Device provisioning using partial personalization scripts

1. A computer-implemented method comprising:

receiving, by a processor of an application provider computer, from a mobile device, a request for provisioning the mobile device, the request including device information for the mobile device, the device information including a secure element identifier and a session identifier;

sending, by the processor, to a service provider computer, the request for provisioning the mobile device, wherein the service provider computer retrieves a personalization master key associated with the mobile device based on the secure element identifier, generates a personalization session key using a key derivation function, the secure element identifier, the session identifier, and the personalization master key, generates store data commands comprising personalization data, encrypts the store data commands using the personalization session key, generates a partial personalization script using the encrypted store data commands, generates an activation script, encrypts the activation script using the personalization session key, generates a deletion script, and encrypts the deletion script using the personalization session key;

receiving, by the processor, from the service provider computer, the partial personalization script and the activation script and the deletion script; and

initiating, by the processor, execution of the partial personalization script and at least one of the activation script and the deletion script on the mobile device, wherein the mobile device decrypts the store data commands and at least one of the activation script and the deletion script using an encryption key that matches the personalization session key, and wherein the execution of the activation script enables the mobile device with access to the personalization data and provisions the personalization data onto the mobile device.

2. The computer-implemented method of claim 1 , further comprising:

sending, by the processor, to the mobile device, the activation script and the deletion script;

receiving, by the processor, from the service provider computer, an activation message; and

initiating, by the processor, the execution of the activation script on the mobile device, wherein the mobile device decrypts the activation script using the encryption key that matches the personalization session key.

3. The computer-implemented method of claim 1 , further comprising:

sending, by the processor, to the mobile device, the activation script and the deletion script;

receiving, by the processor, from the service provider computer, a deletion message; and

initiating, by the processor, the execution of the deletion script to delete the personalization data from the mobile device, wherein the mobile device decrypts the deletion script using the encryption key that matches the personalization session key.

4. The computer-implemented method of claim 1 , further comprising:

receiving, by the processor, from the service provider computer, an activation message; and

wherein initiating the execution of at least one of the activation script and the deletion script on the mobile device includes:

in response to receiving the activation message, sending, by the processor, to the mobile device, the activation script, wherein the mobile device executes the activation script.

5. The computer-implemented method of claim 1 , further comprising:

receiving, by the processor, from the service provider computer, a deletion message; and

wherein initiating the execution of at least one of the activation script and the deletion script on the mobile device includes:

in response to receiving the deletion message, sending, by the processor, to the mobile device, the deletion script, wherein the mobile device executes the deletion script to delete the personalization data from the mobile device.

6. The computer-implemented method of claim 1 , wherein the service provider computer determines that the personalization session key is expired, establishes a new session associated with a new personalization session key, and generates a new activation script using the new personalization session key, and further comprising:

receiving, by the processor, from the service provider computer, the new activation script.

7. The computer-implemented method of claim 1 , wherein the partial personalization script includes a script operable to store the personalization data on the mobile device in a secured form.

8. The computer-implemented method of claim 1 , wherein the session identifier is a nonce value.

9. The computer-implemented method of claim 1 , wherein the personalization master key is a symmetric encryption key.

10. An application provider computer comprising:

a processor;

a non-transitory computer-readable medium comprising code executable by the processor for implementing operations including:

receiving, from a mobile device, a request for provisioning the mobile device, the request including device information for the mobile device, the device information including a secure element identifier and a session identifier;

sending, to a service provider computer, the request for provisioning the mobile device, wherein the service provider computer retrieves a personalization master key associated with the mobile device based on the secure element identifier, generates a personalization session key using a key derivation function, the secure element identifier, the session identifier, and the personalization master key, generates store data commands comprising personalization data, encrypts the store data commands using the personalization session key, generates a partial personalization script using the encrypted store data commands, generates an activation script, encrypts the activation script using the personalization session key, generates a deletion script, and encrypts the deletion script using the personalization session key;

receiving, from the service provider computer, the partial personalization script and the activation script and the deletion script; and

initiating execution of the partial personalization script and at least one of the activation script and the deletion script on the mobile device, wherein the mobile device decrypts the store data commands and at least one of the activation script and the deletion script using an encryption key that matches the personalization session key, and wherein the execution of the activation script enables the mobile device with access to the personalization data and provisions the personalization data onto the mobile device.

11. The application provider computer of claim 10 , further comprising:

sending, to the mobile device, the activation script and the deletion script;

receiving, from the service provider computer, an activation message; and

initiating, the execution of the activation script on the mobile device, wherein the mobile device decrypts the activation script using the encryption key that matches the personalization session key.

12. The application provider computer of claim 10 , wherein the execution of the partial personalization script stores the personalization data onto the mobile device a secured form.

13. The application provider computer of claim 10 , wherein the session identifier is a nonce value.

14. The application provider computer of claim 10 , wherein the personalization master key is a symmetric encryption key.

15. The application provider computer of claim 10 , wherein the device information includes a device cryptogram generated by the mobile device using the encryption key that matches the personalization session key, and wherein the service provider computer authenticates a user of the mobile device by validating the device cryptogram using the personalization session key.

16. The application provider computer of claim 10 , wherein the request further includes user authentication information for a user of the mobile device, wherein the user authentication information includes an account identifier, and wherein the personalization data includes a token that represents the account identifier.

17. The application provider computer of claim 10 , wherein the request does not include the personalization master key, and wherein the personalization master key is not sent between the mobile device and the service provider computer.

18. The application provider computer of claim 10 , wherein the personalization master key is associated with an issuer of a user account or a manufacturer of a secure element associated with the secure element identifier.