Token enrollment system and method

• US 10,015,147 B2
• Filed: 10/22/2015
• Issued: 07/03/2018
• Est. Priority Date: 10/22/2014
• Status: Active Grant

• Current Assignee: Visa International Service Association (Visa, Inc.)
• Original Assignee: Visa International Service Association (Visa, Inc.)
• Inventors: Narayan, Prasanna L., Palanisamy, Karthikeyan, Sethuraman, Ramji
• Primary Examiner(s): Avery, Jeremiah
• Application Number:
  US14/920,618
• Publication Number:
  US 20160119296A1
• Time in Patent Office: 985 Days
• Field of Search: None
• CPC Class Codes: H04L 2209/24 Key scheduling, i.e. generating round keys or sub-keys for block encryption
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2463/102 applying security measure for e-commerce data processing systems or methods, specially adapted for e-commerce G06Q30/00
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/083 involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms

Abstract

Embodiments of the invention are directed to methods, apparatuses, computer readable media and systems for providing a token service environment that allows a token requesting party (e.g. token requestor) to specify parameters for token generation for controlling and customizing the token generation process. For example, the token requesting party may specify (e.g. select from a list or provide a list of) the accounts for tokenization. The accounts may be identified by account identifiers (e.g. account numbers) or bank identification numbers (BINs). The token requesting party may also specify encryption keys for the tokens to be generated. The token requesting party may also specify additional parameters such as notification thresholds indicating when notifications associated with the tokens are to be generated.

Claims

1. A method comprising:

providing, by a token server computer operated by a token service provider, an interface to a party, wherein the party controls generation of payment tokens for account identifiers via the interface;

receiving, at the token server computer, a set of account identifiers from a computer operated by the party via the interface;

receiving, at the token server computer, one or more encryption keys from the computer operated by the party via the interface;

receiving, at the token server computer, a request to generate payment tokens for the set of account identifiers using the one or more encryption keys such that each generated payment token represents an account identifier among the set of account identifiers;

for each account identifier in the set of account identifiers;

determining, by the token server computer, a payment token based on the one or more encryption keys provided by the party, wherein the payment token determined for an account identifier substitutes the account identifier in a payment transaction initiated using the payment token, wherein a format of the payment token is similar to a format of the account identifier substituted by the payment token; and

storing the payment token and associated encryption keys for later use in token transaction processing.

2. The method of claim 1, further comprising:

receiving, at the token server computer, a notification criteria from the computer operated by the party via the interface; and

sending, by the token server computer, a notification to the computer operated by the party when the payment token satisfies the notification criteria.

3. The method of claim 2, wherein the notification criteria includes generation of the payment token or provisioning of the payment token.

4. The method of claim 1, further comprising:

receiving, by the token server computer from the computer operated by the party via the interface, an instruction instructing using the one or more encryption keys provided by the party during generation of the payment tokens.

5. The method of claim 1, further comprising:

receiving, at the token server computer, a restriction to be placed on one or more of the generated payment tokens from the computer operated by the party via the interface.

6. The method of claim 1, wherein receiving the set of account identifiers from the computer operated by the party further comprises:

presenting, by the token server computer, a list of a plurality of account identifiers via the interface; and

receiving, at the token server computer, a selection of the set of account identifiers on the list of the plurality of account identifiers from the computer operated by the party via the interface.

7. The method of claim 1, wherein receiving the set of account identifiers from the computer operated by the party further comprises:

receiving, at the token server computer, a file containing the set of account identifiers from the computer operated by the party via the interface.

8. The method of claim 1, further comprising:

receiving, at the token server computer, provisioning parameters for the generated payment tokens via the interface, wherein the provisioning parameters include one or more of risk decision rules, design elements or provisioning conditions; and

provisioning, by the token server computer, the generated payment tokens on user devices based on the provisioning parameters.

9. A token server computer operated by a token service provider, comprising:

one or more processors;

a non-transitory computer readable storage medium communicatively coupled with the one or more processors and storing instructions which, when executed by the one or more processors, cause the token server computer to;

provide an interface to a party, wherein the party controls generation of payment tokens for account identifiers via the interface;

receive a set of account identifiers from a computer operated by the party via the interface;

receive one or more encryption keys from the computer operated by the party via the interface;

receive a request to generate payment tokens for the set of account identifiers using the one or more encryption keys such that each generated payment token represents an account identifier among the set of account identifiers;

for each account identifier in the set of account identifiers;

determine a payment token based on the one or more encryption keys provided by the party, wherein the payment token determined for an account identifier substitutes the account identifier in a payment transaction initiated using the payment token, wherein a format of the payment token is similar to a format of the account identifier substituted by the payment token; and

a token vault for storing the payment token and associated encryption keys for later use in token transaction processing.

10. The token server computer of claim 9, further including:

a notification module for;

receiving a notification criteria to generate one or more notifications from the computer operated by the party via the interface;

generating a notification when the payment token satisfies the notification criteria; and

sending the notification to the computer operated by the party.

11. The token server computer of claim 9, wherein instructions to receive a set of account identifiers from a computer operated by the party further comprises instructions to:

present a list of a plurality of account identifiers via the interface; and

receive a selection of the set of account identifiers on the list of the plurality of account identifiers from the computer operated by the party via the interface.

12. The token server computer of claim 9, wherein instructions to receive a set of account identifiers from a computer operated by the party further comprises instructions to:

receive a file containing the set of account identifiers from the computer operated by the party via the interface.

13. A method comprising:

accessing, by a computer operated by a party, an interface provided by a token server computer operated by a token service provider to control generation of payment tokens for account identifiers;

providing, by the computer operated by the party, a set of account identifiers to the token server computer via the interface;

providing, by the computer operated by the party, one or more encryption keys to the token server computer via the interface;

providing, by the computer operated by the party to the token server computer via the interface, an instruction to generate a set of payment tokens using the one or more encryption keys provided by the computer operated by the party; and

customizing, by the computer operated by the party, generation of payment tokens by the token server computer, wherein a payment token associated with at least one encryption key is generated for each account identifier of the set of account identifiers for later use in token transaction processing, wherein a payment token generated for an account identifier substitutes the account identifier in a payment transaction initiated using the payment token, wherein a format of the payment token is similar to a format of the account identifier substituted by the payment token.

14. The method of claim 13, further comprising:

providing, by the computer operated by the party, a notification criteria to receive one or more notifications from the token server computer via the interface, wherein the notification criteria includes generation of the payment token or provisioning of the payment token on a user device; and

receiving, by the computer operated by the party, a notification from the token server computer when the payment token satisfies the notification criteria.

15. The method of claim 13, further comprising:

selecting, by the computer operated by the party, the set of account identifiers on a list of a plurality of account identifiers provided by the token server computer via the interface.

16. The method of claim 13, wherein providing a set of account identifiers to the token server computer further comprises:

providing, by the computer operated by the party, a file containing the set of account identifiers to the token server computer via the interface.

17. The method of claim 13, further comprising:

providing, by the computer operated by the party, provisioning parameters for the generated payment tokens via the interface, wherein the provisioning parameters include one or more of risk decision rules, design elements or provisioning conditions; and

receiving, by the computer operated by the party, a notification from the token server computer when the generated payment tokens are provisioned on user devices based on the provisioning parameters.