Securing external systems with account token substitution

Patent metadata

Field	Value
Publication number	US-10726413-B2
Application number	US-201615095984-A
Country	US
Kind code	B2
Filing date	Apr 11, 2016
Priority date	Aug 12, 2010
Publication date	Jul 28, 2020
Grant date	Jul 28, 2020

Abstract

Systems, apparatuses, and methods for providing an account token to an external entity during the lifecycle of a payment transaction. In some embodiments, an external entity may be a merchant computer requesting authorization of a payment message. In other embodiments, the external entity may be a support computer providing a payment processing network or a merchant support functions.

First claim

What is claimed is:

1. A method comprising:
receiving, by a tokenization server, a transaction authorization message including an account identifier, wherein the tokenization server is communicatively coupled to a first external entity computer of a first external entity and a second external entity computer of a second external entity for performing transaction support processes that supplement an authorization process in connection with the transaction authorization message;
determining, by the tokenization server, that the first external entity computer is adapted to receive an account token in lieu of the account identifier whereas the second external entity computer is adapted to receive the account identifier;
identifying, by the tokenization server, a unique token derivation key assigned to the first external entity computer, wherein the unique token derivation key is available only to the tokenization server;
generating, by the tokenization server, the account token for the account identifier included in the transaction authorization message, generating comprising:
encrypting the account identifier using the unique token derivation key for the first external entity computer to obtain the account token;

transmitting, by the tokenization server, a first external transaction support request message with the account token to the first external entity computer for processing by the first external entity;
transmitting, by the tokenization server, a second external transaction support request message with the account identifier to the second external entity computer for processing by the second external entity;
receiving, by the tokenization server, a first external transaction support response message including the account token from the first external entity computer in response to the first external entity computer performing the transaction support process;
receiving, by the tokenization server, a second external transaction support response message including the account identifier from the second external entity computer in response to the second external entity computer performing the transaction support process;
sending, by the tokenization server, the transaction authorization message along with data from the first external transaction support response message or the second external transaction support response message to an issuer computer;
receiving, by the tokenization server, a transaction response message from the issuer computer; and
sending, by the tokenization server, the transaction response message along with data from the first external transaction support response message or the second external transaction support response message to a merchant computer.

2. The method of claim 1 , wherein the transaction authorization message is a transaction authorization request message, the first external transaction support response message or the second external transaction support response message includes a fraud score, and the method further comprises:
sending, by the tokenization server, the fraud score along with the transaction authorization message to the issuer computer.

3. The method of claim 1 , further comprising, before generating the account token, determining, by the tokenization server, that an account token associated with the account identifier has not been generated.

4. The method of claim 1 , further comprising:
receiving, by the tokenization server from the first external entity computer and the second external entity computer, transaction support processing information about the first external entity computer and the second external entity computer during an enrollment process;
storing, by the tokenization server, the transaction support processing information associated with the first external entity computer and the second external entity computer in a database.

5. The method of claim 4 , wherein determining that the first external entity computer is adapted to receive the account token further comprises:
looking up, by the tokenization server, the transaction support processing information associated with the first external entity computer from the database; and
determining, by the tokenization server, that the first external entity computer is adapted to receive the account token in lieu of the account identifier based on the transaction support processing information about the first external entity.

6. The method of claim 1 , wherein the first external entity computer or the second external entity computer includes a reporting system that generates reports of transaction histories based on a number of categories, and the method further comprises:
sending the transaction response message along with the reports of transaction histories to the merchant computer.

7. A server computer comprising:
a processor and
a memory coupled to the processor, the memory storing instructions that, when executed by the processor, cause the processor to:
receive a transaction authorization message including an account identifier, wherein the server computer is communicatively coupled to a first external entity computer of a first external entity and a second external entity computer of a second external entity for performing transaction support processes that supplement an authorization process in connection with the transaction authorization message;
determine that the first external entity computer is adapted to receive an account token in lieu of the account identifier whereas the second external entity computer is adapted to receive the account identifier;
identify a unique token derivation key assigned to the first external entity computer, wherein the unique token derivation key is available only to the server computer;
generate the account token for the account identifier included in the transaction authorization message, wherein the instructions causing the processor to generate the account token further cause the processor to:
encrypt the account identifier using the unique token derivation key for the first external entity computer to obtain the account token;

transmit a first external transaction support request message with the account token to the first external entity computer for processing by the first external entity;
transmit a second external transaction support request message with the account identifier to the second external entity computer for processing by the second external entity;
receive a first external transaction support response message including the account token from the first external entity computer in response to the first external entity computer performing the transaction support process; and
receive a second external transaction support response message including the account identifier from the second external entity computer in response to the second external entity computer performing the transaction support process;
send the transaction authorization message along with data from the first external transaction support response message or the second external transaction support response message to an issuer computer;
receive a transaction response message from the issuer computer; and
send the transaction response message along with data from the first external transaction support response message or the second external transaction support response message to a merchant computer.

8. The server computer of claim 7 , wherein the transaction authorization message is a transaction authorization request message, the first external transaction support response message or the second external transaction support response message includes a fraud score, and the instructions, when executed by the processor, further cause the processor to:
send the fraud score along with the

Assignees

• Visa Int Service Ass

Inventors

• Basu Gourab
• Mori Michael
• Sakata Ross
• Cracknell Steven
• Yee Millie
• Carlson Mark
• Stan Patrick
• Keshan Surendra
• Katzin Edward

Classifications

• G06Q20/02 Primary

  involving a neutral party, e.g. certification authority, notary or trusted third party [TTP] · CPC title

• G06Q20/3672 Primary

  initialising or reloading thereof · CPC title

• G06Q20/385 Primary

  using an alias or single-use codes · CPC title

• G06Q20/382

  insuring higher security of transaction · CPC title

• G06Q20/12

  specially adapted for electronic shopping systems · CPC title