Methods and systems for providing a low value token buffer

• US 10,164,996 B2
• Filed: 03/10/2016
• Issued: 12/25/2018
• Est. Priority Date: 03/12/2015
• Status: Active Grant

• Current Assignee: Visa International Service Association (Visa, Inc.)
• Original Assignee: Visa International Service Association (Visa, Inc.)
• Inventors: Gaddam, Ajit, Aissi, Selim
• Primary Examiner(s): Shehni, Ghazal B
• Application Number:
  US15/066,359
• Publication Number:
  US 20160269391A1
• Time in Patent Office: 1,020 Days
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

Embodiments of the present invention are directed at methods and systems for providing a low value token buffer using only low value tokens (i.e., tokens that cannot be used to conduct transactions) within an organization to reduce access to high value tokens (i.e., tokens that are directly tied to real credentials and can be used to conduct transactions) within the organization. Accordingly, whenever a high value token is received by the organization, the high value token is changed to a low value token while being used within the organization. The low value token may be transformed to high value token upon (or before) delivery outside the organization.

Claims

1. A method comprising:

receiving, by a first server computer, a request message including a first token from an access device, the first token being a substitute for a real credential, the first token being configured to be processed by the access device to conduct a transaction;

determining, by the first server computer, a second token associated with the first token, the second token not being configured to be processed by the access device to conduct the transaction;

updating, by the first server computer, the request message to include the second token; and

sending, by the first server computer, the request message including the second token to a second server computer, the second server computer using the second token to either obtain the first token or the real credential to incorporate into the request message before transmitting the request message to an authorizing entity computer.

2. The method of claim 1, further comprising:

receiving, by the first server computer, a response message including the second token from the second server computer;

determining, by the first server computer, the first token associated with the second token;

updating, by the first server computer, the response message to include the first token; and

sending, by the first server computer to the access device, the response message including the first token.

3. The method of claim 2, wherein the second server computer receives the response message from the authorizing entity computer, and wherein the second server computer incorporates the second token into the response message before transmitting the response message to the first server computer.

4. The method of claim 2, wherein the request message is an authorization request message and the response message is an authorization response message.

5. The method of claim 1, wherein the real credential comprises an account identifier.

6. The method of claim 1, wherein the second server computer uses the second token to perform at least one of risk analysis and application system processing.

7. The method of claim 1, wherein receiving the request message by the first server computer from the access device occurs via at least one of a resource provider computer and a transport computer.

8. A first server computer comprising:

a processor; and

a memory comprising code, executable by the processor, for implementing a method comprising;

receiving a request message including a first token from an access device, the first token being a substitute for a real credential, the first token being configured to be processed by the access device to conduct a transaction;

determining a second token associated with the first token, the second token not being configured to be processed by the access device to conduct the transaction;

updating the request message to include the second token; and

sending the request message including the second token to a second server computer, the second server computer using the second token to either obtain the first token or the real credential to incorporate into the request message before transmitting the request message to an authorizing entity computer.

9. The first server computer of claim 8, wherein the method further comprises:

receiving a response message including the second token from the second server computer;

determining the first token associated with the second token;

updating the response message to include the first token; and

sending, to the access device, the response message including the first token.

10. The first server computer of claim 9, wherein the second server computer receives the response message from the authorizing entity computer, and wherein the second server computer incorporates the second token into the response message before transmitting the response message to the first server computer.

11. The first server computer of claim 9, wherein the request message is an authorization request message and the response message is an authorization response message.

12. The first server computer of claim 8, wherein the real credential comprises an account identifier.

13. The first server computer of claim 8, wherein the second server computer uses the second token to perform at least one of risk analysis and application system processing.

14. The first server computer of claim 8, wherein receiving the request message by the first server computer from the access device occurs via at least one of a resource provider computer and a transport computer.

15. A method comprising:

receiving, by a server computer, a request message including a first token from an access device, the first token being a substitute for a real credential, the first token being configured to be processed by the access device to conduct a transaction;

determining, by the server computer, a second token associated with the first token, the second token not being configured to be processed by the access device to conduct the transaction;

sending, by the server computer, the second token to an application system, wherein the application system performs analysis using the second token;

receiving, by the server computer, the second token and results of the analysis from the application system;

determining, by the server computer, the real credential using the second token;

updating, by the server computer, the request message to include the real credential; and

sending, by the server computer, the request message including the real credential to an authorizing entity computer.

16. The method of claim 15, further comprising:

receiving, by the server computer, a response message including the real credential;

determining, by the server computer, the first token associated with the real credential;

updating, by the server computer, the response message to include the first token; and

sending, by the server computer, the response message including the first token.