Systems and methods for communicating token attributes associated with a token vault

Patent metadata

Field	Value
Publication number	US-9996835-B2
Application number	US-201414340464-A
Country	US
Kind code	B2
Filing date	Jul 24, 2014
Priority date	Jul 24, 2013
Publication date	Jun 12, 2018
Grant date	Jun 12, 2018

Abstract

Systems and methods for interoperable network token processing are provided. A network token system provides a platform that can be leveraged by external entities (e.g., third party wallets, e-commerce merchants, payment enablers/payment service providers, etc.) or internal payment processing network systems that have the need to use the tokens to facilitate payment transactions. A token registry vault can provide interfaces for various token requestors (e.g., mobile device, issuers, merchants, mobile wallet providers, etc.), merchants, acquirers, issuers, and payment processing network systems to request generation, use and management of tokens. The network token system further provides services such as card registration, token generation, token issuance, token authentication and activation, token exchange, and token life-cycle management.

First claim

What is claimed is:

1. A server computer for use in a payment processing system, the payment processing system comprising at least two entities operating at least two entity computers, where the at least two entities are capable of processing different parts of a single payment transaction, the server computer comprising:
a) a processor;
b) a non-transitory computer readable medium comprising code that, when executed by the processor, cause the processor to:
receive, over a first communications network, a first message from a token requestor via a first communication interface, wherein the server computer is configured to communicate with each entity in the payment processing system via a dedicated communication interface;
analyze the first message;
determine that the first message includes a request for a token;
determine a first token, wherein the first token is a substitute for a primary account identifier;
transmit, over the first communications network, the first token to a consumer device via the token requestor;
receive, over a second communications network from an entity in the payment processing system via a second communication interface, a second message comprising the first token and a token inquiry request associated with the first token in response to the entity receiving an authorization request message from a merchant computer during a transaction initiated using the first token, wherein the entity is different from a merchant associated with the merchant computer and is different from the token requestor;
analyze the second message;
determine that the second message includes the first token;
determine token attributes associated with the first token in response to analyzing the second message, wherein a token attribute represents a feature of or information about a token;
determine an identity of the entity based on at least a communication format of the second communication interface;
when the entity is identified to be an acquirer computer:
determine one or more permissions associated with the acquirer computer;
determine that the acquirer computer is authorized to obtain a subset of the determined token attributes based on the determined one or more permissions associated with the acquirer computer; and
transmit, to the acquirer computer over the second communications network, a reply message in response to the second message, the reply message including the subset of the determined token attributes that indicate whether the authorization request message is valid to be forwarded to a recipient computer in the payment processing system by the acquirer computer;

when the entity is identified to be an issuer computer:
determine one or more permissions associated with the issuer computer;
determine that the issuer computer is authorized to obtain the determined token attributes based on the determined one or more permissions associated with the issuer computer; and
transmit to the issuer computer over the second communications network, a reply message in response to the second message, the reply message including the determined token attributes that control authorization of the transaction identified in the authorization request message by the issuer computer.

2. The server computer of claim 1 , wherein the second message includes at least one of a token validation request, a token management request, or a token exchange request.

3. The server computer of claim 1 , wherein the first message comprises the primary account identifier, authentication data, and a token requestor identifier, and wherein the first token is transmitted to the token requestor in a token response message, which also comprises a token assurance level code.

4. The server computer of claim 2 , wherein the second message includes the token validation request, wherein the token validation request includes transaction data, and wherein determining the token attributes further comprises searching a token database for transaction restrictions associated with the first token in response to receiving the second message, wherein the token attributes include the transaction restrictions.

5. The server computer of claim 2 , wherein when the entity is identified to be the issuer computer, the second message includes the token management request, the token management request including instructions to activate, de-activate, or update the first token, wherein the token attributes include a status of the first token.

6. The server computer of claim 5 , wherein the token management request includes instructions to update the first token, wherein the instructions to update the first token includes an updated real account identifier associated with the first token, and wherein the server computer updates a token record to include the real updated account identifier associated with the first token in response to analyzing the second message.

7. The server computer of claim 2 , wherein determining the token attributes further comprises searching a token database for a token record associated with the received first token in response to analyzing the second message, determining authorized information from the token record for the identified entity, and wherein the token attributes include the authorized information from the token record.

8. The server computer of claim 1 , wherein the code when executed by the processor, further cause the processor to, after transmitting the determined token attributes to the identified entity:
receive the first token from a payment processing network computer during processing of the transaction;
retrieve the primary account number associated with the first token; and
transmit the primary account number to the payment processing network computer for processing the transaction.

9. A system comprising:
a server computer for use in a payment processing system, the payment processing system comprising at least two entities operating at least two entity computers, where the at least two entities are capable of processing different parts of a single payment transaction, the server computer comprising
a) a processor,
b) a non-transitory computer readable medium comprising code that, when executed by the processor, cause the processor to
receive, over a first communications network, a first message from a first token requestor via a first communication interface, wherein the server computer is configured to communicate with each entity in the payment processing system via a dedicated communication interface,
analyze the first message,
determine that the first message includes a request for a token,
determine a first token, wherein the first token is a substitute for a primary account identifier,
transmit, over the first communications network, the first token to a consumer device via the token requestor;
receive, over a second communications network from an entity in the payment processing system via a second communication interface, a second message comprising the first token and a token inquiry request associated with the first token in response to the entity receiving an authorization request message from a merchant computer during a transaction initiated using the first token, wherein the entity is different from a merchant associated with the merchant computer and is different from the token requestor;
analyze the second message;
determine that the second message includes the first token;
determine token attributes associated with the first token in response to analyzing the second message, wherein a token attribute represents a feature of or information about a token;
determine an identity of the entity based on at least a communication format of the second communication interface;
when the entity

Assignees

• Visa Int Service Ass

Inventors

• Dill Matthew
• Narayan Prasanna L
• Powell Glenn
• Sheets John
• Carpenter Andrew

Classifications

• G06Q20/4016

  involving fraud or risk level assessment in transaction processing · CPC title

• H04L2209/42

  Anonymization, e.g. involving pseudonyms · CPC title

• G06Q20/385 Primary

  using an alias or single-use codes · CPC title

• G06Q20/40 Primary

  Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists · CPC title

• H04L2209/56

  Financial cryptography, e.g. electronic payment or e-cash · CPC title