Payment Authorization Translation with Dual-Key Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security measures for protecting financial account data, such as encrypting a personal identification number (PIN), leave sensitive data like the primary account number (PAN) exposed, and require different key management schemes, increasing the burden on merchants.
Innovation Solution
A method and system for encrypting a PIN and sensitive data using different encryption key variants based on an initial key, with a secure module decrypting and re-encrypting the data for different payment processing networks, ensuring compliance with PCI DSS standards and maintaining data security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If encryption key variants are used for different data types (PIN and sensitive data), then data security is improved, but device complexity and key management burden increase
Solution Approach 1:
The patent segments the encryption key into multiple variants (first encryption key variant for PIN, second encryption key variant for sensitive data) derived from a master key. This allows different data types to be encrypted with appropriate keys while maintaining a structured key management approach through the master key hierarchy.
Solution Approach 2:
The patent performs preliminary key derivation by generating multiple encryption key variants from a master key before data encryption occurs. This preliminary action establishes the key structure in advance, reducing the operational complexity of key management during transaction processing.
2Adaptability or versatility
If multiple payment processing networks are supported with different encryption schemes, then adaptability is improved, but device complexity increases
Solution Approach 1:
The patent implements a universal encryption framework where a single master key can generate multiple encryption key variants that are compatible with different payment processing networks. The secure module serves multiple functions by supporting both encrypted data transmission and network routing decisions, reducing the need for separate encryption implementations for each network.
Solution Approach 2:
The patent changes encryption parameters (selecting different encryption key variants) based on the routing destination of the authorization request. When data needs to be sent to a specific payment processing network, the system selects the appropriate encryption key variant, allowing adaptability to different networks without requiring fundamentally different encryption systems.
3Reliability
If encryption is applied to all data, then data protection is improved, but processing time increases
Solution Approach 1:
The patent applies encryption locally and selectively - encrypting PIN data with the first encryption key variant and sensitive data with the second encryption key variant. Not all data is encrypted uniformly, but only the portions that require protection, which reduces the overall processing time compared to encrypting every data element.
Solution Approach 2:
The patent applies partial encryption to the extent necessary for security - encrypting only the PIN and sensitive data fields rather than all transaction data. This partial action provides adequate protection while minimizing the processing overhead associated with full encryption of every data element.
Data Source
AI summary
Systems and methods are disclosed in which data associated with a transaction are protected with encryption. At an access device, a PIN associated with a payment account may be encrypted with a first key derived from an initial key of the access device and sensitive data associated with the payment account may be encrypted with a second key derived from the initial key. At a secure module associated with a host server encrypted sensitive data of an authorization request message may be decrypted. The secure module associated with the host server can re-encrypt the sensitive data using a zone encryption key associated with a payment processing network. A translated authorization request message including the re-encrypted sensitive data can be transmitted by the merchant server to the payment processing network.