that is assigned to the client device, wherein the financial asset received from the remote server includes challenge data based on the challenge transmitted to the remote server, and
verify the financial asset received from the remote server based on the challenge data.
2. The client device of claim 1 , wherein the secure memory is further configured to store instructions that, when executed by the secure processor, cause the secure element to delete the challenge from the secure element, subsequent to verifying the financial asset.
3. The client device of claim 2 , wherein the secure memory is further configured to store instructions that, when executed by the secure processor, cause the secure element to:
generate a new challenge, and
store the new challenge on the secure element.
4. The client device of claim 1 , wherein the storage device is further configured to store instructions that, when executed by the application processor, cause the client device to:
receive a financial asset identifier from the remote server, wherein the financial asset identifier uniquely identifies the financial asset assigned to the client device, and
communicate, to the remote server, a request for the financial asset that is assigned to the client device and the financial asset identifier associated with the financial asset.
5. The client device of claim 1 , wherein the storage device is further configured to store instructions that, when executed by the application processor, cause the client device to obtain the device identifier from the secure element prior to transmitting the device identifier to the remote server.
6. The client device of claim 1 , wherein the secure memory is further configured to store instructions that, when executed by the secure processor, cause the secure element to:
verify that the financial asset received from the remote server is valid when the challenge data included in the financial asset is determined to be valid.
7. A method for requesting a financial asset from a remote device, the method comprising:
at a client device including a secure element:
transmitting, to the remote device, a request to provision the financial asset to an account associated with the client device,
transmitting, to the remote device, a device identifier that uniquely identifies the client device, wherein the device identifier is used to authenticate the request to provision the financial asset,
transmitting, to the remote device, a challenge obtained from the secure element of the client device, wherein the challenge is used to associate the financial asset with the secure element, and
receiving, from the remote device, the financial asset assigned to the client device, wherein the financial asset includes challenge data based on the challenge transmitted to the remote device, and
wherein the secure element comprises a secure processor and a secure memory, and the secure element is configured to:
perform, using the secure processor, a session handshake with the remote device,
generate, using the secure processor, the challenge after performing the session handshake with the remote device, and
verify the financial asset received from the remote device based on the challenge data.
8. The method of claim 7 , wherein the secure element is configured to delete the challenge from the secure element subsequent to verifying the financial asset.
9. The method of claim 7 , further comprising:
receiving a financial asset identifier from the remote device, wherein the financial asset identifier uniquely identifies the financial asset assigned to the client device.
10. The method of claim 9 , further comprising:
communicating, to the remote device, a request for the financial asset that is assigned to the client device and the financial asset identifier associated with the financial asset, and
receiving the financial asset from the remote device in response to the request.
11. The method of claim 7 , further comprising:
obtaining the device identifier from the secure element prior to transmitting the device identifier to the remote device.
12. The method of claim 7 , wherein the secure element is further configured to:
verify that the financial asset received from the remote device is valid when the challenge data included in the financial asset is determined to be valid.
13. A secure element included in a client device, the secure element comprising:
a secure processor; and
a secure memory configured to store instructions, that when executed by the secure processor, cause the secure element to:
obtain a device identifier, wherein the device identifier uniquely identifies the client device, and the device identifier is used to authenticate a request to provision a financial asset to the client device,
perform a session handshake with a provisioning device,
generate a challenge after performing the session handshake with the provisioning device, wherein the challenge is used to associate the financial asset with the secure element, and
verify the financial asset received from the provisioning device based on challenge data embedded in the financial asset, wherein the challenge data is based on the challenge generated by the secure element.
14. The secure element of claim 13 , wherein the secure memory is further configured to store instructions that, when executed by the secure processor, cause the secure element to:
verify that the financial asset received from the provisioning device is valid when the challenge data embedded in the financial asset is determined to be valid.
15. The secure element of claim 13 , wherein the secure memory is further configured to store instructions that, when executed by the secure processor, cause the secure element to:
delete the challenge from the secure element subsequent to verifying the financial asset.
16. The client device of claim 1 , wherein the storage device is further configured to store instructions that, when executed by the application processor, cause the client device to:
execute a transaction with a merchant device to charge the account.
17. The method of claim 7 , the method further comprising:
at the client device:
executing a transaction with a merchant device to charge the account.
18. The secure element of claim 13 , wherein the secure memory is further configured to store instructions that, when executed by the secure processor, cause the secure element to:
maintain a listing comprising the financial asset.
19. The client device of claim 1 , further comprising:
a virtual wallet configured to execute transactions with a merchant device.
20. The secure element of claim 13 , wherein the financial asset is a virtual credit card (VCC).