Transaction Context Tokens for Secure Recurring Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems allow transactions without full authentication data, posing a security risk and preventing resubmission or recurring transactions, as merchants are not permitted to store transaction authentication data.
Innovation Solution
Generate a cryptographically signed and/or encrypted token from the initial transaction data, which includes authentication data, and transmit it to the merchant, allowing secure authentication of subsequent transactions without storing additional authentication data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If merchants are not permitted to store authentication data for security reasons, then security is improved, but the ability to resubmit or conduct recurring transactions is worsened
Solution Approach 1:
The authentication data is segmented into two parts: a cryptographic token that the merchant can store and reuse, and the actual sensitive authentication data that remains secure on the card or token device. This segmentation allows the merchant to retain transaction context without storing sensitive authentication information, resolving the contradiction between security and resubmission capability.
Solution Approach 2:
A cryptographic token acts as an intermediary between the authentication data and the merchant's transaction processing system. The token contains sufficient information to authenticate subsequent transactions without exposing the actual authentication data, enabling resubmissions while maintaining security through the intermediary layer.
2Reliability
If full authentication data is required for each transaction, then security is improved, but device complexity and data storage requirements are worsened
Solution Approach 1:
Instead of storing the actual authentication data, the system creates a cryptographic copy or representation (the token) that suffices for authentication purposes. This copy contains the necessary transaction context and authentication verification information without requiring the full authentication data set, reducing storage requirements while maintaining security.
Solution Approach 2:
The cryptographic token is generated and provided to the merchant in advance, during the initial authenticated transaction. This preliminary action equips the merchant with the necessary authentication material before subsequent transactions occur, eliminating the need to store or retrieve full authentication data later and simplifying the transaction processing system.
Data Source
AI summary
Methods of transaction authentication are provided. In one such method, at least one first transaction has been conducted, the or each first transaction generating data including first data comprising authentication data and second data identifying the or each first transaction, wherein a given first transaction is between a merchant and a card holder. A cryptographically signed and/or encrypted token corresponding to the given first transaction and comprising a characteristic of the first transaction has been generated using at least said second data. The cryptographically signed and/or encrypted token has been transmitted to the merchant. The method comprises receiving, from the merchant, data corresponding to a second transaction and in the event that the data corresponding to the second transaction includes the cryptographically signed and/or encrypted token, responsively authenticating the cryptographically signed and/or encrypted token, whereby to determine an authenticated association between the second transaction and a given first transaction.