TOKENIZATION OF PAYMENT INFORMATION IN MOBILE ENVIRONMENTS

• US 20130212019A1
• Filed: 02/06/2013
• Published: 08/15/2013
• Est. Priority Date: 02/10/2012
• Status: Abandoned Application

• Current Assignee: Protegrity USA, Inc. (Xcelera Inc.)
• Original Assignee: Protegrity USA, Inc. (Xcelera Inc.)
• Inventors: Mattsson, Ulf, Rozenberg, Yigal
• Application Number:
  US13/761,028
• Publication Number:
  US 20130212019A1
• Time in Patent Office: Days
• US Class Current: 705/44
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06Q 20/20 Point-of-sale [POS] network systems
• CPC Class Codes: G06Q 20/322 Aspects of commerce using mobile devices [M-devices]
• CPC Class Codes: G06Q 20/3223 Realising banking transactions through M-devices
• CPC Class Codes: G06Q 20/326 Payment applications installed on the mobile devices
• CPC Class Codes: G06Q 20/34 using cards, e.g. integrated circuit [IC] cards or magnetic cards
• CPC Class Codes: G06Q 20/367 involving electronic purses or money safes
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: G06Q 20/3821 Electronic credentials
• CPC Class Codes: G06Q 20/3823 combining multiple encryption tools for a transaction
• CPC Class Codes: G06Q 20/3829 involving key management
• CPC Class Codes: G06Q 20/385 using an alias or single-use codes
• CPC Class Codes: G06Q 20/4014 Identity check for transactions
• CPC Class Codes: G06Q 20/405 Establishing or using transaction specific rules
• CPC Class Codes: G06Q 2220/00 Business processing using cryptography postage metering system using cryptography G06Q2250/05
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/03 Protecting confidentiality, e.g. by encryption

Abstract

Data can be protected in mobile and payment environments through various tokenization operations. A mobile device can tokenize communication data based on device information and session information associated with the mobile device. A payment terminal can tokenize payment information received at the payment terminal during a transaction based on transaction information associated with the transaction. Payment data tokenized first a first set of token tables and according to a first set of tokenization parameters by a first payment entity can be detokenized or re-tokenized with a second set of token tables and according to a second set of tokenization parameters. Payment information can be tokenized and sent to a mobile device as a token card based on one or more selected use rules, and a user can request a transaction based on the token card. The transaction can be authorized if the transaction satisfies the selected use rules.

Claims

1. A method for processing payment information, comprising:

receiving, at a central security system, payment information and a use rule selection specifying one or more use rules, wherein the central security system is configured to;

identify a token table associated with the selected use rules;

tokenize the payment information using the identified token table to generate a token card; and

transmit the token card to a mobile device;

receiving, at the mobile device, the token card from the central security system;

receiving, at the mobile device, a request to use the token card in a transaction;

transmitting, by the mobile device, the token card to a central payment system, wherein the central payment system is configured to;

identify the token table used to generate the token card;

identify the use rules associated with the identified token table;

determine if the identified use rules are satisfied by the transaction;

responsive to a determination that the use rules are satisfied by the transaction, detokenize the token card using the identified token table; and

transmit the detokenized token card to a payment network associated with the transaction and communicatively coupled to the central payment system.

2. The method of claim 1, wherein the payment information comprises a credit card number.

3. The method of claim 1, wherein the payment information comprises a bank account number.

4. The method of claim 1, wherein the selected use rules comprise a rule specifying a maximum purchase amount.

5. The method of claim 1, wherein the selected use rules comprise a rule specifying a geographic region.

6. The method of claim 1, wherein the selected use rules comprise a rule specifying a business.

7. The method of claim 1, wherein identifying a token table associated with the selected use rules comprises identifying a token table storing the selected use rules in a metadata field of the token table.

8. The method of claim 1, wherein identifying a token table associated with the selected use rules comprises querying a use rules table mapping use rules to associated token tables with the selected use rules to identify a token table associated with the selected use rules.

9. The method of claim 1, wherein the mobile device is configured to:

store a plurality of token cards;

in response to receiving a request to use a token card in a transaction, display a representation of one or more of the stored plurality of token cards; and

receive a selection of a displayed representation of a token card.

10. The method of claim 9, wherein each displayed representation of a stored token card comprises a display of description text associated with the token card entered by a user at the central security system.

11. The method of claim 1, wherein identifying the token table used to generate the token card comprises querying stored token tables to identify a token table including the token card as a token.

12. The method of claim 1, wherein identifying the token table used to generate the token card comprises querying, by the central payment system, the central security system with the token card to identify token table including the token card as a token.

13. The method of claim 1, wherein identifying the use rules associated with the identified token table comprises querying a metadata field of the identified token table storing use rules associated with the identified token table.

14. The method of claim 1, wherein identifying the use rules associated with the identified token table comprises querying a use rules table mapping use rules to associated token tables with an identifier for the identified token table.

15. The method of claim 1, wherein determining if the identified use rules are satisfied by the transaction comprises, for each use rule:

identifying a transaction restriction associated with each use rule; and

determining if the transaction exceeds the transaction restriction.

16. The method of claim 1, wherein the payment network is configured to authorize the transaction.

17. The method of claim 16, wherein authorizing the transaction comprises:

sending, from the payment network, an authorization request to the mobile device;

receiving, at the mobile device, an authorization in response to the authorization request; and

sending, from the mobile device, the authorization to the payment network.

18. The method of claim 17, wherein receiving an authorization comprises receiving user credentials at the mobile device.

19. A mobile device for providing payment information, configured to:

receive, from a central security system, one or more token cards, each token card associated with a set of payment information, and generated based on an associated set of use rules, the use rules specifying one or more transaction restrictions configured to restrict use of the token card in a transaction;

receive a request from a user of the mobile device to perform a transaction;

receiving from the user a selection of a token card stored at the mobile device;

transmit the selected token card to a central payment system configured to;

identify the use rules associated with the selected token card;

determine if the identified use rules are satisfied by the transaction;

responsive to a determination that the use rules are satisfied by the transaction, detokenize the token card; and

transmit the detokenized token card to a payment network associated with the transaction and communicatively coupled to the central payment system.

20. A method for processing payment information, comprising:

receiving, at a mobile device, a request to perform a transaction;

receiving, at the mobile device, a selection of a token card, the token card comprising payment information tokenized based on a set of use rules restricting the use of the token card in transactions;

transmitting, by the mobile device, the token card to a central payment system configured to detokenize the token card and transmit the payment information to a payment network associated with the transaction in response to the set of use rules being satisfied by the transaction.