Secure token distribution

Patent metadata

Field	Value
Publication number	US-10911429-B2
Application number	US-201615369488-A
Country	US
Kind code	B2
Filing date	Dec 5, 2016
Priority date	Dec 4, 2015
Publication date	Feb 2, 2021
Grant date	Feb 2, 2021

Abstract

A method for utilizing a registration authority to facilitate a certificate signing request is disclosed. In at least one embodiment, a registration authority computer may receive a certificate signing request associated with a token requestor. The registration authority may authenticate the identity of the token requestor and forward the certificate signing request to a certificate authority computer. A token requestor ID and a signed certificate may be provided by the certificate authority computer and forwarded to the token requestor. The token requestor ID may be utilized by the token requestor to generate digital signatures for subsequent token-based transactions.

First claim

What is claimed is:

1. A computer-implemented method, comprising:
receiving, at a registration authority computer, a certificate signing request from a token requestor computer associated with a token requestor, wherein the registration authority computer is operated by or on behalf of an acquirer bank that manages a financial account associated with the token requestor, the token requestor being a merchant, the certificate signing request being received in an authorization request message conforming to an ISO 8583 transaction message format;
in response to receiving the certificate signing request, authenticating, by the registration authority computer based on executing a know-your-customer process, the token requestor associated with the token requestor computer utilizing data associated with the financial account;
in response to authenticating the token requestor by the registration authority computer utilizing data associated with the financial account, transmitting, by the registration authority computer to a certificate authority computer, a modified certificate signing request comprising an identifier associated with the registration authority computer, the modified certificate signing request being transmitted in the authorization request message, the certificate authority computer being operated by an entity different from the acquirer bank, wherein transmitting the modified certificate signing request to the certificate authority computer causes the certificate authority computer to:
verify the registration authority computer authenticated the token requestor based at least in part on determining that the identifier associated with the registration authority computer is included in the modified certificate signing request;
in response to verifying the registration authority computer authenticated the token requestor, generate a token requestor identifier (ID) for the token requestor; and
store a mapping between a token requestor ID and a public key generated by and received from the token requestor computer;

receiving, by the registration authority computer from the certificate authority computer, the token requestor ID for the token requestor;
transmitting, by the registration authority computer, the token requestor ID to the token requestor computer;
receiving, by a transport computer, a subsequent authorization request message comprising a payment token obtained by the token requestor utilizing the token requestor ID, the payment token being provided in lieu of payment data, the subsequent authorization request message comprising an amount for a payment transaction; and
transmitting, by the transport computer to a token provider computer, the subsequent authorization request message comprising the payment token, wherein transmitting the subsequent authorization request message comprising the payment token to the token provider computer causes the token provider computer to replace the payment token in the subsequent authorization request message with the payment data prior to transmitting the subsequent authorization request message to an authorization computer.

2. The computer-implemented method of claim 1 , wherein the token requestor ID is generated by the certificate authority computer in response to receiving the certificate signing request from the registration authority computer.

3. The computer-implemented method of claim 1 , further comprising:
receiving, by the registration authority computer, a token provisioning request message, the token provisioning request message comprising a digital signature generated by the token requestor computer utilizing the token requestor ID generated by the certificate authority computer;
transmitting, by the registration authority computer the token provisioning request message to the token provider computer, wherein transmitting the token provisioning request messages causes the token provider computer to retrieve the public key associated with the token requestor ID using the mapping and to verify the digital signature using the public key;
in response to transmitting the token provisioning request message, receiving, by the registration authority computer from the token provider computer, the payment token provisioned to the token requestor by the token provider computer; and
transmitting the payment token to the token requestor computer, wherein transmitting the payment token to the token requestor computer causes the token requestor computer to transmit the subsequent authorization request message including the payment token.

4. The computer-implemented method of claim 3 , wherein the token provisioning request message comprises a digital signature generated by the token requestor computer, the digital signature being generated based on the token requestor ID, an identifier associated with registration authority computer, an identifier associated with the token requestor, a terminal identifier, a time stamp, a message counter, and a private encryption key associated with the token requestor.

5. The computer-implemented method of claim 1 , further comprising:
notifying the authorization computer that the payment token has been provisioned to the token requestor, the authorization computer being associated with an issuer corresponding to the payment data.

6. The computer-implemented method of claim 4 , wherein transmitting the token provisioning request message to the token provider computer causes the token provider computer to decrypt the digital signature to generate decrypted information and compare the decrypted information against one or more data fields of the token provisioning request message.

7. The computer-implemented method of claim 3 , further comprising:
receiving, by the transport computer, an authorization response message corresponding to the authorization request message; and
transmitting, by the transport computer to the token requestor computer, the authorization response message.

8. A system comprising a registration authority computer and a transport computer, the registration authority computer and the transport computer individually comprising:
a processor; and
a computer readable medium, the computer readable medium comprising code, executable by the processor, for implementing a method comprising:
receiving, by the registration authority computer, a certificate signing request from a token requestor computer, the token requestor computer being associated with merchant having a financial account that is managed by the registration authority computer on behalf of the merchant, the registration authority computer being an acquirer bank, the certificate signing request being received in an authorization request message conforming to an ISO 8583 transaction message format;
in response to receiving the certificate signing request, authenticating, by the registration authority computer based on executing a know-your-customer process, a token requestor associated with the token requestor computer based at least in part on the certificate signing request and utilizing data associated with the financial account;
in response to authenticating the token requestor by the registration authority computer utilizing data associated with the financial account, transmitting, by the registration authority computer to a certificate authority computer, a modified certificate signing request comprising an identifier associated with the registration authority computer, the modified certificate signing request being transmitted in the authorization request message, the certificate authority computer being operated by an entity different from the acquirer bank, wherein transmitting the modified certificate signing request to the certificate authority computer causes the certificate a

Assignees

• Visa Int Service Ass

Inventors

• Law Simon
• Wagner Kim R

Classifications

• G06Q20/3674

  involving authentication · CPC title

• H04L63/0807 Primary

  using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213) · CPC title

• G06Q20/38215

  Use of certificates or encrypted proofs of transaction rights · CPC title

• G06Q20/3825

  Use of electronic signatures · CPC title

• H04L9/3268

  using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL] · CPC title