Tokenization request via access device

Patent metadata

Field	Value
Publication number	US-11620643-B2
Application number	US-201514952444-A
Country	US
Kind code	B2
Filing date	Nov 25, 2015
Priority date	Nov 26, 2014
Publication date	Apr 4, 2023
Grant date	Apr 4, 2023

Abstract

Embodiments of the invention are directed to a method for submitting a tokenization request via an access device. Embodiments allow tokens to be retrieved for complex mobile devices as well as basic card-type devices. Token requests can be formatted as authorization request messages and transmitted along authorization communication channels.

First claim

What is claimed is:

1. A method comprising:
receiving, by a magnetic stripe reader in a point of sale terminal, a payment account number from a magnetic stripe on a magnetic stripe card in a payment transaction;
sending, by the point of sale terminal, a token request message including the payment account number to a token provider computer via a transport computer, a transaction processing computer, and an authorizing entity computer;
validating, by the token provider computer, the token request message;
creating, by the token provider computer, an association between a payment token and the payment account number;
sending, by the token provider computer, a token response message including the payment token to the point of sale terminal;
receiving, at the point of sale terminal, the token response message including the payment token from the token provider computer via the transport computer, the transaction processing computer, and the authorizing entity computer;
generating, by the point of sale terminal, an authorization request message comprising the payment token and an amount for the payment transaction;
submitting, by the point of sale terminal, the authorization request message including the payment token and the amount to the authorizing entity computer via the transport computer and the transaction processing computer for the payment transaction, wherein the token request message and the authorization request message are in the same format;
authorizing, by the authorizing entity computer, the payment transaction based on the payment token; and
in response to submitting the authorization request message, receiving, by the point of sale terminal, from the authorizing entity computer via the transport computer and the transaction processing computer, an authorization response message including an authorization result for the payment transaction.

2. The method of claim 1 , wherein the token request message is formatted as an ISO 8583 message.

3. The method of claim 1 , wherein the payment token is valid for 1 minute, 5 minutes, or 1 hour.

4. The method of claim 1 , wherein the payment account number is encrypted.

5. A system comprising:
a point of sale terminal comprising:
a magnetic stripe reader;
a first processor; and
a first non-transitory computer readable medium, storing executable instructions that when executed, cause the first processor to perform the steps of:
receiving a payment account number from a magnetic stripe on a magnetic stripe card in a payment transaction;
sending a token request message including the payment account number to a token provider computer via a transport computer, a transaction processing computer, and an authorizing entity computer;
receiving a token response message including a payment token associated with the payment account number from the token provider computer via the transport computer, the transaction processing computer, and the authorizing entity computer
generating an authorization request message comprising the payment token and an amount for the payment transaction;
submitting the authorization request message including the payment token and the amount to the authorizing entity computer via the transport computer and the transaction processing computer for the payment transaction, wherein the token request message and the authorization request message are in the same format; and
in response to submitting the authorization request message, receiving, from the authorizing entity computer via the transport computer and the transaction processing computer, an authorization response message including an authorization result for the payment transaction;

the token provider computer comprising:
a second processor; and
a second non-transitory computer readable medium, storing instructions that, when executed, cause the second processor to perform the steps of:
validating the token request message;
creating an association between the payment token and the payment account number; and
sending the token response message including the payment token to the point of sale terminal; and

the authorizing entity computer comprising:
a third processor; and
a third non-transitory computer readable medium, storing executable instructions that, when executed, cause the third processor to perform the steps of:
authorizing the payment transaction based on the payment token.

6. The point of sale terminal of claim 5 , wherein the point of sale terminal comprises a payment card reader.

7. The point of sale terminal of claim 5 ,
wherein the authorization response message indicates that the payment transaction is authorized, and further comprising:
storing a transaction record including the payment token, and not including the payment account number.

8. The method of claim 1 , the token request message having an ISO 8583 format, the authorization request message having an ISO 8583 message format, the token response message having an ISO 8583 format, and the authorization response message having an ISO 8583 message format.

9. The method of claim 1 , wherein the token request message and the authorization request message are both transmitted through the same communication channel.

10. The method of claim 9 , wherein the same communication channel is a payment transaction authorization communication channel that includes the transport computer and the transaction processing computer.

11. The method of claim 1 , wherein there is no wireless communication connectivity between the magnetic stripe card and the token provider computer.

12. The method of claim 1 , wherein the payment token is not sent over the air directly from the token provider computer to the magnetic stripe card.

13. The method of claim 1 , wherein the point of sale terminal is operated by a merchant and located at a physical store.

14. The method of claim 1 , wherein the token request message is in the format of an authorization request message, the token request message having a zero dollar amount in an authorization amount field.

15. The method of claim 1 , wherein the payment token is a substitute for the payment account number, wherein the authorization request message comprises the payment token in place of the payment account number, and wherein the authorization request message does not include the payment account number.

16. The method of claim 1 , wherein the authorization response message includes the payment token and does not include the payment account number.

17. The method of claim 1 , wherein the authorization request message is submitted to request authorization for the payment transaction.

18. The method of claim 1 , wherein the transaction processing computer includes data processing subsystems that deliver authorization services and clearing and settlement services.

19. The method of claim 13 , wherein the transport computer is associated with an acquirer that has a business relationship with the merchant.

20. The method of claim 1 , wherein the token request message is submitted to request the payment token, and is not submitted to request authorization for the payment transaction.

Assignees

• Visa Int Service Ass

Inventors

• Dimmick James

Classifications

• G06Q20/36 Primary

  using electronic wallets or electronic money safes · CPC title

• G06Q20/3674 Primary

  involving authentication · CPC title

• G06Q20/3226

  Use of secure elements separate from M-devices · CPC title

• G06Q20/425

  using two different networks, one for transaction and one for security confirmation · CPC title

• G06Q20/385

  using an alias or single-use codes · CPC title