Tokenized Card Data Storage for PCI DSS Compliance
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current systems for card-not-present transactions require consumers to repeatedly enter the Card Verification Value (CVV) for each payment, leading to inconvenience and increased fraud risk, as storing the CVV is restricted by PCI DSS regulations, limiting merchants' ability to offer a simplified checkout process globally.
Innovation Solution
A method involving a server computer that receives cardholder data, generates a unique consumer reference token, encrypts it with the CVV, and transmits it to a third party for storage, allowing subsequent decryption and use for payment transactions without requiring the consumer to re-enter the CVV, while ensuring security through hardware encryption and validation checks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the CVV is stored for future transactions, then the checkout process becomes more convenient and faster, but the security risk increases and PCI DSS compliance is violated
Solution Approach 1:
The system segments the cardholder data by separating the CVV from other card information. The CVV is extracted, encrypted separately with hardware security, and stored in a restricted manner that complies with PCI DSS, while other card data can be stored for convenient future use.
Solution Approach 2:
Hardware security modules act as intermediaries between the CVV and storage systems. These specialized hardware components provide an additional layer of security through cryptographic operations, allowing the system to store card data for convenience while maintaining security compliance through the intermediary's protective functions.
2Reliability
If the CVV is not stored and must be entered each time, then security is maintained according to PCI DSS, but the transaction process becomes more time-consuming and inconvenient
Solution Approach 1:
The system performs preliminary actions by securely capturing and storing the CVV in an encrypted state during the initial card registration. This preliminary secure storage eliminates the need for repeated CVV entry in future transactions, reducing transaction time while maintaining security through the pre-established encrypted storage mechanism.
3Productivity
If the CVV is encrypted and stored, then future transactions can be simplified, but the encryption and decryption processes add system complexity
Solution Approach 1:
The system replaces complex software-based encryption and decryption mechanisms with hardware security modules. These specialized hardware devices perform cryptographic operations more efficiently and securely, reducing the overall system complexity while enabling fast encrypted storage and retrieval of CVV data for simplified future transactions.
Data Source
AI summary
Systems and methods for storing cardholder data and processing transactions are provided. Cardholder data is received at a server computer, the cardholder data including consumer credentials to be stored and at least one data item not to be stored. A unique consumer reference token is obtained and combined with the data item not to be stored and the combination encrypted to form an encrypted token. The encrypted token is transmitted to a third party for storage and is erased from the server computer. At the time of transaction, the encrypted token is received and decrypted to yield the data item not to be stored, so that a transaction can be initiated using stored consumer credentials and the data item not to be stored. The unique consumer reference token encrypted together with the data item enables the server computer to perform validation checks on the encrypted token.