Token enrollment system and method

Patent metadata

Field	Value
Publication number	US-10015147-B2
Application number	US-201514920618-A
Country	US
Kind code	B2
Filing date	Oct 22, 2015
Priority date	Oct 22, 2014
Publication date	Jul 3, 2018
Grant date	Jul 3, 2018

Abstract

Embodiments of the invention are directed to methods, apparatuses, computer readable media and systems for providing a token service environment that allows a token requesting party (e.g. token requestor) to specify parameters for token generation for controlling and customizing the token generation process. For example, the token requesting party may specify (e.g. select from a list or provide a list of) the accounts for tokenization. The accounts may be identified by account identifiers (e.g. account numbers) or bank identification numbers (BINs). The token requesting party may also specify encryption keys for the tokens to be generated. The token requesting party may also specify additional parameters such as notification thresholds indicating when notifications associated with the tokens are to be generated.

First claim

What is claimed is:

1. A method comprising:
providing, by a token server computer operated by a token service provider, an interface to a party, wherein the party controls generation of payment tokens for account identifiers via the interface;
receiving, at the token server computer, a set of account identifiers from a computer operated by the party via the interface;
receiving, at the token server computer, one or more encryption keys from the computer operated by the party via the interface;
receiving, at the token server computer, a request to generate payment tokens for the set of account identifiers using the one or more encryption keys such that each generated payment token represents an account identifier among the set of account identifiers;
for each account identifier in the set of account identifiers:
determining, by the token server computer, a payment token based on the one or more encryption keys provided by the party, wherein the payment token determined for an account identifier substitutes the account identifier in a payment transaction initiated using the payment token, wherein a format of the payment token is similar to a format of the account identifier substituted by the payment token; and
storing the payment token and associated encryption keys for later use in token transaction processing.

2. The method of claim 1 , further comprising:
receiving, at the token server computer, a notification criteria from the computer operated by the party via the interface; and
sending, by the token server computer, a notification to the computer operated by the party when the payment token satisfies the notification criteria.

3. The method of claim 2 , wherein the notification criteria includes generation of the payment token or provisioning of the payment token.

4. The method of claim 1 , further comprising:
receiving, by the token server computer from the computer operated by the party via the interface, an instruction instructing using the one or more encryption keys provided by the party during generation of the payment tokens.

5. The method of claim 1 , further comprising:
receiving, at the token server computer, a restriction to be placed on one or more of the generated payment tokens from the computer operated by the party via the interface.

6. The method of claim 1 , wherein receiving the set of account identifiers from the computer operated by the party further comprises:
presenting, by the token server computer, a list of a plurality of account identifiers via the interface; and
receiving, at the token server computer, a selection of the set of account identifiers on the list of the plurality of account identifiers from the computer operated by the party via the interface.

7. The method of claim 1 , wherein receiving the set of account identifiers from the computer operated by the party further comprises:
receiving, at the token server computer, a file containing the set of account identifiers from the computer operated by the party via the interface.

8. The method of claim 1 , further comprising:
receiving, at the token server computer, provisioning parameters for the generated payment tokens via the interface, wherein the provisioning parameters include one or more of risk decision rules, design elements or provisioning conditions; and
provisioning, by the token server computer, the generated payment tokens on user devices based on the provisioning parameters.

9. A token server computer operated by a token service provider, comprising:
one or more processors;
a non-transitory computer readable storage medium communicatively coupled with the one or more processors and storing instructions which, when executed by the one or more processors, cause the token server computer to:
provide an interface to a party, wherein the party controls generation of payment tokens for account identifiers via the interface;
receive a set of account identifiers from a computer operated by the party via the interface;
receive one or more encryption keys from the computer operated by the party via the interface;
receive a request to generate payment tokens for the set of account identifiers using the one or more encryption keys such that each generated payment token represents an account identifier among the set of account identifiers;
for each account identifier in the set of account identifiers:
determine a payment token based on the one or more encryption keys provided by the party, wherein the payment token determined for an account identifier substitutes the account identifier in a payment transaction initiated using the payment token, wherein a format of the payment token is similar to a format of the account identifier substituted by the payment token; and

a token vault for storing the payment token and associated encryption keys for later use in token transaction processing.

10. The token server computer of claim 9 , further including:
a notification module for:
receiving a notification criteria to generate one or more notifications from the computer operated by the party via the interface;
generating a notification when the payment token satisfies the notification criteria; and
sending the notification to the computer operated by the party.

11. The token server computer of claim 9 , wherein instructions to receive a set of account identifiers from a computer operated by the party further comprises instructions to:
present a list of a plurality of account identifiers via the interface; and
receive a selection of the set of account identifiers on the list of the plurality of account identifiers from the computer operated by the party via the interface.

12. The token server computer of claim 9 , wherein instructions to receive a set of account identifiers from a computer operated by the party further comprises instructions to:
receive a file containing the set of account identifiers from the computer operated by the party via the interface.

13. A method comprising:
accessing, by a computer operated by a party, an interface provided by a token server computer operated by a token service provider to control generation of payment tokens for account identifiers;
providing, by the computer operated by the party, a set of account identifiers to the token server computer via the interface;
providing, by the computer operated by the party, one or more encryption keys to the token server computer via the interface;
providing, by the computer operated by the party to the token server computer via the interface, an instruction to generate a set of payment tokens using the one or more encryption keys provided by the computer operated by the party; and
customizing, by the computer operated by the party, generation of payment tokens by the token server computer, wherein a payment token associated with at least one encryption key is generated for each account identifier of the set of account identifiers for later use in token transaction processing, wherein a payment token generated for an account identifier substitutes the account identifier in a payment transaction initiated using the payment token, wherein a format of the payment token is similar to a format of the account identifier substituted by the payment token.

14. The method of claim 13 , further comprising:
providing, by the computer operated by the party, a notification criteria to receive one or more notifications from the token server computer via the interface, wherein the notification criteria includes generation of the payment token or provisioning of the payment token on a user device; and
receiving, by the computer operated

Assignees

• Visa Int Service Ass

Inventors

• Narayan Prasanna L
• Palanisamy Karthikeyan
• Sethuraman Ramji

Classifications

• H04L9/083

  involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP] · CPC title

• H04L9/0822

  using key encryption key · CPC title

• H04L2209/56

  Financial cryptography, e.g. electronic payment or e-cash · CPC title

• H04L2463/102

  applying security measure for e-commerce · CPC title

• H04L63/0876

  based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint · CPC title