Private Label Account Tokenization for Retail Data Breach Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Retailer databases storing consumer private label credit account numbers are vulnerable to data breaches, leading to unauthorized access and exploitation of the stored information.
Innovation Solution
Generate and utilize authorization tokens that resemble credit card structures but do not include the actual account number, linking these tokens with the underlying credit account to track transactions and maintain security throughout the purchase life cycle, including authorization, settlement, and billing, while allowing retailers to store and manage purchase information without exposing the actual account number.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the retailer stores the actual private label credit account number in their database for returns and rewards tracking, then the retailer can easily track transactions and manage customer accounts, but the database becomes vulnerable to data breaches and unauthorized exploitation of account information
Solution Approach 1:
The patent introduces an authorization token as an intermediary element that replaces the actual credit account number in the retailer's database. This token contains sufficient information to authorize transactions and track purchases but does not reveal the sensitive account number. The token acts as a mediator between the payment system and the retailer's database, enabling transaction tracking while protecting the actual account information from storage and potential breaches.
Solution Approach 2:
The patent extracts the sensitive account number information from the data stored in the retailer's database. Instead of storing the complete account number, only a tokenized representation is retained. The actual account number is removed from the retailer's database environment, eliminating the vulnerability to data breaches while preserving the ability to track transactions through the token.
2Object-affected harmful factors
If the retailer does not store the actual account number but uses authorization tokens, then data security is improved, but the system complexity increases due to token generation and management requirements
Solution Approach 1:
The authorization token system is designed to be self-service in nature. The token is automatically generated by the payment processing system during the authorization process and returned to the retailer's database without requiring manual intervention. The token inherently contains all necessary information for transaction tracking and authorization, eliminating the need for complex external token management systems or additional infrastructure.
3Measurement precision
If the authorization token contains detailed transaction information, then accurate tracking of purchases and rewards is achieved, but the token size and processing requirements increase
Solution Approach 1:
The authorization token is structured with local quality, meaning different portions of the token contain specific types of information optimized for their intended use. The token includes essential elements such as authorization status, transaction amount, and purchase identifiers in a compact format. This localized organization of information within the token enables accurate transaction tracking while maintaining a efficient data structure that minimizes processing overhead and storage requirements.
Data Source
AI summary
A system and method for private label account number protection is described. A method receives, at a retail computing system, a private label credit account number being proffered to make a private label credit purchase. A request for authorization for the purchase is provided from the retail computing system to a private label credit account provider over a dedicated connection between the retail computing system and the private label credit account provider. The retail computing system receives an authorization token from the credit account provider and stores the authorization token in place of the private label credit account number.