Tokenization in mobile environments

Patent metadata

Field	Value
Publication number	US-9697518-B2
Application number	US-201615344986-A
Country	US
Kind code	B2
Filing date	Nov 7, 2016
Priority date	Feb 10, 2012
Publication date	Jul 4, 2017
Grant date	Jul 4, 2017

Abstract

Data can be protected in mobile and payment environments through various tokenization operations. A mobile device can tokenize communication data based on device information and session information associated with the mobile device. A payment terminal can tokenize payment information received at the payment terminal during a transaction based on transaction information associated with the transaction. Payment data tokenized first a first set of token tables and according to a first set of tokenization parameters by a first payment entity can be detokenized or re-tokenized with a second set of token tables and according to a second set of tokenization parameters. Payment information can be tokenized and sent to a mobile device as a token card based on one or more selected use rules, and a user can request a transaction based on the token card. The transaction can be authorized if the transaction satisfies the selected use rules.

First claim

What is claimed is:

1. A method for tokenizing data, comprising:
receiving, at a central security system communicatively coupled to each of a plurality of mobile devices via a network, information to be tokenized and a use rule selection specifying one or more use rules, wherein the central security system is configured to:
identify based on the specified use rules a token table from a plurality of token tables each mapping a different token value to each of a plurality of input values;
tokenize the received information using the identified token table by querying the identified token table with a portion of the received information to identify a token value mapped to a value of the portion of the received information and replacing the portion of the received information with the identified token value to generate a token card; and
transmit the token card to a mobile device;

receiving, at the mobile device, the token card from the central security system;
receiving, at the mobile device, a request to use the token card in an interaction with a user of the mobile device;
transmitting, by the mobile device, the token card to a central processing system, wherein the central processing system is configured to:
identify the token table used to generate the token card;
identify the specified use rules based on the identified token table;
determine if the identified use rules are satisfied by the interaction;
responsive to a determination that the use rules are satisfied by the interaction, detokenize the token card using the identified token table by querying the identified token table with the identified token value to identify the input value mapped to the identified token value by the identified token table and replacing the identified token value with the identified input value to produce a detokenized token card; and
transmit the detokenized token card to the network associated with the interaction and communicatively coupled to the central processing system.

2. The method of claim 1 , wherein the received information is associated with a user account.

3. The method of claim 1 , wherein the received information is associated with an identity of the user.

4. The method of claim 1 , wherein the received information is associated with the interaction.

5. The method of claim 1 , wherein the specified use rules comprise a rule specifying a geographic region.

6. The method of claim 1 , wherein the specified use rules comprise a rule specifying a business.

7. The method of claim 1 , wherein identifying a token table associated with the specified use rules comprises identifying a token table storing the specified use rules in a metadata field of the token table.

8. The method of claim 1 , wherein identifying a token table associated with the specified use rules comprises querying a use rules table mapping use rules to associated token tables with the selected use rules to identify a token table associated with the specified use rules.

9. The method of claim 1 , wherein the mobile device is configured to:
store a plurality of token cards;
in response to receiving a request to use a token card in an interaction, display a representation of one or more of the stored plurality of token cards; and
receive a selection of a displayed representation of a token card.

10. The method of claim 9 , wherein each displayed representation of a stored token card comprises a display of description text associated with the token card entered by a user at the central security system.

11. The method of claim 1 , wherein identifying the token table used to generate the token card comprises querying stored token tables to identify a token table including the token card as a token.

12. The method of claim 1 , wherein identifying the token table used to generate the token card comprises querying, by the central processing system, the central security system with the token card to identify token table including the token card as a token.

13. The method of claim 1 , wherein identifying the use rules associated with the identified token table comprises querying a metadata field of the identified token table storing use rules associated with the identified token table.

14. The method of claim 1 , wherein identifying the use rules associated with the identified token table comprises querying a use rules table mapping use rules to associated token tables with an identifier for the identified token table.

15. The method of claim 1 , wherein determining if the identified use rules are satisfied by the interaction comprises, for each use rule:
identifying an interaction restriction associated with each use rule; and
determining if the interaction exceeds the interaction restriction.

16. The method of claim 1 , wherein the network is configured to authorize the interaction.

17. The method of claim 16 , wherein authorizing the interaction comprises:
sending, from the network, an authorization request to the mobile device;
receiving, at the mobile device, an authorization in response to the authorization request; and
sending, from the mobile device, the authorization to the network.

18. The method of claim 17 , wherein receiving an authorization comprises receiving user credentials at the mobile device.

19. A method for tokenizing data, comprising:
receiving, at a central security system communicatively coupled to each of a plurality of mobile devices via a network, information to be tokenized and a use rule selection specifying one or more use rules;
identifying, by the central security system, based on the specified use rules a token table from a plurality of token tables each mapping a different token value to each of a plurality of input values;
tokenizing, by the central security system, the received information using the identified token table by querying the identified token table with a portion of the received information to identify a token value mapped to a value of the portion of the received information and replacing the portion of the received information with the identified token value to generate a token card; and
transmitting, by the central security system, the token card to a mobile device, the mobile device configured to:
receive the token card from the central security system;
receive a request to use the token card in an interaction with a user of the mobile device; and
transmit the token card to a central processing system configured to:
responsive to a determination that the use rules are satisfied by the interaction, detokenize the token card using the identified token table by querying the identified token table with the identified token value to identify the input value mapped to the identified token value by the identified token table and replacing the identified token value with the identified input value to produce a detokenized token card; and
transmit the detokenized token card to the network associated with the interaction and communicatively coupled to the central processing system.

20. A method for tokenizing data, comprising:
receiving, at a central processing system from a mobile device, a token card, the token card generated by a central security system communicatively coupled to the mobile device and one or more additional mobile devices, the central security system configured to:
receive information to be tokenized and a use rule selection specifying one or more use rules;
identify based on the specified use rules a token table from a plurality of token tables each mapping a differe

Assignees

• Protegrity Corp

Inventors

• Mattsson Ulf
• Rozenberg Yigal

Classifications

• G06Q20/20 Primary

  Point-of-sale [POS] network systems · CPC title

• H04W12/02

  Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII] · CPC title

• G06Q20/322

  Aspects of commerce using mobile devices [M-devices] · CPC title

• G06Q20/385 Primary

  using an alias or single-use codes · CPC title

• G06F21/606

  by securing the transmission between two devices or processes · CPC title