Third-Party Wallet FPAN Provisioning With Partial Disclosure Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems lack secure methods for provisioning funding card numbers to third-party wallets while ensuring data privacy and security, particularly in e-commerce transactions.
Innovation Solution
Implementing a system that uses Public Key Infrastructure (PKI) for field-level encryption and symmetric keys to securely transport funding card numbers between issuers and merchants, with authentication and validation processes through APIs and OAUTH/SiteMinder, allowing partial FPAN disclosure and encryption of sensitive data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the actual FPAN is provided to the merchant, then the merchant can conduct transactions directly, but security is compromised and data exposure increases
Solution Approach 1:
The patent segments the FPAN into two parts: a truncated version (first portion) that is provided to the merchant for transactions, and a separate encryption key (second portion) that remains with the issuer. This segmentation allows the merchant to conduct transactions without exposing the complete FPAN, resolving the contradiction between transaction capability and security.
Solution Approach 2:
The patent introduces an intermediary encryption mechanism where the complete FPAN is encrypted using a key held by the issuer. The merchant receives only the encrypted version and the truncated version, not the actual FPAN. This intermediary encryption layer enables transaction processing while preventing direct access to sensitive card data.
2Adaptability or versatility
If the complete FPAN is provided to the third-party wallet, then the wallet can store and use the card number, but data privacy and security are compromised
Solution Approach 1:
The patent segments the FPAN disclosure by providing only the first portion (truncated version) to the third-party wallet through the API, while retaining the second portion (encryption key) with the issuer. This segmentation enables wallet integration functionality while preventing complete data exposure, thus maintaining data privacy.
Solution Approach 2:
The patent applies local quality by providing different levels of FPAN information to different entities: the third-party wallet receives only the truncated first portion for storage and transaction use, while the issuer retains the complete encrypted FPAN and encryption key. This localized information distribution enables wallet functionality without compromising overall data security.
3Object-affected harmful factors
If the FPAN is encrypted and only partial information is provided, then security is improved, but the complexity of the provisioning system increases
Solution Approach 1:
The patent uses an intermediary API layer that handles the encryption and decryption operations. The API receives the complete FPAN from the issuer, encrypts it using the issuer's key, and provides only the encrypted version and truncated portion to the third-party wallet. This intermediary API simplifies the overall system architecture by centralizing the security logic, making the complexity manageable while maintaining strong security.
4Reliability
If authentication and encryption processes are implemented through APIs, then security and privacy are enhanced, but the number of system components and validation steps increases
Solution Approach 1:
The patent implements a universal API framework that handles multiple functions: authentication of the third-party wallet, encryption of the FPAN using issuer-held keys, provision of truncated FPAN portions, and validation of communication security. This multi-functional API approach consolidates multiple security operations into a single integrated layer, enhancing reliability while managing system complexity through universality.
Data Source
AI summary
Systems, methods, and devices for provisioning funding card numbers to merchant wallets are disclosed. In one embodiment, in an information processing apparatus comprising at least one computer processor, a method for provisioning funding card numbers to third party wallets may include: (1) authenticating a customer using an electronic device; (2) redirecting the customer to a third-party website; (3) receiving, from the third-party website and via a first API, a request for funding primary account numbers (FPANs) associated with the customer; (4) providing the third-party website with a plurality of FPAN identifiers for FPANs associated with the customer; (5) receiving, from the third-party website and via a second API, a request for a FPAN associated with a selected FPAN identifier; (6) encrypting the FPAN associated with the selected FPAN identifier; and (7) communicating the encrypted FPAN to the third-party website.