System and method for token domain control

Patent metadata

Field	Value
Publication number	US-9848052-B2
Application number	US-201514704571-A
Country	US
Kind code	B2
Filing date	May 5, 2015
Priority date	May 5, 2014
Publication date	Dec 19, 2017
Grant date	Dec 19, 2017

Abstract

A method for providing a token code in conjunction with a value token is disclosed. The token code serves as a shared secret for authenticating the use of the value token. Multiple token holders can possess the same value token, but each token holder may have a different token code for use with the value token.

First claim

What is claimed is:

1. A method comprising:
receiving, by a processor in a token service computer, a first token request from a first token requestor computer, wherein the first token request includes a payment account number and a first domain identifier;
identifying, by the processor in the token service computer, a payment token associated with the payment account number;
generating, by the processor in the token service computer, a first token code associated with the payment token;
assigning, by the processor in the token service computer, the payment token and the first token code to the first domain identifier, such that the first token code is specific to a first domain associated with the first domain identifier;
providing, by the processor in the token service computer, the payment token and the first token code to the first token requestor computer, wherein the first token requestor subsequently uses the payment token in place of the payment account number for a first payment transaction, and wherein the first token requestor's subsequent use of the payment token is valid if the payment token is accompanied by the first token code and used within the first domain;
receiving, by the processor in the token service computer, a second token request from a second token requestor computer, wherein the second token request includes the payment account number and a second domain identifier, wherein the payment account number received in the second token request is the same as the payment account number received in the first token request;
identifying, by the processor in the token service computer, the payment token associated with the payment account number;
generating, by the processor in the token service computer, a second token code associated with the payment token, wherein the second token code is different than the first token code, and wherein the second token code and the first token code are both associated with the same payment token;
assigning, by the processor in the token service computer, the payment token and the second token code to the second domain identifier, such that the second token code is specific to a second domain associated with the second domain identifier, wherein the first domain identifier is different than the second domain identifier, and wherein the first domain is different than the second domain; and
providing, by the processor in the token service computer, the payment token and the second token code to the second token requestor computer, wherein the second token requestor subsequently uses the payment token in place of the payment account number for a second payment transaction, wherein the second token requestor's subsequent use of the payment token is valid if the payment token is accompanied by the second token code and used within the second domain.

2. The method of claim 1 , wherein the first token code is a first hexadecimal value and the second token code is a second hexadecimal value.

3. The method of claim 1 , wherein the first domain includes e-commerce payment transactions and wherein the second domain includes in-person payment transactions.

4. The method of claim 1 , wherein the first token requestor computer is a merchant computer, wherein the payment account number is associated with a user, and wherein the merchant computer stores the payment token and the first token code on behalf of the user, wherein the first domain identifier is associated with the merchant computer, and wherein the first domain includes transactions associated with the merchant computer.

5. The method of claim 1 , wherein the first token requestor computer is a mobile device, wherein the mobile device is associated with a user, and wherein the payment account number is associated with the user, wherein the first domain identifier is associated with the mobile device, and wherein the first domain includes transactions associated with the mobile device.

6. The method of claim 1 , further comprising:
receiving, by the processor in the token service computer, a first authorization request message for the first payment transaction, the first authorization request message including the payment token, the first token code, and the first domain identifier;
determining, by the processor in the token service computer, that the first token code is associated with the payment token;
determining, by the processor in the token service computer, that the payment token and the first token code are assigned to the first domain identifier;
identifying, by the processor in the token service computer, the payment account number associated with the payment token;
adding, by the processor in the token service computer, the payment account number to the first authorization request message;
receiving, by the processor in the token service computer, a first authorization response message including the payment account number; and
replacing, by the processor in the token service computer, the payment account number with the payment token and the first token code in the first authorization response message.

7. The method of claim 1 , wherein the first token requestor's subsequent use of the payment token is valid if the payment token is accompanied by the first domain identifier, and wherein the second token requestor's subsequent use of the payment token is valid if the payment token is accompanied by the second domain identifier.

8. The method of claim 3 , wherein the first token requestor's subsequent use of the payment token is valid if the payment token is used for an e-commerce payment transaction, and wherein the second token requestor's subsequent use of the payment token is valid if the payment token is used for an in-person payment transaction.

9. The method of claim 1 , wherein the first domain includes payment transactions with a first merchant, wherein the first domain identifier includes a first merchant identifier, wherein the second domain includes payment transactions with a second merchant, and wherein the second domain identifier includes a second merchant identifier.

10. The method of claim 9 , wherein the first token requestor's subsequent use of the payment token is valid if the first token requestor is the first merchant, and wherein the second token requestor's subsequent use of the payment token is valid if the second token requestor is the second merchant.

11. The method of claim 9 , wherein the first token requestor's subsequent use of the payment token is valid if the payment token is accompanied by the first merchant identifier, and wherein the second token requestor's subsequent use of the payment token is valid if the payment token is accompanied by the second merchant identifier.

12. The method of claim 1 , wherein the first domain includes a contactless entry mode and wherein the second domain includes magnetic stripe entry mode.

13. A token service computer comprising:
a processor; and
a non-transitory computer readable medium, the non-transitory computer readable medium comprising code, that when executed by the processor, implementing a method comprising:
receiving a first token request from a first token requestor computer, wherein the first token request includes a payment account number and a first domain identifier;
identifying a payment token associated with the payment account number;
generating a first token code associated with the payment token;
assigning the payment token and the first token code to the first domain identifier, such that the first token code is specific to a first domain associated with the first domain identifier;
providing the payment token and the first token code to the f

Assignees

• Visa Int Service Ass

Inventors

• Kumnick Phillip

Classifications

• H04L67/10

  in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) · CPC title

• H04L67/02

  based on web technology, e.g. hypertext transfer protocol [HTTP] · CPC title

• H04L63/083

  using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226) · CPC title

• G06Q20/4016

  involving fraud or risk level assessment in transaction processing · CPC title

• H04L67/20 Primary

  Electricity · mapped topic