Token Processing with Domain Restriction Handling
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Payment tokens with domain restrictions can cause transactions to be unnecessarily declined when used outside their intended domain, leading to inconsistencies between card present and card not present transactions.
Innovation Solution
A method is implemented where a server computer processes authorization requests by determining if a token is being used outside its domain, and if it is related to a prior transaction, it initiates authorization using the associated account identifier, allowing transactions to proceed even if the token is domain restricted.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If domain restrictions are applied to tokens to protect consumer and merchant from fraudulent purchases, then security is improved, but transaction compatibility across different domains deteriorates
Solution Approach 1:
The server computer acts as an intermediary between the token and the authorization system. When a token is used outside its restricted domain, the server intercepts the authorization request, detects the domain mismatch, and translates the token into its associated account identifier before forwarding the request for authorization. This intermediary translation layer allows tokens to function across different domains while maintaining the security benefits of domain restrictions.
Solution Approach 2:
The system dynamically changes the parameter being used for authorization based on the domain context. When the token is used within its restricted domain, the token itself is used for authorization. When used outside the restricted domain, the system changes the authorization parameter from the token to the associated account identifier, allowing the transaction to proceed while maintaining security controls.
2Object-affected harmful factors
If tokens are restricted to specific domains to prevent fraud, then fraud protection is improved, but transaction processing flexibility deteriorates
Solution Approach 1:
The server computer serves as a mediator that transparently handles the complexity of domain restriction validation. The resource provider computer simply submits the token without needing to understand domain restrictions. The server intermediary automatically determines whether the token is being used within or outside its restricted domain and appropriately processes the authorization request, maintaining ease of operation for merchants while enforcing fraud protection.
Solution Approach 2:
The token itself carries information about its restricted domain, and the server computer automatically validates this restriction without requiring external intervention. The system self-determines whether domain expansion is appropriate by checking for related transaction indicators and reference data, allowing the transaction to proceed autonomously when security conditions are met.
3Adaptability or versatility
If a token is used outside its restricted domain, then transaction versatility is improved, but security control deteriorates
Solution Approach 1:
The system implements feedback by checking for the presence of related transaction indicators and reference data in the authorization request. When these indicators are present, the system feedback confirms that the transaction is related to a prior authorized transaction, thereby maintaining security control even though the token is being used outside its original restricted domain. This feedback mechanism ensures that domain expansion only occurs when appropriate security conditions are met.
Solution Approach 2:
The system performs preliminary validation by checking for related transaction indicators and reference data before allowing the token to be used outside its restricted domain. This preliminary action ensures that only transactions with proper authorization history can bypass domain restrictions, maintaining security control while enabling necessary transaction versatility.
Data Source
AI summary
Embodiments of the invention provide for faster and more efficient data processing, and can utilize multiple authorizations and tokens having domain restrictions. The different authorizations may be related, and a related transaction indicator as well as reference data may be included in authorization requests made after an initial authorization.