Payment Account Authentication Using Token Mapping and Cryptograms
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authentication methods for e-commerce transactions, which are typically card-not-present (CNP), lack the robust security measures employed in card-present transactions, leading to increased vulnerability to fraudulent activities.
Innovation Solution
A system and method that incorporates enhanced authentication techniques, including the use of a digital service server (DSS) to map tokens to primary account numbers, validate cryptograms, and generate issuer authentication values (IAVs) within a full accountholder authentication value (AAV), ensuring secure transactions by integrating EMV 3-D Secure protocol components.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If enhanced authentication techniques (EMV 3-D Secure) are implemented in e-commerce transactions, then security against fraudulent activities is improved, but device complexity and processing requirements increase
Solution Approach 1:
The authentication system is divided into separate functional components: token service providers that handle tokenization, directory servers that route authentication requests, and access control servers that perform validation. This segmentation allows each component to specialize in specific security functions, improving overall security while making the complex authentication process more manageable and modular.
Solution Approach 2:
Directory servers act as intermediaries between merchants and access control servers, routing authentication requests and coordinating the validation process. This intermediary layer simplifies the interface for merchants while maintaining the complexity of security protocols in the background, effectively managing device complexity without compromising security.
2Reliability
If tokenization services are used to map tokens to primary account numbers, then security is enhanced by hiding account information, but processing time and system complexity increase
Solution Approach 1:
Tokens are generated and mapped to primary account numbers in advance, before actual transactions occur. This preliminary tokenization allows the system to prepare authentication credentials ahead of time, reducing processing time during actual transactions while maintaining security through the use of tokens instead of exposed account numbers.
Solution Approach 2:
The system creates token copies that represent primary account numbers without exposing the actual account information. These token copies can be processed more quickly than full account details while maintaining equivalent security, as the tokens are designed to be processed efficiently by authentication systems.
3Reliability
If cryptogram validation is performed for each transaction, then fraudulent activities are reduced, but transaction processing speed decreases
Solution Approach 1:
The system performs cryptogram validation selectively based on risk assessment and transaction characteristics. For low-risk transactions, full cryptogram validation may be skipped or simplified, while high-risk transactions receive complete validation. This partial action approach maintains security for necessary transactions while improving overall processing speed by avoiding unnecessary validation steps.
Solution Approach 2:
The authentication system uses feedback from previous validation results and risk assessment data to optimize processing. When similar transaction patterns are identified as low-risk, the system can reduce validation intensity, creating a feedback loop that improves processing speed while maintaining security through adaptive validation strategies.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Systems and methods are provided for authenticating users to payment accounts in connection with transactions. An exemplary method includes receiving, by at least one computing device, an authentication request for a transaction associated with a payment account where the authentication request includes a token associated with the payment account and a cryptogram, and mapping the token to a primary account number (PAN) for the payment account. The method also includes validating the cryptogram, generating a directory server nonce (DSN) for the authentication request, and transmitting the DSN and the account number to an access control server (ACS) associated with an issuer of the payment account. The method further includes, in response to an issuer authentication value (IAV), compiling an accountholder authentication value (AAV) including the IAV, the DSN and an amount of the transaction, and transmitting the AAV to one of a merchant and a server.