Unique code for token verification

• US 10,664,843 B2
• Filed: 12/02/2016
• Issued: 05/26/2020
• Est. Priority Date: 12/04/2015
• Status: Active Grant

• Current Assignee: Visa International Service Association (Visa, Inc.)
• Original Assignee: Visa International Service Association (Visa, Inc.)
• Inventors: Narayan, Prasanna L., Kumnick, Phillip, Vasu, Madhu
• Primary Examiner(s): Davis, Zachary A.
• Application Number:
  US15/368,353
• Publication Number:
  US 20170163617A1
• Time in Patent Office: 1,271 Days
• CPC Class Codes: G06Q 20/02 involving a neutral party, e.g. certification authority, notary or trusted third party [TTP]
• CPC Class Codes: G06Q 20/12 specially adapted for electronic shopping systems
• CPC Class Codes: G06Q 20/322 Aspects of commerce using mobile devices [M-devices]
• CPC Class Codes: G06Q 20/3821 Electronic credentials
• CPC Class Codes: G06Q 20/385 using an alias or single-use codes
• CPC Class Codes: G06Q 20/401 Transaction verification
• CPC Class Codes: G06Q 20/4014 Identity check for transactions
• CPC Class Codes: G06Q 20/4018 using the card verification value [CVV] associated with the card
• CPC Class Codes: G06Q 20/405 Establishing or using transaction specific rules
• CPC Class Codes: G07C 9/00174 Electronically operated locks; Circuits therefor; Nonmechanical keys therefor, e.g. passive or active electrical keys or other data carriers without mechanical keys mechanical locks with electric permutation E05B49/00; arrangements for sensing or reading record carriers G06K7/00; electronic switching H03K17/00
• CPC Class Codes: G07C 9/30 not involving the use of a pass
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2463/102 applying security measure for e-commerce data processing systems or methods, specially adapted for e-commerce G06Q30/00
• CPC Class Codes: H04L 2463/121 Timestamp cryptographic mechanisms or cryptographic arrangements involving time stamps H04L9/3297
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/0838 using one-time-passwords
• CPC Class Codes: H04L 63/0846 using time-dependent-passwords, e.g. periodically changing passwords
• CPC Class Codes: H04L 63/0892 by using authentication-authorization-accounting [AAA] servers or protocols
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/107 : wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 9/3234 : involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853
• CPC Class Codes: H04L 9/3297 : involving time stamps, e.g. generation of time stamps
• CPC Class Codes: H04W 12/068 : using credential vaults, e.g. password manager applications or one time password [OTP] applications

Abstract

A method for tokenizing credentials is disclosed. In addition to a token, a verification value can be provided for each interaction. The verification value can be generated based at least in part on a dynamic data element. The dynamic data element may be kept secret, while the verification value can be distributed for use during an interaction. When the verification value is used, it can be validated by re-creating the verification value based at least on the stored dynamic data element.

Claims

1. A method comprising:

receiving, by a second computer, from a first computer, a request for a verification value associated with a transaction, the request including a token;

generating, by the second computer, a random value that is not shared with the first computer and a third computer;

storing, by the second computer, a record including the random value and the token;

generating, by the second computer, a first verification value based on the random value and the token;

providing, by the second computer, the first verification value to the first computer;

receiving, by the second computer, from the third computer, a request to validate the first verification value, the request including the first verification value and the token;

identifying, by the second computer, the record including the random value based on the token;

generating, by the second computer, a second verification value based on the random value and the token;

determining, by the second computer, whether the second verification value matches the first verification value; and

providing, by the second computer, to the third computer, a value credential associated with the token when the second verification value matches the first verification value and not providing the value credential associated with the token when the second verification value does not match the first verification value,

wherein the transaction is a payment transaction, and

wherein the third computer sends the value credential to an authorizing entity computer, which authorizes the payment transaction based on the value credential.

2. The method of claim 1, wherein the random value is a unique hexadecimal value, and wherein the first verification value is a dynamic value.

3. The method of claim 1, wherein the first verification value is not stored at the second computer.

4. The method of claim 1, wherein the request for the verification value further includes a token requestor identifier, wherein the stored record further includes the token requestor identifier, wherein the request to validate the first verification value further includes the token requestor identifier, and wherein the record including the random value is identified further based on the token requestor identifier.

5. The method of claim 1, wherein the token is a substitute for a primary account number.

6. The method of claim 5, wherein the second computer is a token provider computer.

7. The method of claim 6, wherein the first computer is a resource provider computer.

8. A second computer comprising:

a processor device; and

a non-transitory computer readable medium, the non-transitory computer readable medium comprising code, executable by the processor device, for implementing a method comprising;

receiving, from a first computer, a request for a verification value associated with a transaction, the request including a token;

generating a random value that is not shared with the first computer and a third computer;

storing a record including the random value and the token;

generating a first verification value based on the random value and the token;

providing the first verification value to the first computer;

receiving, from the third computer, a request to validate the first verification value, the request including the first verification value and the token;

identifying the record including the random value based on the token;

generating a second verification value based on the random value and the token;

determining whether the second verification value matches the first verification value; and

providing, to the third computer, a value credential associated with the token when the second verification value matches the first verification value and not providing the value credential associated with the token when the second verification value does not match the first verification value,

wherein the transaction is a payment transaction, and

wherein the third computer sends the value credential to an authorizing entity computer, which authorizes the payment transaction based on the value credential.

9. The second computer of claim 8, wherein the random value is a unique hexadecimal value, and wherein the first verification value is a dynamic value.

10. The second computer of claim 8, wherein the first verification value is not stored at the second computer.

11. The second computer of claim 8, wherein the request for the verification value further includes a token requestor identifier, wherein the stored record further includes the token requestor identifier, wherein the request to validate the first verification value further includes the token requestor identifier, and wherein the record including the random value is identified further based on the token requestor identifier.

12. A method comprising:

receiving, by a third computer, from a first computer, an authorization request message for a payment transaction, the authorization request message including a token and a first verification value;

sending, by the third computer, the token and the first verification value to a second computer, wherein the second computer identifies a random value based on the token, wherein the random value is not shared by the second computer with the first computer and the third computer, wherein the second computer generates a second verification value based on the random value and the token, and wherein the second computer determines whether the second verification value matches the first verification value and provides, to the third computer, a value credential associated with the token when the second verification value matches the first verification value and does not provide the value credential associated with the token when the second verification value does not match the first verification value;

receiving, by the third computer, from the second computer, the value credential associated with the token; and

sending, by the third computer, the authorization request message and the value credential to an authorizing entity computer, wherein the authorizing entity computer authorizes the payment transaction based on the value credential.

13. The method of claim 12, wherein the random value is a unique hexadecimal value, and wherein the first verification value is a dynamic value.

14. The method of claim 12, wherein the first verification value is not stored at the second computer.

15. The method of claim 12, wherein the authorization request message also includes a token requestor identifier, wherein the token requestor identifier is also sent to the second computer, and wherein the second computer identifies the random value further based on the token requestor identifier.

16. A third computer comprising:

a processor device; and

a non-transitory computer readable medium, the non-transitory computer readable medium comprising code, executable by the processor device, for implementing a method comprising;

receiving, from a first computer, an authorization request message for a payment transaction, the authorization request message including a token and a first verification value;

sending the token and the first verification value to a second computer, wherein the second computer identifies a random value based on the token, wherein the random value is not shared by the second computer with the first computer and the third computer, wherein the second computer generates a second verification value based on the random value and the token, and wherein the second computer determines whether the second verification value matches the first verification value and provides, to the third computer, a value credential associated with the token when the second verification value matches the first verification value and does not provide the value credential associated with the token when the second verification value does not match the first verification value;

receiving, from the second computer, the value credential associated with the token; and

sending the authorization request message and the value credential to an authorizing entity computer, wherein the authorizing entity computer authorizes the payment transaction based on the value credential.

17. The third computer of claim 16, wherein the random value is a unique hexadecimal value, and wherein the first verification value is a dynamic value.

18. The third computer of claim 16, wherein the authorization request message also includes a token requestor identifier, wherein the token requestor identifier is also sent to the second computer, and wherein the second computer identifies the random value further based on the token requestor identifier.