Tokenization capable authentication framework
First Claim
1. A method comprising:
- receiving, by a first server computer, transaction data associated with a tokenized transaction initiated by a user;
determining, by the first server computer, that the transaction data includes a token, wherein the token comprises tokenized credentials;
initiating, by the first server computer, a user authentication process in connection with the tokenized transaction prior to a transaction authorization process in connection with the tokenized transaction, wherein the user authentication process includes;
identifying, by the first server computer, a token service provider among a plurality of token service providers;
sending, by the first server computer, the token to the token service provider to detokenize the token comprising the tokenized credentials to form detokenized credentials;
receiving, by the first server computer, from the token service provider, the detokenized credentials;
forwarding, by the first server computer, the detokenized credentials to a second server computer for authentication; and
receiving, by the first server computer, the detokenized credentials and an authentication value from the second server computer upon the second server computer authenticating the detokenized credentials before the transaction authorization process starts,wherein the authentication value and the token are incorporated into a transaction authorization request message after the transaction authorization process in connection with the tokenized transaction starts, andwherein the transaction authorization request message associated with the tokenized transaction includes at least the token and the authentication value.
1 Assignment
0 Petitions
Accused Products
Abstract
Embodiments are directed to systems and methods for performing consumer authentication in a tokenized transaction. The token in the authentication request may be resolved to corresponding credentials before the consumer authentication process is initiated. As part of an authentication system, the merchant computer may include a merchant plug-in module as a proxy between the merchant computer and an issuer access control server. The merchant plug-in module may communicate with the issuer access control server by sending verification and authentication messages to the issuer access control server via a directory server. The token may be resolved to corresponding credentials before the authentication request reaches the issuer access computer for authentication. The merchant plug-in module, the directory server or a token router coupled to the issuer access control server may each be in communication with one or more token service providers to de-tokenize the token provided by the consumer'"'"'s user device.
529 Citations
18 Claims
-
1. A method comprising:
-
receiving, by a first server computer, transaction data associated with a tokenized transaction initiated by a user; determining, by the first server computer, that the transaction data includes a token, wherein the token comprises tokenized credentials; initiating, by the first server computer, a user authentication process in connection with the tokenized transaction prior to a transaction authorization process in connection with the tokenized transaction, wherein the user authentication process includes; identifying, by the first server computer, a token service provider among a plurality of token service providers; sending, by the first server computer, the token to the token service provider to detokenize the token comprising the tokenized credentials to form detokenized credentials; receiving, by the first server computer, from the token service provider, the detokenized credentials; forwarding, by the first server computer, the detokenized credentials to a second server computer for authentication; and receiving, by the first server computer, the detokenized credentials and an authentication value from the second server computer upon the second server computer authenticating the detokenized credentials before the transaction authorization process starts, wherein the authentication value and the token are incorporated into a transaction authorization request message after the transaction authorization process in connection with the tokenized transaction starts, and wherein the transaction authorization request message associated with the tokenized transaction includes at least the token and the authentication value. - View Dependent Claims (2, 3, 4, 5, 6)
-
-
7. A server computer comprising:
-
a processor and a computer readable medium coupled to the processor, the computer readable medium comprising instructions that, when executed by the processor, cause the processor to; receive transaction data associated with a tokenized transaction initiated by a user; determine that the transaction data includes a token, wherein the token comprises tokenized credentials; initiate a user authentication process in connection with the tokenized transaction prior to a transaction authorization process in connection with the tokenized transaction, wherein the user authentication process includes; identifying a token service provider among a plurality of token service providers; sending the token to the token service provider to detokenize the token comprising the tokenized credentials to form detokenized credentials; receiving from the token service provider the detokenized credentials; forwarding the detokenized credentials to a second server computer for authentication; and receiving the detokenized credentials and an authentication value from the second server computer upon the second server computer authenticating the detokenized credentials before the transaction authorization process starts, wherein the authentication value and the token are incorporated into a transaction authorization request message after the transaction authorization process in connection with the tokenized transaction starts, and wherein the transaction authorization request message associated with the tokenized transaction includes at least the token and the authentication value. - View Dependent Claims (8, 9, 10, 11)
-
-
12. A system comprising:
-
a first server computer including a first processor and a first computer readable medium coupled to the first processor, the first computer readable medium comprising instructions that, when executed by the first processor, cause the first processor to; receive transaction data associated with a tokenized transaction initiated by a user; determine that the transaction data includes a token, wherein the token comprises tokenized credentials; initiate a user authentication process in connection with the tokenized transaction prior to a transaction authorization process in connection with the tokenized transaction, wherein the user authentication process includes; identifying a token service provider among a plurality of token service providers; sending the token to the token service provider to detokenize the token comprising the tokenized credentials to form detokenized credentials; and receiving from the token service provider the detokenized credentials; and a second server computer including a second processor and a second computer readable medium coupled to the second processor, the second computer readable medium comprising instructions that, when executed by the second processor, cause the second processor to; receive the detokenized credentials directly or indirectly from the first server computer for authentication; authenticate the detokenized credentials; generate an authentication value upon authenticating the detokenized credentials; and send the detokenized credentials and the authentication value to the first server computer before the transaction authorization process starts, wherein the token and the authentication value are incorporated into a transaction authorization request message after the transaction authorization process in connection with the tokenized transaction starts, and wherein the transaction authorization request message associated with the tokenized transaction includes at least the token and the authentication value. - View Dependent Claims (13, 14)
-
-
15. A method comprising:
-
receiving, by a first server computer, transaction data associated with a tokenized transaction initiated by a user; determining, by the first server computer, that the transaction data includes a token wherein the token comprises tokenized credentials; initiating, by the first server computer, a user authentication process in connection with the tokenized transaction prior to a transaction authorization process in connection with the tokenized transaction, wherein the user authentication process includes; identifying, by the first server computer, a token service provider among a plurality of token service providers; sending, by the first server computer, the token to the token service provider to detokenize the tokenized credentials to form detokenized credentials; and receiving, by the first server computer, the detokenized credentials that were replaced with the token from the token service provider; receiving, by a second server computer, the detokenized credentials directly or indirectly from the first server computer for authentication; authenticating, by the second server computer, the detokenized credentials; generating, by the second server computer, an authentication value upon authenticating the detokenized credentials; and sending, by the second server computer, the detokenized credentials and the authentication value to the first server computer before the transaction authorization process starts, wherein the token and the authentication value are incorporated into a transaction authorization request message after the transaction authorization process in connection with the tokenized transaction starts, and wherein the transaction authorization request message associated with the tokenized transaction includes at least the token and the authentication value. - View Dependent Claims (16, 17, 18)
-
Specification