Configurable Payment Tokens for Secure Online Transactions
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing payment systems face challenges in providing a seamless and secure online shopping experience for merchants, particularly in handling multiple payment types and avoiding PCI DSS compliance issues, while also protecting against identity theft.
Innovation Solution
The implementation of customizable payment tokens, which can vary in length and character set, including letters and numbers, generated using a random number generator, allowing merchants to create tokens that are not mathematically related to the original payment account numbers, enabling secure storage and presentation without exposing sensitive information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If merchants use standard payment card formats (16-digit numbers), then payment processing is simplified and compatible with existing systems, but security is reduced because intercepted data is easily recognizable as payment information
Solution Approach 1:
The patent changes the parameters of payment token representation by allowing variable lengths (not fixed at 16 digits) and flexible character sets (including letters and numbers). This transformation makes intercepted data less recognizable as traditional payment information while maintaining functional equivalence through mapping to actual card numbers via Luhn algorithm validation.
2Ease of operation
If merchants collect and store customers' credit card numbers directly, then the payment process is straightforward and customers can see their card information, but PCI DSS compliance burden increases and security risk increases
Solution Approach 1:
The patent creates simplified copies of payment card numbers in the form of tokens that resemble but are not identical to actual card numbers. These token copies can be displayed to customers and processed by merchants without requiring the merchant to handle or store the real sensitive payment information, thus reducing PCI DSS compliance requirements.
Solution Approach 2:
The patent introduces tokens as an intermediary between the customer's actual payment card information and the merchant's payment processing system. The tokens serve as a safe mediator that carries the necessary payment functionality while protecting the underlying sensitive data from exposure to the merchant environment.
3Device complexity
If merchants use third-party hosted order pages for payment collection, then PCI DSS compliance is simplified, but user experience deteriorates due to redirects and loss of seamless interface
Solution Approach 1:
The patent enables merchants to display tokenized versions of payment information directly on their own hosted order pages. These token copies allow the merchant to maintain control of the user interface and provide a seamless experience without redirecting customers to third-party pages, while still avoiding PCI DSS compliance issues by not handling real card numbers.
4Reliability
If payment tokens use fixed 16-digit numeric format, then compatibility with existing payment systems is maintained, but security is reduced because the format is easily identifiable as payment card data
Solution Approach 1:
The patent changes the format parameters of payment tokens by allowing variable lengths and incorporating letters along with numbers. This creates a more secure representation that is less easily identifiable as traditional payment card data, while maintaining functional compatibility through systematic mapping to actual card numbers using validation algorithms like Luhn.
Data Source
AI summary
Methods and systems are disclosed for the generation and use of merchant-customizable token formats that define tokens that represent credit card and other payment numbers in online transactions. The tokens, which are used instead of the card numbers themselves for security, can be specified by the token format to have a certain number of characters, have certain fields reserved for major card identifiers, use encryption and/or randomization, be alphanumeric, and have other formatting. The customized tokens can be used with legacy equipment that uses longer or shorter card numbers than the standard sixteen-digit payment card number format and can be less likely to be recognized as related to card numbers by identify thieves.