Token Failsafe Cryptogram Generation for Authorization Resilience
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current token-based interaction systems fail to effectively handle authorization requests when initial token interactions fail, often resulting in repeated failures without proper resolution.
Innovation Solution
A method involving a token requestor computer that transmits an initial authorization request message with a token and cryptogram, generates a second cryptogram request after receiving a declined response, and uses the new cryptogram and associated credential in a second authorization request to facilitate the interaction.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the system attempts to perform the same authorization request again after token interaction failure, then the user can retry the interaction, but the interaction will most likely fail again
Solution Approach 1:
The system changes the parameters of the authorization request by switching from token-based authentication to credential-based authentication. When a token interaction fails, the system generates a new cryptogram using the underlying credential instead of retrying the same token, thereby changing the authentication parameters to achieve success.
Solution Approach 2:
The system creates a copy of the authentication mechanism by generating a new cryptogram that mirrors the structure of the original token-based cryptogram but uses the underlying credential as the foundation. This copied authentication approach allows the system to maintain the same interface while using a different underlying mechanism for retry attempts.
2Ease of operation
If the system uses token-based interactions for authorization, then the interface remains simple and user-friendly, but the system lacks resilience when token interactions fail
Solution Approach 1:
The system introduces an intermediary layer that sits between the simple token-based interface and the complex credential-based authentication mechanism. The cryptogram generation module acts as this intermediary, translating simple token requests into complex credential-based authentication when needed, thereby maintaining interface simplicity while adding resilience.
Solution Approach 2:
The authentication system becomes dynamic by automatically switching between token-based and credential-based authentication based on the outcome of previous attempts. The system monitors authorization responses and adapts its behavior, using tokens for initial attempts and falling back to credentials when tokens fail, thereby maintaining simplicity while improving reliability.
3Productivity
If the system exposes real credentials for authorization, then the authorization process can proceed, but the credentials are vulnerable to exposure and misuse
Solution Approach 1:
The system creates a copy of the authentication function using cryptograms instead of exposing real credentials. The cryptogram serves as a surrogate that maintains the authentication capability while preventing direct exposure of the underlying credential, thereby protecting against harmful factors like credential leakage and misuse.
Solution Approach 2:
The system extracts the sensitive credential information from the authentication process and replaces it with a derived cryptogram. By taking out the actual credential and using only its cryptographic representation in the authorization interface, the system maintains productivity while eliminating the harmful exposure of real credentials.
Data Source
AI summary
A method comprises a token requestor computer transmitting a first authorization request message comprising a token and first cryptogram for authorization of an interaction to a server computer. The token requestor computer receives a first authorization response message comprising a response code from the server computer, then generates a cryptogram request message comprising the token or a token identifier and the response code. The token requestor computer transmits the cryptogram request message to a token provider computer, which generates a second cryptogram. The token requestor computer receives the second cryptogram and credential and generates a second authorization request message comprising the second cryptogram and the credential. The token requestor computer transmits the second authorization request message to the server computer. A second authorization response message is received from the server computer in response to the second authorization request message. The second authorization response message indicates whether the interaction is authorized.