Sandboxed Payment Card Presentation Without PCI-Compliant Webservers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems face challenges in securely transmitting and displaying payment card data on websites without requiring the website's webserver to be PCI-compliant, especially for businesses using third-party branded payment cards.
Innovation Solution
A PCI-compliant payment-card server transmits payment card data directly to a sandboxed container environment within a webpage, bypassing the website's webserver, using a client-access token and transport layer encryption to ensure secure communication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If payment card data is transmitted through the website's webserver, then the website can display payment card information, but the webserver must be PCI-compliant which increases complexity and cost
Solution Approach 1:
A payment card server acts as an intermediary between the payment card network and the website. This server receives payment card data from the network and transmits it directly to the client device, bypassing the website's webserver. The intermediary handles all PCI compliance requirements while the website simply displays the provided payment card information without being directly involved in sensitive data transmission.
2Productivity
If the webserver handles payment card data transmission, then the website can process payments, but security compliance costs increase
Solution Approach 1:
The payment card server serves as a dedicated intermediary that handles all aspects of secure payment card data transmission. It receives authorization requests from the website, obtains payment card data from the payment card network, and delivers it to the client. This separates the payment processing functionality from the website's webserver, allowing the website to maintain payment processing capability without bearing the burden of PCI compliance implementation.
3Loss of information
If payment card data is displayed on the website, then users can view card information, but the webserver becomes a security target requiring PCI compliance
Solution Approach 1:
The payment card server functions as a secure intermediary that controls the entire lifecycle of payment card data transmission. It retrieves data from the payment card network, encrypts it during transmission, and delivers it directly to the user's device. The website's role is reduced to displaying already-encrypted payment card information, eliminating the webserver from being a security target that would require PCI compliance.
Data Source
Figure 1A
Figure 1B
Figure 1C
AI summary
The present disclosure relates to a system, method, and computer program for securely transmitting and presenting payment card data in a web client. Payment card information is securely transmitted form a payment card server to a sandboxed container object on a webpage. The payment card sever is PCI compliant and independent of the webserver that provided the webpage to the web client. A sandboxed payment-card client, executing within the sandboxed container object on the web page, establishes a secure communication session with the payment-card sever. The payment-card server transmits payment card data to the sandboxed payment-card client, which displays the payment card data in the sandboxed container object (or in a plurality of sandboxed container objects). The website's webserver is bypassed in communications between the payment-card server and the sandboxed payment-card client.