Apple Inc.

Ahmer Ali Khan

Joakim Linde

Christopher Brooke Sharp

Zachary A Rosen

George R Dicker

Jerrold Von Hauck

David T Haggerty

Timothy S Hurley

Franck Farian Rakotomalala

Yousuf H Vaid

Ho Cheung Chung

Gianpaolo Fasoli

Gordon Y Scott

Ka Yang

Irene M Graff

David W Silver

Mehdi Ziat

Martijn Theo Haring

Gregory B Novick

Policarpo Bonilla Wood

Glen W Steele

Joseph Hakim

Thomas John Miller

Yehonatan Perez

David E Brudnicki

Oren M Elrad

Christopher D Adams

Saket R Vora

Haya Iris Villanueva Gaviola

Mayura D Deshpande

Antonio Allen

Vinay Ganesh

Xiangying Yang

Onur E Tackin

Matthias Lerch

Thomas Elliott

Jennifer J Bailey

Manoj K Thulaseedharan Pillai

Kevin P McLaughlin

Brian J Tucker

Rupamay Saha

Martijn T Haring

Vishnu Janardhanan

Ravi Chotrani

Mitchell David Adler

Peng Liu

Wade Benson

Daniel A Boyd

Jason Lim

Chang Ellison

Kelli L Biegger

Brandon P Gutierrez

Lucia Elena Ballard

Libor Sykora

Jeffrey C Lee

Vineet Chadha

Lorraine Meere

Vamshi Krishna Aileni

Manoj Thulaseedharan Pillai

Antonio A Allen

Jerroid V Hauck

Yousaf H Vaid

Techniques are disclosed relating to authenticating a user with a mobile device. In various embodiments, a mobile device receives a request to provision the mobile device with identification information from an identification document issued by an authority to a user for establishing an identity of the user. In response to the received request, the mobile device issues a request for verification information signed by the authority and usable to verify the identification information. The issued request identifies multiple public keys of the mobile device, each having a respective corresponding private key for generating a signature usable to verify the identification information. The mobile device receives and stores the signed verification information, the signed verification information including the plurality of public keys. In some embodiments, the mobile device receives a request provide, at least, a portion of the identification information and selects one of the private keys to generate a signature.

Multiple-key verification information for mobile device identity document

A computing device can receive a request from a requesting device for one or more data elements associated with a digital credential. The computing device can store the digital credential which includes a set of data elements and a security object. The computing device can determine a subset of the data elements based at least in part on the request. The computing device can generate the response, wherein the response includes the subset of the data elements and the security object. The computing device can transmit the response to the requesting device.

Techniques for generating and using nonlinkable digital credentials

A computing device can generate a set of transaction keys, the computing device configured to present a digital credential to a requesting device. The computing device can generate a request bundle. The request bundle can include the set of transaction keys. The computing device can transmit, to a first server, the request bundle. The first server can be configured to verify the request bundle. The first server can be configured to send the request bundle to a second server with a request for a set of credentials. Each credential of the set of credentials can correspond to a transaction key of the set of transaction keys. Each credential can include data elements and a security object. The data elements for each credential can be the same. The security object for each credential can be different. The computing device can receive, from the first server, the set of credentials. The computing device can store the set of credentials. The computing device can be configured to generate a response based on a particular credential of the set of credentials when a requesting device requests the digital credential.

Systems, methods, and computer-readable media for provisioning credentials on an electronic device are provided. In one example embodiment, a secure platform system may be in communication with an electronic device and a financial institution subsystem. The secure platform system may be configured to, inter alia, detect a selection of a particular commerce credential, access communication mechanism data indicative of at least one communication mechanism of the device, where the at least one mechanism is configured to receive a communication on the device, transmit information to the financial subsystem, where the information includes the mechanism data and the selection of the particular commerce credential, and instruct the financial subsystem to provision the particular commerce credential in a disabled state on the device and communicate credential enablement data to the device using a particular communication mechanism of the at least one communication mechanism indicated by the communication mechanism data.

Credential provisioning for an electronic device

Disclosed herein are systems, methods, and non-transitory computer-readable storage media for transmitting, as part of a polling loop, a value added services (VAS) command that includes capability data corresponding to a payment terminal. For example, the payment terminal can transmit a VAS command that advertises the payment terminal's capabilities as part of a polling loop. The payment terminal can listen for a response to the VAS command and, after receiving a response, the payment terminal may initiate a VAS protocol. The VAS command can also specify a mode in which the payment terminal is operating, such as a payment-only mode, a VAS mode, a payment-plus-VAS mode, etc.

Value added services polling

An embodiment includes a method to increase the efficiency of security checkpoint operations. A security checkpoint kiosk serves as a Relying Party System (RPS). The RPS establishes a secure local connection between the RPS and a User Mobile-Identification-Credential Device (UMD). The RPS sends a user information request to the UMD, via the secure local connection, seeking release of user information associated with a Mobile Identification Credential (MIC). The RPS obtains authentication of the user information received in response to the user information request. The RPS retrieves user travel information based on the user information. The RPS determines that the user travel information matches the user information. When the user travel information matches the user information, the RPS approves the user to proceed past the security checkpoint kiosk.

Checkpoint identity verification using mobile identification credential

To facilitate conducting a financial transaction via wireless communication between an electronic device and another electronic device, the electronic device determines a unique transaction identifier for the financial transaction based on financial-account information communicated to the other electronic device. The financial-account information specifies a financial account that is used to pay for the financial transaction. Moreover, the unique transaction identifier may be capable of being independently computed by one or more other entities associated with the financial transaction (such as a counterparty in the financial transaction or a payment network that processes payment for the financial transaction) based on the financial-account information communicated by the portable electronic device. The electronic device may also associate receipt information, which is subsequently received from a third party (such as the payment network), with the financial transaction by comparing the determined unique transaction identifier to the computed unique transaction identifier.

Generating transaction identifiers

In order to validate a user to facilitate conducting a high-valued financial transaction via wireless communication between an electronic device (such as a smartphone) and another electronic device (such as a point-of-sale terminal), the electronic device may authenticate the user prior to the onset of the high-valued financial transaction. In particular, a secure enclave processor in a processor may provide local validation information that is specific to the electronic device to a secure element in the electronic device when received local authentication information that is specific to the electronic device (such as a biometric identifier of the user) matches stored authentication information. Moreover, an authentication applet in the secure element may provide the local validation information to an activated payment applet in the secure element. This may enable the payment applet to conduct the high-valued financial transaction via wireless communication, such as near-field communication.

System and method for payments using biometric authentication

Systems, methods, and computer-readable media for communicating electronic device secure element data over multiple paths for online payments are provided. In one example embodiment, a method includes, inter alia, at a commercial entity subsystem, receiving, from an electronic device, device transaction data that includes credential data indicative of a payment credential on the electronic device for funding a transaction with a merchant subsystem, accessing a transaction identifier, deriving a transaction key based on transaction key data that includes the accessed transaction identifier, transmitting, to one of the merchant subsystem and the electronic device, merchant payment data that includes a first portion of the credential data and the accessed transaction identifier, and sharing, with a financial institution subsystem using the transaction key, commercial payment data that includes a second portion of the credential data that is different than the first portion of the credential data. Additional embodiments are also provided.

Multi-path communication of electronic device secure element data for online payments

A device for controlled identity credential release may include at least one processor configured to receive a request to release an identity credential of a user, the identity credential being stored on the device. The at least one processor may be further configured to authenticate the user associated with the identity credential. The at least one processor may be further configured to, responsive to the authentication, provide at least a portion of the identity credential, such as for display and/or to a terminal device over a direct wireless connection. The at least one processor may be further configured to cause the electronic device to enter a locked state and/or to remain in a locked state, responsive to providing the at least the portion of the identity credential.

Controlled identity credential release

Techniques are disclosed relating to authenticate a user with a mobile device. In one embodiment, a computing device includes a short-range radio and a secure element. The computing device reads, via the short-range radio, a portion of credential information stored in a circuit embedded in an identification document issued by an authority to a user for establishing an identity of the user. The computing device issues, to the authority, a request to store the credential information, the request specifying the portion of the credential information. In response to an approval of the request, the computing device stores the credential information in the secure element, the credential information being usable to establish the identity of the user. In some embodiments, the identification document is a passport that includes a radio-frequency identification (RFID) circuit storing the credential information, and the request specifies a passport number read from the RFID circuit.

Document importation into secure element

The present disclosure generally relates to digital identification credential user interfaces.

Digital identification credential user interfaces

Techniques are disclosed relating to authenticating a user with a mobile device. In some embodiments, a computing device stores a first signed attestation indicating an ability of the computing device to securely perform a user authentication. The computing device receives a request to store credential information of an identification document issued by an issuing authority to a user for establishing an identity of the user. In response to the request, the computing device sends, to the issuing authority, a request to store the credential information, the sent request including the first signed attestation to indicate an ability to perform a user authentication prior to permitting access to the credential information. In response to an approval of the sent request based on the first signed attestation, the computing device stores the credential information in a secure element of the computing device.

User authentication framework

Growing community of inventors

Milpitas, CA, United States of America

Ahmer Ali Khan