Secure Microform for Web Payment Data Collection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Content providers face challenges in securely handling sensitive financial information without redirecting users to third-party sites, losing control over the user session and branding, while existing solutions are prone to man-in-the-middle attacks and cross-site scripting.
Innovation Solution
Embedding a secure iframe on the content provider's website using cryptographic authentication and secure transports to connect with a secure service for sensitive data collection, generating a token for transaction completion, and maintaining control over the user session and branding through HTTPS and public key pinning.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the content provider uses a third-party site for card data entry to improve data security, then data security is improved, but the content provider loses control of the user session and branding
Solution Approach 1:
The patent embeds a third-party secure payment form within an iframe on the content provider's website, allowing the third-party service to collect card data securely while the content provider maintains visual control and branding through the iframe container and surrounding page elements
Solution Approach 2:
The patent uses an iframe as an intermediary element that allows the content provider to integrate third-party secure payment processing without direct redirection, maintaining user session control while leveraging the third-party service's security
2Reliability
If the content provider redirects users to a third-party site for payment data entry to improve data security, then data security is improved, but the user experience is degraded due to loss of branding control and transaction discontinuity
Solution Approach 1:
The third-party payment form is nested within an iframe on the content provider's site, allowing users to complete transactions without leaving the branded environment, thus maintaining visual consistency and reducing transaction discontinuity perception
3Ease of operation
If the content provider handles PANs directly to simplify payment acceptance, then ease of operation is improved, but data security and liability risks increase
Solution Approach 1:
The patent extracts sensitive card data collection from the content provider's servers and places it in a third-party secure environment, allowing the content provider to accept payments simply by embedding the iframe while avoiding direct handling of PANs
Data Source
AI summary
A secure iframe and a combination of security elements are used in rendering a web page of a content provider. The security elements may be both pre-provisioned and executed in real time to allow a third party to securely collect sensitive information while allowing the content provider to retain total control of the look and feel of the web page. A microform within the secure iframe uses a combination of Content Security Policies (CSP), HSTS, and HPKP to generate a secure connection between the iframe and the third party while still allowing the content provider control the look and feel of the iframe. The content provider never handles the sensitive data, reducing the content provider's financial exposure in the event of a data breach. The secure service collects sensitive data and returns a tokenized identifier for use by the content provider when interacting with the customer.