Location-Matched Transaction Tokens for Presence Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Users are hesitant to share sensitive information during transactions due to security concerns, and existing authentication methods fail to verify the authorized user's presence at the resource provider, leading to potential fraud.
Innovation Solution
A method and system that utilize a token server to generate and manage tokens for transactions, where the user's location is verified using a communication device to ensure proximity to the resource provider, thereby authenticating the user without exposing sensitive information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If users share sensitive information with resource providers to conduct transactions, then transaction capability is improved, but security risk increases
Solution Approach 1:
The patent introduces a token as an intermediary that replaces sensitive information (PAN, CVV, expiration date) in transaction communications. The token server acts as a mediator between the user device and resource provider, generating tokens that enable transactions without exposing actual sensitive data. This resolves the contradiction by maintaining transaction capability while eliminating security risks associated with sharing sensitive information.
Solution Approach 2:
The patent creates a token copy that represents the sensitive information without being the actual sensitive data. The token is a substitute representation that functions identically to the original sensitive information for transaction purposes but cannot be reverse-engineered to reveal the underlying sensitive data. This copying approach allows transactions to proceed while protecting the original sensitive information from exposure.
2Reliability
If authentication systems verify user presence at resource provider, then fraud prevention is improved, but system complexity increases
Solution Approach 1:
The patent implements location-based authentication where the user's mobile device automatically provides location information to verify presence at the resource provider. The system leverages existing GPS and network location capabilities of smartphones, requiring no additional hardware or complex authentication mechanisms. The user simply needs to have their device with them, and the system automatically verifies location through standard device functions, maintaining low complexity while improving fraud prevention.
Data Source
AI summary
A method is disclosed. The method includes receiving, by a token server from an application provider computer, a request to obtain a token for a transaction. The request to obtain the token comprising sensitive information and a transaction identifier. The method further includes retrieving, by the token server, the token, and receiving, by the token server from a resource provider computer, a request for the token, the request for the token comprising the transaction identifier. The method also includes providing, by the token server to the resource provider computer, the token.