Secure Detokenization via Tokenization Certificates

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

In systems with multiple levels of tokenization, de-tokenization processes are complicated by the need to identify and authorize the original token provider and requestor, while ensuring secure transmission of sensitive data like PANs across multiple intermediaries.

Innovation Solution

A method involving tokenization certificates that validate the identity and authorization of requestors, allowing encryption of credentials with the requestor's public key, ensuring only the requestor can decrypt and access the data, even through multiple tokenization layers.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If multiple levels of tokenization are implemented to enhance security, then the security of sensitive data is improved, but the complexity of the de-tokenization process increases

Engineering Contradiction:

Improvesecurity of sensitive dataVSAvoidcomplexity of de-tokenization process

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent introduces a token provider computer as an intermediary that manages multiple tokenization layers. This intermediary receives de-tokenization requests, identifies the appropriate token level, and coordinates the de-tokenization process across multiple layers, thereby reducing the complexity that would otherwise be distributed throughout the entire system.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The system performs preliminary actions by pre-establishing the relationships between tokens at different levels and storing metadata about tokenization hierarchies. This allows the de-tokenization process to efficiently navigate multiple layers without requiring complex real-time analysis, as the structural relationships are predetermined and stored for quick retrieval.

Inventive Principle:

Principle #10Preliminary action

2Reliability

If tokenization certificates are used to validate requestor identity, then the security and authorization verification are improved, but the computational overhead and processing time increase

Engineering Contradiction:

Improveauthorization verificationVSAvoidprocessing time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

Tokenization certificates are pre-generated and validated before actual de-tokenization operations. The requestor's identity and authorization level are verified in advance, and the certificate is cached or stored for quick reference during subsequent de-tokenization requests, reducing processing time while maintaining security.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

Instead of repeatedly performing complex cryptographic validations for each de-tokenization request, the system creates validated copies of authorization information within the tokenization certificate itself. This allows subsequent operations to reference the pre-validated certificate data rather than re-performing the entire validation sequence.

Inventive Principle:

Principle #26Copying

3Reliability

If credentials are encrypted with the requestor's public key for secure transmission, then the security of credential transmission is improved, but the complexity of key management and encryption/decryption operations increases

Engineering Contradiction:

Improvesecurity of credential transmissionVSAvoidcomplexity of key management

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The token provider computer acts as an intermediary that manages the encryption and decryption operations. It handles the public key encryption of credentials and the corresponding private key decryption, isolating the complexity of cryptographic key management from the requestor and other system components. This centralizes the complexity in a dedicated security module.

Inventive Principle:

Principle #24Intermediary (Mediator)

4Adaptability or versatility

If de-tokenization requests are forwarded through multiple token provider computers, then the ability to handle multi-level tokenization is improved, but the communication overhead and processing delays increase

Engineering Contradiction:

Improveability to handle multi-level tokenizationVSAvoidcommunication overhead

Core Design Contradiction:

Adaptability or versatilityVSLoss of time

Solution Approach 1:

The system pre-establishes routing information and relationships between token provider computers during system initialization or token creation. This metadata about the tokenization hierarchy is stored and used to optimize the forwarding path, allowing requests to be routed efficiently through the minimal necessary intermediaries rather than requiring sequential exploration or trial-and-error routing.

Inventive Principle:

Principle #10Preliminary action

Data Source

PatentUS10652028B2Systems and methods for secure detokenization

Publication Date: 2020.05.12 VISA INTERNATIONAL SERVICE ASSOCIATION

AI summary

A method for requesting a credential associated with token in a multiple token layer environment is disclosed. A tokenization certificate serves to validate the identity of a credential requestor and provide information about the requestor's authorization for de-tokenizing a token. Also, a public key in the tokenization certificate is used to encrypt the credential for secure transmission to the requestor.