Tokenized Payment Authentication with Next-Transaction Cryptograms
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Merchant-initiated transactions in digital transactions are vulnerable to fraud due to the lack of cryptogram authentication, as consumer digital wallets are not available to generate cryptograms for these transactions.
Innovation Solution
A method is introduced to provide a next transaction cryptogram that can be used to authenticate and secure merchant-initiated transactions, which includes generating a cryptogram based on the first transaction's cryptogram and payment token, and providing it within the authorization response message.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If merchant-initiated transactions are processed without a cryptogram, then processing simplicity is maintained, but security against fraud deteriorates
Solution Approach 1:
The system generates and provides a next transaction cryptogram in advance during the first authorization response, before the merchant-initiated transaction occurs. This preliminary provision of authentication credentials allows the merchant to securely process subsequent transactions without needing to interact with the consumer's digital wallet, thus maintaining processing simplicity while ensuring fraud protection through cryptographic authentication.
2Reliability
If a cryptogram is generated for each transaction, then security is maximized, but transaction processing time increases
Solution Approach 1:
The next transaction cryptogram is generated and provided in advance during the first authorization response. This eliminates the need for real-time cryptogram generation during the merchant-initiated transaction, thereby maintaining cryptographic security while significantly reducing transaction processing time for subsequent transactions.
Solution Approach 2:
Instead of generating a new cryptogram for each transaction, the system creates a copy of the authentication credential (next transaction cryptogram) that can be reused for the specified second transaction. This copying approach maintains security through cryptographic authentication while avoiding the time-consuming process of generating new cryptograms for each transaction.
3Reliability
If the digital wallet is used to generate cryptograms, then consumer authentication is performed, but merchant-initiated transactions cannot be authenticated
Solution Approach 1:
The system extracts the essential authentication function from the consumer's digital wallet by providing the next transaction cryptogram to the merchant during the first authorization response. This extraction allows the merchant to independently authenticate merchant-initiated transactions without needing access to the consumer's digital wallet, thereby maintaining consumer authentication security while enabling merchant-initiated transaction support.
Solution Approach 2:
The next transaction cryptogram serves as an intermediary authentication credential that bridges the gap between consumer-initiated and merchant-initiated transactions. It carries the authentication authority from the consumer's digital wallet to the merchant's system, enabling the merchant to authenticate transactions without direct access to the consumer's wallet while maintaining the security guarantees of consumer authentication.
Data Source
AI summary
Following a tokenized consumer-initiated transaction, it is typical for subsequent merchant-initiated transactions to be processed without a cryptogram, causing a real opportunity for fraudulently generated merchant-initiated transactions to be submitted and subsequently processed. The present disclosure provides a method that solves or alleviates this problem. The method comprises: receiving a first transaction request including a payment token, first payment information, a first cryptogram and a next transaction notification identifying a future second transaction; authenticating the first transaction request based at least in part on the first cryptogram; providing an authorization response approval message to authorize the first transaction request; and providing a next transaction cryptogram suitable for use in authenticating a second transaction request.