Token enrollment system and method

• US 10,412,060 B2
• Filed: 05/29/2018
• Issued: 09/10/2019
• Est. Priority Date: 10/22/2014
• Status: Active Grant

• Current Assignee: Visa International Service Association (Visa, Inc.)
• Original Assignee: Visa International Service Association (Visa, Inc.)
• Inventors: Narayan, Prasanna L., Palanisamy, Karthikeyan, Sethuraman, Ramji
• Primary Examiner(s): Avery, Jeremiah L
• Application Number:
  US15/991,914
• Publication Number:
  US 20180295104A1
• Time in Patent Office: 469 Days
• Field of Search: None
• CPC Class Codes: H04L 2209/24 Key scheduling, i.e. generating round keys or sub-keys for block encryption
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2463/102 applying security measure for e-commerce data processing systems or methods, specially adapted for e-commerce G06Q30/00
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/083 involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms

Abstract

Embodiments of the invention are directed to methods, apparatuses, computer readable media and systems for providing a token service environment that allows a token requesting party (e.g. token requestor) to specify parameters for token generation for controlling and customizing the token generation process. For example, the token requesting party may specify (e.g. select from a list or provide a list of) the accounts for tokenization. The accounts may be identified by account identifiers (e.g. account numbers) or bank identification numbers (BINs). The token requesting party may also specify encryption keys for the tokens to be generated. The token requesting party may also specify additional parameters such as notification thresholds indicating when notifications associated with the tokens are to be generated.

Claims

1. A method comprising:

providing, by a token server computer operated by a token service provider, an interface to a party, wherein the party controls generation of payment tokens for account identifiers associated with accounts issued the party via the interface;

receiving, at the token server computer, a plurality of sets of account identifiers from a computer operated by the party via the interface;

receiving, at the token server computer, a request to generate payment tokens for the plurality of sets of account identifiers such that each generated payment token represents an account identifier among the plurality of sets of account identifiers;

for each account identifier in the plurality of sets of account identifiers;

determining, by the token server computer, whether the account identifier is eligible for tokenization, wherein the determining includes;

searching, by the token server computer, a token database for an entry associated with the account identifier;

if the token database includes the entry associated with the account identifier;

identifying the account identifier as ineligible for tokenization,

transmitting a message to the party indicating that the account identifier is ineligible for tokenization, and

selecting a next account identifier among the plurality of sets of account identifiers; and

if the token database does not include the entry associated with the account identifier;

identifying the account identifier as eligible for tokenization,

generating, by the token server computer, a payment token for the account identifier, wherein the payment token for the account identifier substitutes the account identifier in a payment transaction initiated using the payment token;

creating a new entry in the token database to store the payment token associated with corresponding account identifier; and

selecting the next account identifier among the plurality of sets of account identifiers.

2. The method of claim 1, further comprising:

receiving, at the token server computer, a notification criteria from the computer operated by the party via the interface; and

sending, by the token server computer, a notification to the computer operated by the party when a token satisfies the notification criteria.

3. The method of claim 2, wherein the notification criteria includes generation of the token or provisioning of the token.

4. The method of claim 1, further comprising:

receiving, at the token server computer, provisioning parameters for the payment token via the interface, wherein the provisioning parameters include one or more of risk decision rules, design elements or provisioning conditions; and

provisioning, by the token server computer, the payment token on a user device based on the provisioning parameters.

5. The method of claim 1, further comprising:

receiving, at the token server computer, an identification of an entity for managing the payment token via the interface; and

assigning management rights of the payment token to the entity.

6. A token server computer operated by a token service provider, comprising:

one or more processors;

a non-transitory computer readable storage medium communicatively coupled with the one or more processors and storing instructions which, when executed by the one or more processors, cause the token server computer to;

provide an interface to a party, wherein the party controls generation of payment tokens for account identifiers associated with accounts issued the party via the interface;

receive a plurality of sets of account identifiers from a computer operated by the party via the interface;

receive a request to generate payment tokens for the plurality of sets of account identifiers such that each generated payment token represents an account identifier among the plurality of sets of account identifiers;

for each account identifier in the plurality of sets of account identifiers;

determine whether the account identifier is eligible for tokenization, wherein determining includes;

searching a token database for an entry associated with the account identifier;

if the token database includes the entry associated with the account identifier;

identifying the account identifier as ineligible for tokenization,

transmitting a message to the party indicating that the account identifier is ineligible for tokenization, and

selecting a next account identifier among the plurality of sets of account identifiers; and

if the token database does not include the entry associated with the account identifier;

identifying the account identifier as eligible for tokenization,

generating a payment token for the account identifier, wherein the payment token for the account identifier substitutes the account identifier in a payment transaction initiated using the payment token;

creating a new entry in the token database to store the payment token associated with corresponding account identifier; and

selecting the next account identifier among the plurality of sets of account identifiers.

7. The token server computer of claim 6, wherein the instructions which, when executed by the one or more processors, further cause the token server computer to:

receive a notification criteria from the computer operated by the party via the interface; and

send a notification to the computer operated by the party when a token satisfies the notification criteria.

8. The token server computer of claim 7, wherein the notification criteria includes generation of the token or provisioning of the token.

9. The token server computer of claim 6, wherein the instructions which, when executed by the one or more processors, further cause the token server computer to:

receive provisioning parameters for the payment token via the interface, wherein the provisioning parameters include one or more of risk decision rules, design elements or provisioning conditions; and

provision the payment token on a user device based on the provisioning parameters.

10. The token server computer of claim 6, wherein the instructions which, when executed by the one or more processors, further cause the token server computer to:

receive an identification of an entity for managing the payment token via the interface; and

assign management rights of the payment token to the entity.