Segmented Transaction Credentials for Cross-Channel Fraud Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing tokenization systems in distributed systems face challenges with the generation of a vast number of tokens for various transaction channels and user devices, leading to complex storage and processing needs, and increased vulnerability to cross-channel fraud.
Innovation Solution
A method and system for credential management that assigns a credential with a user-identifying portion and a transaction-identifying portion, encoded based on unique user information and transaction properties, allowing secure and flexible transaction processing without direct mapping to Primary Account Numbers (PANs).
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a fresh token is issued for each new transaction channel and user device, then security is improved by preventing cross-channel fraud, but the number of tokens increases vastly leading to complex storage and processing needs
Solution Approach 1:
The credential is segmented into two distinct portions: a user-identifying portion that remains consistent across channels and a transaction-identifying portion that varies by transaction properties. This segmentation allows the system to maintain security through channel-specific transaction identification while reducing storage complexity by reusing the user-identifying portion across multiple transactions and channels.
Solution Approach 2:
The user-identifying portion of the credential serves multiple functions across different transaction channels and devices, eliminating the need to create entirely new tokens for each channel. This multi-functionality reduces the total number of tokens required while maintaining security through the transaction-specific portion.
2Reliability
If a vast number of tokens are generated to protect user PAN across all transaction interactions, then security coverage is improved, but the size of token vault databases increases significantly
Solution Approach 1:
By segmenting the credential into user-identifying and transaction-identifying portions, the system can store the compact user-identifying portion once per user while generating transaction-specific identifiers on-demand. This dramatically reduces the database size compared to storing complete unique tokens for every possible transaction channel and device combination.
Solution Approach 2:
The user-identifying portion is determined and stored in advance, while the transaction-identifying portion is generated only when needed for specific transactions. This preliminary action reduces the overall data storage requirements while maintaining comprehensive security coverage.
3Reliability
If tokenisation is used to protect additional user data beyond card PAN, then security is enhanced, but the variety and number of tokens increase further complicating management
Solution Approach 1:
The credential structure with its user-identifying and transaction-identifying portions can universally accommodate different types of user data and transaction types without requiring fundamentally different token structures. This universality simplifies management even as the system protects diverse data types across multiple channels.
Solution Approach 2:
The segmented credential structure allows different types of information to be encoded in the transaction-identifying portion while maintaining a consistent user-identifying portion. This segmentation makes it easier to manage diverse credentials compared to creating entirely different token types for each use case.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method of provisioning a credential for a transaction between a payment device of a user and a transaction processing device is described. The method is implemented a third-party server remote from the payment device and the transaction processing device. The method comprises assigning the credential to the transaction and the user and provisioning the credential into the payment device for subsequent retrieval by the payment device. Assigning the credential to the transaction comprises: determining unique identifying information of the user; allocating a first user-identifying portion of the credential to correspond to the unique identifying information; determining a plurality of properties intrinsic to the transaction and encoding the plurality of properties into transaction-identifying information; and allocating a second transaction-identifying portion of the credential to correspond to the transaction-identifying information. The credential is associated with encrypted authentication data that is generated by the payment device during the transaction, and used for subsequent authentication of the transaction by the remote third-party server.