Using biometric authentication for NFC-based payments

1. An electronic device, comprising:

a secure element comprising: an authentication applet and a plurality of payment applets;

a processor, comprising a secure enclave processor configured to securely communicate with the secure element using one or more encryption keys;

wherein the secure enclave processor is configured to:

receive a first local authentication information specific to the electronic device, wherein the first local authentication information is associated with an activated payment applet of the plurality of payment applets;

perform a first comparison with the first local authentication information and a first stored authentication information;

determine that the first comparison satisfies a first match;

in response to the first match, request second local authentication information;

in response to the request, receive a second local authentication information specific to the electronic device;

perform a second comparison with the second local authentication information and a second stored authentication information;

determine that the second comparison satisfies a second match; and

in response to the second match, provide local validation information (LVI) and an authentication-complete indicator to the authentication applet; and

wherein the authentication applet is configured to:

based at least on the LVI, set an LVI flag of the activated payment applet;

based at least on the authentication-complete indicator, set a global authentication-complete flag in an operating system of the secure element that enables a subset of the plurality of payment applets; and

request LVI from the subset of the plurality of payment applets enabled,

wherein the secure element conducts a financial transaction without further validation with a second electronic device based at least on the LVI flag and the global authentication-complete flag, wherein the financial transaction exceeds a predetermined financial value.

2. The electronic device of claim 1 , further comprising:

an antenna; and

an interface circuit, coupled to the antenna, the secure element and the secure enclave processor, wherein the interface circuit is configured to communicate with the second electronic device, wherein the financial transaction is conducted via wireless communication.

3. The electronic device of claim 1 , further comprising a biometric sensor coupled to the secure enclave processor; wherein the second local authentication information includes a biometric identifier acquired by the biometric sensor.

4. The electronic device of claim 1 , wherein the second local authentication information includes a passcode for unlocking at least some functionality of the electronic device.

5. The electronic device of claim 1 , wherein the second electronic device includes a point-of-sale terminal that provides the predetermined financial value.

6. The electronic device of claim 2 , wherein the second electronic device includes a point-of-sale terminal;

wherein the wireless communication with the point-of-sale terminal is via nearfield communication; and

wherein the financial transaction is initiated by positioning the electronic device proximate to the point-of-sale terminal.

7. The electronic device of claim 1 , wherein the processor is further configured to:

prior to the secure enclave processor performing the second comparison with the second local authentication information:

provide an activation command to the secure element via the secure enclave processor, wherein the activated payment applet is configured to conduct the financial transaction after receiving the activation command and based at least on the LVI;

receive an activation response from the secure element via the secure enclave processor; and

request the second local authentication information based at least on the activation response.

8. The electronic device of claim 7 , wherein the processor is further configured to:

prior to providing the activation command, receive from a user, a selection of the activated payment applet for the financial transaction, wherein the selection is made using a top-level user interface in a user-interface hierarchy.

9. The electronic device of claim 1 , wherein the authentication applet is further configured to:

in response to the request for the LVI, receive a confirmation from the activated payment applet of the subset of the payment applets enabled.

10. The electronic device of claim 9 , wherein the secure element is further configured to:

prior to the electronic device being positioned proximate to the second electronic device, provide a confirmation that the activated payment applet of the subset of the payment applets enabled is allowed to conduct the financial transaction that exceeds the predetermined financial value, without further validation.

11. A non-transitory computer-readable storage medium storing first instructions and second instructions;

wherein the first instructions, when executed by a secure enclave processor in a processor of an electronic device, cause the secure enclave processor to perform first operations comprising:

receiving a first local authentication information specific to the electronic device, wherein the first local authentication information is associated with an activated payment applet of a plurality of payment applets;

performing a first comparison with the first local authentication information and a first stored authentication information;

determining that the first comparison satisfies a first match;

in response to the first match, requesting second local authentication information;

in response to the requesting, receiving a second local authentication information specific to the electronic device;

performing a second comparison with the second local authentication information and a second stored authentication information;

determining that the second comparison satisfies a second match; and

in response to the second match, providing local validation information (LVI) and an authentication-complete indicator to an authentication applet stored on a secure element of the electronic device; and

wherein the second instructions, when executed by the secure element of the electronic device cause the authentication applet to perform second operations comprising:

based at least on the LVI, setting an LVI flag of the activated payment applet;

based at least on the authentication-complete indicator, setting a global authentication-complete flag in an operating system of the secure element that enables a subset of the plurality of payment applets; and

requesting LVI from the subset of the plurality of payment applets enabled, wherein the secure element conducts a financial transaction without further validation with a second electronic device based at least on the LVI flag and the global authentication-complete flag wherein the financial transaction exceeds a predetermined financial value.

12. The non-transitory computer-readable storage medium of claim 11 , wherein the second local authentication information includes a biometric identifier.

13. The non-transitory computer-readable storage medium of claim 11 , wherein the second local authentication information includes a passcode for unlocking at least some functionality of the electronic device.

14. The non-transitory computer-readable storage medium of claim 11 , wherein the financial transaction is conducted when the electronic device is positioned proximate to the second electronic device a single time.

15. The non-transitory computer-readable storage medium of claim 11 , further storing third instructions, which when executed by the processor of the electronic device, cause the processor to perform third operations comprising:

prior to the secure enclave processor receiving the second local authentication information:

providing an activation command to the secure element via the secure enclave processor, wherein the activated payment applet is configured to conduct the financial transaction after receiving the activation command and based at least on the LVI;

receiving an activation response from the secure element via the secure enclave processor; and

requesting the second local authentication information based at least on the activation response.

16. A processor-implemented method for, conducting a financial transaction at an electronic device, comprising a secure element and a secure enclave processor, with another electronic device, wherein the method comprises:

receiving, by the secure enclave processor, a first local authentication information specific to the electronic device, wherein the first local authentication information is associated with an activated payment applet of a plurality of payment applets;

performing a first comparison, by the secure enclave processor, on the first local authentication information and a first stored authentication information,

determining, by the secure enclave processor, that the first comparison satisfies a first match;

in response to the first match, requesting, by the secure enclave processor, second local authentication information;

in response to the requesting, receiving, by the secure enclave processor, a second local authentication information specific to the electronic device;

performing a second comparison, by the secure enclave processor, on the second local authentication information and a second stored authentication information;

determining, by the secure enclave processor, that the second comparison satisfies a second match;

in response to the second match, providing, by the secure enclave processor, local validation information (LVI) and an authentication-complete indicator to an authentication applet stored on the secure element;

based at least on the LVI, setting, by the authentication applet, an LVI flag of the activated payment applet;

based at least on the authentication-complete indicator, setting, by the authentication applet, a global authentication-complete flag in an operating system of the secure element to enable a subset of the plurality of payment applets; and

requesting, by the authentication applet, LVI from the subset of the plurality of payment applets enabled, wherein the secure element conducts a financial transaction without further validation with a second electronic device based at least on the LVI flag and the global authentication-complete flag, wherein the financial transaction exceeds a predetermined value.

17. The processor-implemented method of claim 16 , further comprising:

prior to receiving the second local authentication information, providing an activation command to the secure element via a secure enclave processor, wherein the activated payment applet is configured to conduct the financial transaction after receiving the activation command and based at least on the LVI;

receiving an activation response from the secure element via the secure enclave processor; and

requesting the first local authentication information based at least on the activation response.

18. The processor-implemented method of claim 16 , wherein the setting the LVI flag of the activated payment applet comprises:

transmitting an encrypted token to the authentication applet, wherein the encrypted token includes the LVI.

19. The processor-implemented method of claim 18 , further comprising:

decrypting, by the authentication applet, the encrypted token; and

communicating, by the authentication applet, the LVI to the activated payment applet via a sharable interface object,

wherein the authentication applet executes in a master security domain and the activated payment applet executes in a supplemental security domain.