Commerce Platform Encryption for Card-Not-Present Transactions
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing card not present transactions face inefficiencies and security vulnerabilities due to multiple communications and exposure of sensitive customer information in plaintext form, which can be intercepted during transaction processing.
Innovation Solution
Implementing a software development kit (SDK) that generates deterministic identifiers and encrypts customer payment information at the application layer, using transient encryption keys and tokenization to secure data exchange between customer and merchant systems, and processing it through a commerce platform server that maintains encrypted forms until decryption for PCI compliance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If card data is transmitted in plaintext form during transaction processing, then transaction processing speed is improved, but security is worsened as sensitive information can be intercepted by nefarious actors
Solution Approach 1:
The system performs preliminary encryption of card data at the point of data entry (customer device) before the data enters the transaction processing system. This encryption is done in advance, so that when the data is transmitted and processed subsequently, it remains encrypted throughout the entire transaction flow, eliminating the need to handle plaintext at intermediate stages while maintaining processing efficiency
Solution Approach 2:
The patent introduces an encryption layer as an intermediary between the customer device and the transaction processing system. This encryption mechanism acts as a mediator that transforms sensitive card data into encrypted form, allowing the transaction system to process the data without exposing the actual card information, thus securing the transmission while maintaining operational efficiency
2Reliability
If multiple communication steps are used to collect card information, track transaction processing, and process the transaction, then transaction security is improved through verification steps, but processing efficiency is worsened due to increased latency
Solution Approach 1:
The patent combines multiple communication steps into a single encrypted transaction message that is transmitted in one operation. Instead of separate communications for collecting card information, tracking processing, and completing the transaction, the system merges these functions into a unified encrypted message flow that maintains all necessary verification and tracking capabilities while eliminating the latency of multiple sequential communications
Solution Approach 2:
The system performs preliminary packaging and encryption of all necessary transaction information (card data, tracking information, processing instructions) into a single encrypted message before transmission. This preliminary consolidation ensures that all verification and processing steps can occur in sequence without requiring additional communication rounds, reducing overall processing time while maintaining security
3Reliability
If PCI compliance requirements are implemented for protecting sensitive card information, then security is improved, but implementation complexity is worsened
Solution Approach 1:
The patent extracts sensitive card information from the merchant's system environment entirely by encrypting it at the customer device before transmission. This extraction removes the burden of PCI compliance from the merchant's infrastructure, as the sensitive data never resides in plaintext on the merchant's servers or networks, thereby simplifying compliance implementation while maintaining strong protection
Solution Approach 2:
The encryption mechanism serves as an intermediary that isolates sensitive card data from the merchant's processing environment. By introducing this encryption layer, the system creates a security boundary that automatically satisfies PCI compliance requirements without requiring complex compliance infrastructure, policies, or procedures at the merchant level
Data Source
AI summary
A method and apparatus for processing a transaction between a merchant system and a customer system, the customer system associated with a customer of the merchant are described. The method may include receiving, at a commerce platform, a transaction request from the merchant system, wherein the transaction request is generated by the merchant system and comprises a card identifier and encrypted payment card data, wherein the card identifier is determined from card data for a payment card used in the transaction and the encrypted payment card data comprises at least an encryption of a payment account number. The method may also include decrypting, by the commerce platform, the encrypted payment card data using an encryption key selected based on the card identifier, the encryption key associated with the commerce platform. Furthermore, the method may include authorizing, by the commerce platform in communication with one or more authorization systems, the transaction using the decrypted payment card data.