Dynamic Payment Token Expiry for Intercepted Credential Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing e-commerce transactions lack sufficient security and convenience, particularly in the handling of payment tokens, as they often rely on static expiration dates and verification codes that can be intercepted and reused by malicious actors.
Innovation Solution
Implement a system where a payment services computer generates dynamic expiry data and a dynamic token verification code for each transaction, using cryptographic processes to ensure the security and uniqueness of payment credentials, which are transmitted to the user's device and included in the authorization request.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If static expiration dates and verification codes are used in payment transactions, then the system is simpler to operate, but security is compromised as these static elements can be intercepted and reused by malicious actors
Solution Approach 1:
The patent implements dynamic expiration dates and dynamic verification codes that change for each transaction or time period, replacing static credentials. This is achieved through servers that generate time-sensitive or transaction-specific credential elements, ensuring that intercepted credentials become invalid after use or expiration, thereby resolving the security vulnerability of static credentials while maintaining system operability
Solution Approach 2:
The patent changes the parameters of payment credentials by making expiration dates and verification codes variable rather than fixed. The expiration dates are dynamically adjusted based on transaction context, and verification codes are regenerated for each transaction attempt, transforming static credential parameters into dynamic ones that adapt to transaction requirements, thus improving security without fundamentally complicating the payment flow
2Reliability
If dynamic token verification codes are generated for each transaction, then security is enhanced by making intercepted tokens useless, but the complexity of the payment system increases
Solution Approach 1:
The patent introduces intermediary servers (credential generation servers, authentication servers) that handle the complexity of dynamic code generation and verification. These intermediaries manage the cryptographic operations and credential distribution, shielding end users from the complexity while ensuring secure dynamic credential usage. The intermediary layer absorbs the operational complexity while maintaining user-friendly transaction processes
Solution Approach 2:
The patent performs preliminary generation and distribution of dynamic verification codes before transactions occur. Credentials are pre-generated with embedded expiration logic and verification mechanisms, so that during the actual transaction, the dynamic elements are already in place and ready for use. This preliminary action reduces real-time complexity while maintaining security, as the heavy computational work is done in advance
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method includes receiving a request for payment credentials. The request indicates an account from which payment for a transaction is to be made. A payment token is looked-up that corresponds to the indicated account. Dynamic expiry data and a dynamic token verification code are generated. As a response to the request, the looked-up payment token, the generated dynamic expiry data and the generated dynamic token verification code are transmitted.