Encrypted Account Information Messaging Without PCI Data Storage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems for transmitting payment card information across distributed computing systems face high computing resource costs, maintenance costs, and security risks due to the need for storing Payment Card Industry (PCI) data, which is subject to stringent security standards and regulations.
Innovation Solution
A system and method for secure transmission of account information messages that encrypt sensitive details, allowing partners to access necessary information without storing PCI data, using a service provider to generate and transmit encrypted messages.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If PCI data is stored by partners across distributed systems, then payment information can be accessed and transmitted, but security risks increase and compliance burden increases
Solution Approach 1:
The patent extracts PCI data from the partner systems and stores it exclusively in a secure data store controlled by the service provider. This extraction eliminates the security risks associated with partners storing sensitive payment information while maintaining the ability to transmit payment information across distributed systems. The service provider becomes the sole custodian of PCI data, reducing compliance burden on partners.
Solution Approach 2:
The service provider acts as an intermediary between partners and the secure data store. Partners request payment information through the service provider, which retrieves encrypted data from the secure data store, decrypts it in a controlled environment, and transmits only necessary information to partners. This intermediary role eliminates the need for partners to directly store or handle PCI data while maintaining system productivity.
2Adaptability or versatility
If PCI data is stored by multiple partners, then payment information can be accessed across distributed systems, but compliance with PCI standards becomes onerous
Solution Approach 1:
The patent extracts the compliance burden from multiple partner systems and centralizes it at the service provider. By storing PCI data exclusively in a service provider-controlled secure data store, only the service provider needs to maintain PCI compliance rather than multiple partners. This extraction dramatically reduces compliance complexity while maintaining adaptability across distributed payment platforms.
Solution Approach 2:
The service provider implements a universal solution that serves multiple partners across different distributed systems. The secure data store and service provider infrastructure provide a single compliant platform that enables all partners to access payment information without each partner needing to implement their own PCI-compliant storage and transmission mechanisms.
3Reliability
If encrypted messages are generated and transmitted through a service provider, then security is improved, but system complexity increases
Solution Approach 1:
The service provider serves as an intermediary that manages encryption and decryption operations. Partners send requests to the service provider, which handles the complex cryptographic operations by retrieving encrypted data from the secure data store, decrypting it in a controlled environment, and transmitting results to partners. This intermediary approach improves security while containing complexity within the service provider infrastructure rather than distributing it across all partners.
Solution Approach 2:
The patent extracts the cryptographic complexity from partner systems and centralizes it at the service provider. By removing encryption and decryption operations from partner systems and consolidating them at the service provider, the overall system security is improved while the complexity burden is concentrated in a single controlled location rather than distributed across multiple systems.
Data Source
AI summary
Systems and methods are disclosed for secure transmission of account information messages. One method comprises receiving account information; providing a notification to a third party regarding the account information; receiving a first request for information regarding the notification from the third party; providing a response to the third party regarding the first request; receiving data from the third party; using the data to generate a message including details about the account, wherein at least some of the details about the account are encrypted; receiving a second request for information regarding the notification from the third party; and providing the message to the third party.