Tokenized Inline-Frame Storage for Sensitive Payment Data
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Merchants face challenges in determining and complying with data storage requirements for sensitive customer data, which are often beyond their capabilities and can be difficult to implement.
Innovation Solution
A storage service with a network-accessible API is used by merchants to store sensitive customer data, implementing data retention policies such as encryption, access control, and backup procedures, while using inline frames to protect data from merchant access and associating data with tokens for secure retrieval and usage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If merchants implement local data retention policies for sensitive customer data, then data security and compliance are improved, but device complexity and operational difficulty increase significantly
Solution Approach 1:
The patent extracts the data retention policy implementation burden from the merchant's system and transfers it to a third-party storage service provider. The merchant website no longer needs to implement, maintain, or manage data retention policies locally - these functions are completely removed from the merchant's responsibility and handled externally by the storage service, which automatically manages encryption, access control, and retention periods.
Solution Approach 2:
The patent introduces a third-party storage service as an intermediary between the merchant and customer data. This intermediary assumes responsibility for implementing data retention policies, acting as a buffer that protects the merchant from the complexity of compliance while ensuring data is stored securely according to legal and contractual requirements.
2Ease of operation
If merchants store sensitive customer data locally, then data access and usage are simplified, but data privacy protection and security control worsen
Solution Approach 1:
The storage service acts as an intermediary that mediates between data access needs and privacy protection requirements. It provides controlled access to merchants through tokens while maintaining encryption and access logs, thus enabling operational access without compromising privacy security.
Solution Approach 2:
The patent segments data access into two distinct layers: merchants receive tokens that provide controlled access to specific data elements when needed, while the actual sensitive data remains encrypted and protected in the storage service's secure environment. This segmentation allows operational access without exposing the underlying data to unauthorized access or misuse.
3Device complexity
If merchants use third-party storage service, then device complexity and compliance burden are reduced, but control over data access and retrieval is limited
Solution Approach 1:
The token system acts as an intermediary mechanism that preserves merchant control over data retrieval while simplifying policy management. Merchants maintain control by managing their own tokens - they can generate, revoke, and control access permissions through tokens without needing to understand or implement the underlying complex security infrastructure.
Data Source
AI summary
A first inline frame is provided from one or more servers of a service provider for display on a browser executing on a computing device of a first user within a website of a second user. A data retention policy is received from a computing component associated with the second user. Sensitive user data is received via the first inline frame from the computing device of the first user. A token is associated with the sensitive user data. The token is returned to the second user via the computing component. A request is received from the computing component that specifies the token. An electronic payment is initiated responsive to receiving the request, based at least in part on the sensitive user data.