Granted Patent B2

US 12,361,409 · App. 17/842,072 · Granted Jul 15, 2025

Inventors: Erick Wong (Vancouver, CA); Kiushan Pirzadeh (Foster City, CA); Oleg Makhotin (Paris, FR); Glenn Powell (Fremont, CA); Igor Karpenko (Sunnyvale, CA); John Sheets (San Francisco, CA); Frederick Liu (Oakland, CA)

Assignee: Visa International Service Association

G06Q20/3821G06Q20/322G06Q20/382G06Q20/3829G06Q20/4016G06Q20/3674G06Q2220/00

Abstract

Claims (86)

1. A method, comprising:

transmitting, from a mobile device, a first provisioning request to a server computer to provision a first payment credential associated with a first account of a user to the mobile device, wherein the first provisioning request includes a first verification value associated with the first payment credential and excludes the first payment credential;

based on a risk level associated with the first provisioning request being within a predetermined risk threshold range:

receiving, by the mobile device from the server computer, a first set of provisioning scripts and a first token in an inactive state;

executing, by the mobile device, the first set of provisioning scripts;

storing, by the mobile device, the first token and a protection flag associated with the first token in a memory of the mobile device based on executing the first set of provisioning scripts, the protection flag representing the inactive state of the first token;

based on a successful performance of an authentication process for the first provisioning request with the user, receiving, by the mobile device from the server computer, an activation script that, when executed on the mobile device, modifies a status of the first token from the inactive state to an active state;

executing, by the mobile device, the activation script;

disabling, by the mobile device, the protection flag associated with the first token based on executing the activation script;

storing, by the mobile device, the first token in the active state based on disabling the protection flag thereby configuring a digital wallet application stored on the mobile device with the first token;

transmitting, from the mobile device, a second provisioning request to the server computer to provision a second payment credential associated with a second account of the user to the mobile device, wherein the second provisioning request includes a second verification value associated with the second payment credential and excludes the second payment credential;

based on the risk level associated with the second provisioning request being below the predetermined risk threshold range:

receiving, by the mobile device from the server computer, a second set of provisioning scripts and a second token in the active state without performing an authentication process for the second provisioning request with the user;

executing, by the mobile device, the second set of provisioning scripts;

storing, by the mobile device, the second token in the active state based on executing the second set of provisioning scripts and without requiring the authentication process with the user, thereby configuring the digital wallet application stored on the mobile device with the second token.

2. The method of claim 1 , further comprising:

transmitting a third provisioning request to the server computer to provision a third payment credential associated with a third account of the user, wherein the third provisioning request includes a third verification value associated with the third payment credential and excludes the third payment credential;

based on the risk level meeting or exceeding the predetermined risk threshold range:

receiving, by the mobile device, a provisioning request denial message indicating that the third provisioning request is denied.

3. The method of claim 1 , further comprising:

upon storing, by the mobile device, the protection flag associated with the first token in the memory of the mobile device:

facilitating, by the mobile device with the server computer, performance of the authentication process with the user.

4. The method of claim 1 , further comprising:

transmitting, by the mobile device, the first token and the second token in the active state to a transacting entity during a transaction with the transacting entity.

5. The method of claim 4 , further comprising:

generating, by the mobile device, a unique transaction identifier using a shared digest shared with the server computer;

storing, by the mobile device, transaction information associated with the transaction along with the unique transaction identifier at a transaction log on the mobile device;

receiving, by the mobile device from the server computer, the unique transaction identifier and additional transaction information for the transaction;

identifying, by the mobile device, a record of the transaction at the transaction log based upon the unique transaction identifier, and

updating, by the mobile device, the record based upon the additional transaction information.

6. The method of claim 1 , further comprising:

said performing the authentication process with the user comprises receiving, by the mobile device from an issuer computer associated with the first account of the user, a dynamic verification value; and

said successful performance of the authentication process comprises transmitting, by the mobile device to the server computer, a consumer verification response that includes the dynamic verification value.

7. The method of claim 1 , further comprising:

transmitting, by the mobile device, a secure element encryption key to the server computer;

receiving, by the mobile device from a wallet application provider, an encrypted communication message encrypted using the secure element encryption key; and

decrypting, by the mobile device, the encrypted communication message encrypted using a secure element decryption key that corresponds to the secure element encryption key.

8. The method of claim 1 , further comprising:

receiving, by the mobile device, a first encryption key from the server computer as part of the first set of provisioning scripts, the activation script, or the second set of provisioning scripts;

receiving, by the mobile device from a wallet application provider, an encrypted communication message encrypted using a second encryption key that corresponds to the first encryption key; and

decrypting, by the mobile device, the encrypted communication message encrypted using the first encryption key.

9. The method of claim 1 , wherein the memory of the mobile device includes a secure element.

10. A mobile device comprising:

one or more processors; and

a non-transitory computer readable storage medium communicatively coupled with the one or more processors and storing instructions which, when executed by the one or more processors, cause the mobile device to perform operations comprising:

transmitting a first provisioning request to a server computer to provision a first payment credential associated with a first account of a user to the mobile device, wherein the first provisioning request includes a first verification value associated with the first payment credential and excludes the first payment credential;

based on a risk level associated with the first provisioning request being within a predetermined risk threshold range:

receiving, from the server computer, a first set of provisioning scripts and a first token in an inactive state;

executing the first set of provisioning scripts;

storing the first token and a protection flag associated with the first token in a memory of the mobile device based on executing the first set of provisioning scripts, the protection flag representing the inactive state of the first token;

based on a successful performance of an authentication process for the first provisioning request with the user, receiving, from the server computer, an activation script that, when executed on the mobile device, modifies a status of the first token from the inactive state to an active state;

executing the activation script;

disabling the protection flag associated with the first token based on executing the activation script;

storing the first token in the active state based on disabling the protection flag thereby configuring a digital wallet application stored on the mobile device with the first token;

transmitting a second provisioning request to the server computer to provision a second payment credential associated with a second account of the user to the mobile device, wherein the second provisioning request includes a second verification value associated with the second payment credential and excludes the second payment credential;

based on the risk level associated with the second provisioning request being below the predetermined risk threshold range:

receiving, from the server computer, a second set of provisioning scripts and a second token in the active state without performing an authentication process for the second provisioning request with the user;

executing the second set of provisioning scripts;

storing the second token in the active state based on executing the second set of provisioning scripts and without requiring the authentication process with the user, thereby configuring the digital wallet application stored on the mobile device with the second token.

11. The mobile device of claim 10 , wherein the instructions, when executed by the one or more processors, cause the mobile device to perform operations comprising:

transmitting a third provisioning request to the server computer to provision a third payment credential associated with a third account of the user, wherein the third provisioning request includes a third verification value associated with the third payment credential and excludes the third payment credential;

based on the risk level meeting or exceeding the predetermined risk threshold range:

receiving a provisioning request denial message indicating that the third provisioning request is denied.

12. The mobile device of claim 10 , wherein the instructions, when executed by the one or more processors, cause the mobile device to perform operations comprising:

upon storing the protection flag associated with the first token in the memory of the mobile device:

facilitating, with the server computer, performance of the authentication process with the user.

13. The mobile device of claim 10 , wherein the instructions, when executed by the one or more processors, cause the mobile device to perform operations comprising:

transmitting the first token or the second token in the active state to a transacting entity during a transaction with the transacting entity.

14. The mobile device of claim 13 , wherein the instructions, when executed by the one or more processors, cause the mobile device to perform operations comprising:

generating a unique transaction identifier using a shared digest shared with the server computer;

storing transaction information associated with the transaction along with the unique transaction identifier at a transaction log on the mobile device;

receiving, from the server computer, the unique transaction identifier and additional transaction information for the transaction;

identifying a record of the transaction at the transaction log based upon the unique transaction identifier, and

updating the record based upon the additional transaction information.

15. The mobile device of claim 10 , wherein the instructions, when executed by the one or more processors, cause the mobile device to perform operations comprising:

said performing the authentication process with the user comprises receiving, from an issuer computer associated with the first account of the user, a dynamic verification value; and

said successful performance of the authentication process comprises transmitting, to the server computer, a consumer verification response that includes the dynamic verification value.

16. The mobile device of claim 10 , wherein the instructions, when executed by the one or more processors, cause the mobile device to perform operations comprising:

transmitting a secure element encryption key to the server computer;

receiving, from a wallet application provider, an encrypted communication message encrypted using the secure element encryption key; and

decrypting the encrypted communication message encrypted using a secure element decryption key that corresponds to the secure element encryption key.

17. The mobile device of claim 10 , wherein the instructions, when executed by the one or more processors, cause the mobile device to perform operations comprising:

receiving a first encryption key from the server computer as part of the first set of provisioning scripts, the activation script, or the second set of provisioning scripts;

receiving, from a wallet application provider, an encrypted communication message encrypted using a second encryption key that corresponds to the first encryption key; and

decrypting the encrypted communication message encrypted using the first encryption key.

18. The mobile device of claim 10 , wherein the memory of the mobile device includes a secure element.

Continuity (9)

References Cited (400)