Multi-network tokenization processing

• US 10,496,986 B2
• Filed: 08/08/2014
• Issued: 12/03/2019
• Est. Priority Date: 08/08/2013
• Status: Active Grant

• Current Assignee: Visa International Service Association (Visa, Inc.)
• Original Assignee: Visa International Service Association (Visa, Inc.)
• Inventors: Narayan, Prasanna L., Powell, Glenn, Sheets, John, Tait, Paul, Carpenter, Andrew
• Primary Examiner(s): Choo, Johann Y
• Application Number:
  US14/455,574
• Publication Number:
  US 20150046338A1
• Time in Patent Office: 1,943 Days
• CPC Class Codes: G06Q 20/20 Point-of-sale [POS] network systems
• CPC Class Codes: G06Q 20/38215 Use of certificates or encrypted proofs of transaction rights

Abstract

Methods are provided for enabling a transaction using a token associated with a first payment network to be conducted using a second payment network. When a transaction using a token is submitted to a payment network, the payment network can determine the payment network associated with the token. If the token is associated with a second payment network, a token verification request including the token can be sent to the second payment network. The second payment network can then return a token verification response including a primary account identifier such as a primary account number (PAN) corresponding to the token and a validation result. The transaction may then be processed using the primary account identifier.

Claims

1. A computer-implemented method comprising:

receiving, by a first payment network comprising a server computer from a token requestor device via a merchant computer, an authorization request message for a transaction including a token comprising a predetermined issuer identifier of the token, a token requestor identifier, and transaction data, wherein the token is a substitute for a primary account identifier associated with an account;

identifying, by the first payment network comprising the server computer, a network token system associated with the token based on the predetermined issuer identifier of the token, the network token system being operated by a second payment network wherein identifying, by the first payment network comprising the server computer, the network token system associated with the token comprises;

accessing, by the first payment network comprising the server computer, a token mapping table comprising a plurality of payment networks and a plurality of predetermined issuer identifiers associated with the plurality of payment networks, wherein each payment network is associated with a network token system; and

identifying the payment network associated with the token from among the plurality of payment networks based on the predetermined issuer identifier of the token;

sending, by the first payment network comprising the server computer, a token verification request message to the network token system of the second payment network, the token verification request message including the token, the transaction data, a token request timestamp, and a token expiration timestamp;

determining, by the network token system of the second payment network, the primary account identifier associated with the token by validating that the first payment network is entitled to make a request for the primary account identifier associated with the token by evaluating the token request timestamp and the token expiration timestamp;

accessing, by the network token system of the second payment network, a token database comprising a plurality of tokens associated with a plurality of primary account identifiers;

identifying, by the network token system of the second payment network, the primary account identifier associated with the token from among the plurality of primary account identifiers in response to validating that the first payment network is entitled to make a request for the primary account identifier associated with the token;

validating, by the network token system of the second payment network, the use of the token for the transaction by determining whether the token can be used for the transaction using at least the token requestor identifier;

receiving, by the first payment network comprising the server computer and from the network token system of the second payment network, a token verification response message including the primary account identifier and a validation result indicating whether the use of the token for the transaction is authorized;

sending, by the first payment network comprising the server computer, a modified authorization request message including the primary account identifier, the validation result, and the transaction data to an issuer of the account associated with the primary account identifier; and

receiving, from the issuer of the account, an authorization response message indicating whether the transaction is approved or declined, wherein the authorization response message is used to approve or decline the transaction and wherein the first payment network is configured to perform authorization, clearing, and settlement operations for a first entity for approving or declining the transaction and the second payment network is configured to perform authorization, clearing, and settlement operations for a second entity that is different from the first entity.

2. The method of claim 1, wherein the authorization request message received by the first payment network comprising the server computer further includes restrictions associated with the token, and wherein validating the use of the token for the transaction comprises determining whether the restrictions associated with the token preclude the transaction.

3. The method of claim 1, wherein the authorization request message received by the first payment network comprising the server computer further includes an encrypted PIN block comprising a PIN associated with the account, and wherein the method further comprises:

determining, by the first payment network comprising the server computer, an issuer PIN key using the primary account identifier; and

validating, by the first payment network comprising the server computer, the PIN using the determined issuer PIN key.

4. The method of claim 1, wherein the authorization request message received by the first payment network comprising the server computer further includes an encrypted PIN block comprising a PIN associated with the account, wherein the encrypted PIN block is generated based on the token, and wherein the method further comprises:

translating, by the first payment network comprising the server computer, the encrypted PIN block to generate a decrypted PIN block based on the primary account identifier; and

sending, by the first payment network comprising the server computer, the decrypted PIN block to the issuer, wherein the issuer validates the PIN based on the decrypted PIN block.

5. The method of claim 1, wherein the authorization request message received by the first payment network comprising the server computer further includes a token presentment mode, wherein the network token system of the second payment network validates the use of the token for the transaction using the token presentment mode.

6. The method of claim 1, wherein the authorization request message received by the first payment network comprising the server computer further includes a token assurance level code, wherein the token assurance level code indicates a level of confidence that the token was requested by an authorized entity, and wherein the network token system of the second payment network validates the use of the token for the transaction using the token assurance level code.

7. The method of claim 1, wherein the issuer identifier comprises a predetermined number of digits of the token.

8. The method of claim 1, wherein prior to the transaction, the network token system operated by the second payment network receives the primary account identifier and generates the token.

9. The method of claim 1, wherein the token verification request message further comprises a token presentment mode indicating a mode through which the token was provided and wherein validating that the first payment network is entitled to make a request for the primary account identifier associated with the token comprises validating the token presentment mode.

10. The method of claim 9, wherein the token presentment mode indicates a number associated with a type of the transaction, the type of the transaction including a near-field communication (“

NFC”

) based transaction or a QR Code based transaction and wherein validating that the first payment network is entitled to make a request for the primary account identifier associated with the token further comprises validating the number associated with the type of the token presentment mode.

11. The method of claim 1, wherein the token verification request message further comprises a token cryptogram associated with the token, the token cryptogram representing encrypted data associated with the primary account identifier and wherein validating that the first payment network is entitled to make a request for the primary account identifier associated with the token comprises validating the token cryptogram.