Gateway-Agnostic Tokenization for Edge-Decrypted Authorization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional resource exchange systems are vulnerable to credential fraud and suffer from increased latency and integration overhead due to the reliance on single gateway computers and token servers for detokenization.
Innovation Solution
Implementing gateway agnostic tokenization, which allows resource providers to route tokens to any gateway computer and uses edge computers for proxy re-encryption to decrypt credentials directly, eliminating the need for token servers during detokenization.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If a single gateway computer is used for routing credentials, then integration overhead is reduced, but system reliability deteriorates when the gateway fails
Solution Approach 1:
The patent segments the gateway function into multiple independent gateway computers (gateway1, gateway2, etc.). Each gateway can independently route credentials, eliminating the single point of failure. The resource provider computer can distribute credential routing across multiple gateways, maintaining system availability even when individual gateways fail.
Solution Approach 2:
The patent changes the parameter of gateway configuration from a single gateway to multiple gateways. By modifying the routing configuration to include multiple gateway endpoints, the system achieves both reduced integration overhead (through standardized multi-gateway protocols) and improved reliability (through redundancy).
2Reliability
If a token server is used for detokenization, then security is improved, but latency increases due to additional communication steps
Solution Approach 1:
The patent extracts the detokenization function from the centralized token server and places it directly in the gateway computer. The gateway computer now performs detokenization locally using stored token mapping data, eliminating the need for additional communication rounds with the token server and reducing authorization latency while maintaining security.
Solution Approach 2:
The patent implements preliminary action by pre-loading token mapping data into the gateway computer's memory before detokenization is needed. This allows the gateway to perform immediate detokenization operations without real-time communication with the token server, significantly reducing latency while maintaining security through controlled access to the mapping data.
3Adaptability or versatility
If credentials are routed through multiple network computers, then routing flexibility is improved, but fraud vulnerability increases due to interception risks
Solution Approach 1:
The patent uses tokenization to create a copy (token) that represents the sensitive credential. Instead of routing the actual credential through multiple network computers, the system routes tokens that are indistinguishable from the credentials but cannot be used for fraud if intercepted. The token can be freely routed through multiple gateways while the original credential remains protected.
Data Source
AI summary
Methods and systems for gateway agnostic tokenization are disclosed. Gateway agnostic tokenization enables a resource provider to quickly, safely, and efficiently route a token for authorization via any appropriate gateway computer. As part of an interaction with a user, a resource provider can transmit a token to an edge computer. The edge computer can then forward the token to a gateway computer. The gateway computer can identify a data item comprising two ciphertexts associated with the token. The edge computer and gateway computer can collectively decrypt the two ciphertexts to obtain a credential. The gateway computer can then forward the credential to an authorizing entity computer. The authorizing entity computer can then determine whether or not to authorize the interaction.