Tokenization System Using Memory Pointers for Secure Payment Storage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current tokenization techniques for PCI cards lack standardized methodologies for generating and processing tokens, leading to vulnerabilities in data security and compliance with PCI-DSS, despite recommendations from entities like Visa, which emphasize the use of strong cryptographic algorithms and unique salts.
Innovation Solution
A method and system for generating and processing tokens that utilize memory attributes of a secure tokenization system, such as pointers or addresses, instead of encryption algorithms or random numbers, to create tokens that include memory-related information identifying the storage location of encrypted payment information, ensuring secure storage and access without relying on encryption algorithms for token generation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional tokenization techniques using encryption algorithms and random numbers are used, then data security is provided, but system complexity and compliance costs increase
Solution Approach 1:
The patent extracts the core security function from complex encryption algorithms and random number generation, replacing them with a simplified token generation mechanism that uses only the least significant bits of account numbers combined with sequential counters. This removes unnecessary cryptographic complexity while retaining the essential security function of protecting sensitive data.
Solution Approach 2:
The patent implements tokens as disposable, short-lived objects that are generated sequentially and discarded after use. Each token is valid for only one transaction or a limited time period, eliminating the need for complex key management and rotation mechanisms required by traditional encryption systems.
2Reliability
If encryption algorithms and unique salts are used for token generation, then data security is improved, but implementation burden and compliance validation complexity increase
Solution Approach 1:
The patent fundamentally changes the parameters used in token generation from cryptographic algorithms and random salts to simple numerical operations on account numbers and sequential counters. This parameter transformation maintains security through obscurity and frequency distribution while dramatically simplifying implementation and eliminating the need for cryptographic key management.
3Adaptability or versatility
If tokens include detailed payment information elements, then token functionality is improved, but security vulnerabilities increase
Solution Approach 1:
The patent extracts only the essential identifying elements from payment information (the least significant bits of account numbers) and combines them with sequential counters to create minimal tokens. This extraction process removes unnecessary sensitive information that could create security vulnerabilities while retaining sufficient functionality for transaction processing.
Data Source
AI summary
A token is generated and processed as a substitute for sensitive information, e.g., payment information associated with a customer making a purchase of a product/service from a vendor. The customer's payment information is encrypted and stored in a first memory record of a secure computer system. A token is generated that includes memory-related information identifying the first memory record, and the token is transmitted to the vendor for storage in a customer record. To facilitate payment for the purchase, the vendor transmits the token to another party (e.g., a billing service or payment processor), and the encrypted payment information is read from the first memory record of the secure computer system based on the memory-related information in the token. The encrypted payment information is then decrypted to recover the payment information which is then used to effect payment.