Cloud Payment Processing with Asymmetric Key Tokenization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional payment card-based transactions are vulnerable to unauthorized use since the cardholder may not be aware of transactions initiated with their lost or stolen card until reported, allowing multiple unauthorized transactions to occur before the issuer takes action.
Innovation Solution
A cloud-based electronic payment processing system that generates an asymmetric cryptographic key pair, providing a mobile device with one key and saving the other in a pending transaction database, encrypting a unique single-use payment number, and using it for transaction completion without revealing the financial account information, thus limiting unauthorized use.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the payment card account number is stored on the mobile device for payment transactions, then the payment processing is convenient and fast, but the security risk increases allowing unauthorized transactions with lost or stolen cards
Solution Approach 1:
The patent extracts the sensitive account number from the mobile device by using tokenization. The mobile device stores only a token (encrypted representation) of the account number, while the actual account number remains securely stored only in the secure element of the payment terminal. This allows the mobile device to process payments without containing the actual sensitive data, thus maintaining convenience while reducing security risk.
Solution Approach 2:
The patent introduces a token as an intermediary between the mobile device and the actual payment account. The token serves as a mediator that enables payment transactions without exposing the real account number. The token is encrypted and can only be decrypted by the payment terminal's secure element, creating a secure intermediary layer that protects against unauthorized transactions.
2Reliability
If the cardholder reports loss or theft of a payment card, then unauthorized use can be stopped, but multiple transactions may occur before the report is processed
Solution Approach 1:
The patent implements preliminary action by requiring cardholder verification (biometric authentication or PIN) before the mobile device can use the stored token for payment. This verification step is performed in advance of each transaction, ensuring that only the authorized cardholder can initiate payments. Additionally, the system can preliminarily suspend token usage when loss is reported, preventing any further transactions immediately without requiring time for manual processing.
Solution Approach 2:
The patent implements feedback mechanisms where the payment terminal and processing system continuously monitor and verify transaction requests. When a loss or theft is reported, the system provides immediate feedback by blocking the token, preventing any further unauthorized transactions. The real-time monitoring and verification system ensures that authorization decisions are made instantly based on current account status.
3Productivity
If the mobile device stores cryptographic keys for payment processing, then transaction speed is improved, but the security risk of key compromise increases
Solution Approach 1:
The patent extracts the cryptographic key storage function from the mobile device's general memory to a dedicated secure element or hardware security module. The private cryptographic key is stored exclusively in this secure element, which is isolated from the mobile device's main processor and memory. This allows fast transaction processing through the secure element while preventing key compromise through hardware-level security protections.
Solution Approach 2:
The patent uses the secure element as an intermediary between the mobile device's processing system and the actual cryptographic key storage. The secure element acts as a trusted mediator that performs cryptographic operations without exposing the private key to the mobile device's main system. This intermediary layer enables fast processing while maintaining key security through hardware-based protection.
Data Source
AI summary
A payment processing server generates an asymmetric cryptographic key pair, over one secure communications channel providing a mobile device with one cryptographic key of the cryptographic key pair, and saves another cryptographic key of the cryptographic key pair in a pending transaction database in unique association with a single-use payment number and a financial account. The server encrypts the payment number, which does not identify the financial account, with the another cryptographic key and provides the mobile device with the encrypted payment number over another secure communications channel distinct from the one secure communications channel. The server receives from a payment terminal a payment completion request that includes the encrypted payment number decrypted with the one cryptographic key. The payment processing server queries the pending transaction database with the decrypted payment number to identify the associated financial account, and effects completion of the transaction using the identified financial account.