Payment Credential Digitization via Personalization Script Segmentation

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing payment credential digitization processes require issuers to relinquish control over sensitive information, such as master keys, to digitization entities, violating on-soil data requirements and compromising security.

Innovation Solution

A system where the issuer maintains control over sensitive information by generating a personalization script, which is used by a digitization entity to tokenize payment information for mobile devices without accessing issuer master keys, allowing secure and compliant digitization across multiple entities.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Productivity

If the digitization entity performs digitization on behalf of the issuer by accessing issuer master keys, then the digitization process can be efficiently performed, but the issuer loses control over sensitive information and on-soil data requirements are violated

Engineering Contradiction:

Improvedigitization process efficiencyVSAvoidissuer control over sensitive information

Core Design Contradiction:

ProductivityVSReliability

Solution Approach 1:

The digitization process is segmented into two independent parts: (1) the digitization entity performs tokenization of payment credentials without accessing issuer master keys, and (2) the issuer separately provides personalization scripts that instruct how to use the tokenized data. This segmentation allows the digitization entity to operate efficiently while the issuer maintains control over sensitive master keys, resolving the contradiction between productivity and reliability.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The personalization script acts as an intermediary mechanism between the issuer and the digitization entity. The script contains instructions for using tokenized payment data without requiring the digitization entity to access issuer master keys. This intermediary allows efficient digitization while preserving issuer control and satisfying on-soil data requirements.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Ease of manufacture

If the issuer provides sensitive information such as master keys to the digitization entity, then the digitization process can be performed, but security is compromised and on-soil data requirements are violated

Engineering Contradiction:

Improvedigitization process feasibilityVSAvoidsecurity risk from sensitive information exposure

Core Design Contradiction:

Ease of manufactureVSObject-affected harmful factors

Solution Approach 1:

The sensitive issuer master keys are extracted from the digitization process. Instead of providing master keys to the digitization entity, the system uses tokenized payment data combined with personalization scripts. This extraction eliminates the security risk of sensitive information exposure while maintaining the feasibility of the digitization process.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The system creates a copy of the necessary functionality through tokenization rather than using the original sensitive master keys. The personalization script provides the necessary instructions to work with tokenized data, achieving the same digitization functionality without exposing sensitive information, thus resolving the contradiction between ease of manufacture and security.

Inventive Principle:

Principle #26Copying

3Device complexity

If a single entity performs the complete digitization process, then the process is simple to implement, but the issuer must relinquish control over sensitive information

Engineering Contradiction:

Improvedigitization process structureVSAvoidissuer control over sensitive information

Core Design Contradiction:

Device complexityVSReliability

Solution Approach 1:

The digitization process is divided into two segments: the digitization entity handles tokenization (simple and efficient), while the issuer handles personalization script provision (maintaining control). This segmentation maintains relative simplicity while ensuring the issuer retains control over sensitive information, resolving the contradiction between device complexity and reliability.

Inventive Principle:

Principle #1Segmentation

Data Source

PatentUS12008562B2External payment credential digitization

Publication Date: 2024.06.11 MASTERCARD INT INC

AI summary

Provided are a system and method for distributing the digitization of a payment credential to an entity that does not have access to issuer master keys. In one example, the method includes receiving a personalization script for a payment credential, the personalization script generated by an issuer of the payment credential, generating tokenized payment information for the payment credential based on the received personalization script, wherein the tokenized payment information is generated by the digitization entity without having access to issuer master keys (IMKs) of the issuer of the payment credential, and transmitting the tokenized payment information for the payment credential to a digital wallet executing on a user device.