Tokenization revocation list

• US 9,978,094 B2
• Filed: 10/10/2014
• Issued: 05/22/2018
• Est. Priority Date: 10/11/2013
• Status: Active Grant

• Current Assignee: Visa International Service Association (Visa, Inc.)
• Original Assignee: Visa International Service Association (Visa, Inc.)
• Inventors: Gaddam, Ajit, Aissi, Selim, Nagasundaram, Sekhar
• Primary Examiner(s): Misiaszek, Michael
• Assistant Examiner(s): Todd, Matthew W
• Application Number:
  US14/512,231
• Publication Number:
  US 20150106239A1
• Time in Patent Office: 1,320 Days
• CPC Class Codes: G06F 16/951 Indexing; Web crawling techniques
• CPC Class Codes: G06Q 20/08 Payment architectures
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 30/0637 Approvals

Abstract

A method for providing a token revocation list is disclosed. The method includes maintaining a status for each of a plurality of tokens in a token revocation database. Token validation requests are received, and the statuses of payment tokens can be determined. Response messages with the statuses of the payment tokens are then sent to token status requesters so that they may make decisions on whether or not to use them to process transactions.

Claims

1. A method comprising:

generating, by a token revocation list computer system, a status for each of a plurality of tokens issued by a server computer that is coupled with a token revocation database of the token revocation list computer system, wherein the plurality of tokens are generated by a plurality of different entities;

maintaining, by the token revocation list computer system, the status for each of the plurality of tokens in a token revocation list, and wherein the token revocation list is centrally stored;

receiving, by the token revocation list computer system, a token validation request from a requester, wherein the token validation request includes at least one payment token of the plurality of tokens, a digital signature of the requester, and a public key;

determining, by the token revocation list computer system, the status of the at least one payment token of the plurality of tokens included in the token validation request by searching the token revocation database for the status of the at least one of the plurality of tokens;

determining, by the token revocation list computer system, if the requester is authorized to validate the at least one payment token by validating the digital signature of the requester with the public key;

generating, by the token revocation list computer system, a token validation response in accordance with the token validation request and the status of the token in the token revocation list; and

sending, by a token revocation list computer system, the token validation response including the determined status of the at least one payment token of the plurality of tokens to the requester,

wherein in response to the determined status of the at least one payment token of the plurality of tokens being valid, completing a payment transaction.

2. The method of claim 1, wherein the at least one of the plurality of tokens was sent to the requester by a consumer or merchant.

3. The method of claim 1, further comprising:

determining, by the server computer, that the requester is registered with the token revocation list computer system for sending token validation requests.

4. The method of claim 1 wherein the status is at least one of on hold, revoked, or active.

5. The method of claim 1 wherein the token validation request comprises one or more of a requester name, hashed information, the at least one payment token, and a nonce.

6. The method of claim 1 wherein the token validation response comprises one or more of token response status, a TRL computer system ID, a timestamp, a nonce, hashed information, the at least one payment token and a TRL computer system status code.

7. The method of claim 1 wherein the token validation response is sent to a requester device.

8. The method of claim 1 wherein the token validation request and response are transmitted through a communications network that is insecure.

9. The method of claim 1 wherein the at least one payment token is a single payment token that is a pseudo account number with a same format as a real account identifier associated with a payment account associated with a consumer.

10. The method of claim 9 wherein the payment account is a credit card account.

11. The method of claim 1, further comprising consolidating, by the token revocation list computer system, payment tokens generated by a plurality of different entities in the token revocation list.

12. The method of claim 1, wherein the token revocation list is accessible by a plurality of different types of requester devices in order to check the status of a payment token.

13. The method of claim 1, wherein the payment token is associated with a payment account that is a substitute for an account identifier.

14. The method of claim 1, wherein the payment token comprises a series of alphanumeric characters that is a substitute for an account identifier.

15. A token revocation list computer system comprising:

a token status list database; and

token status list computer comprising a processor, and a computer readable medium coupled to the processor, the computer readable medium comprising, code executable by the processor, to implement a method comprising;

generating, by a token revocation list computer system, a status for each of a plurality of tokens issued by a server computer that is coupled with a token revocation database of the token revocation list computer system, wherein the plurality of tokens are generated by a plurality of different entities;

maintaining the status for each of the plurality of tokens in a token revocation list, and wherein the token revocation list is centrally stored;

receiving a token validation request from a requester, wherein the token validation request includes at least one payment token of the plurality of tokens, a digital signature of the requester, and a public key;

determining the status of the at least one of the plurality of tokens by searching the token revocation database for the status of the at least one payment token of the plurality of tokens included in the token validation request;

determining, by the token revocation list computer system, if the requester is authorized to validate the at least one payment token by validating the digital signature of the requester with the public key;

generating, by the token revocation list computer system, a token validation response in accordance with the token validation request and the status of the token in the token revocation list; and

sending the token validation response including the determined status of the at least one payment token of the plurality of tokens to the requester,

wherein in response to the determined status of the at least one payment token of the plurality of tokens being valid, completing a payment transaction.

16. The token revocation list computer system of claim 15 wherein the status is at least one of hold, revoked, or active.

17. The token revocation list computer system of claim 15 wherein the token validation request comprises one or more of a requester name, hashed information, the at least one payment token, and a nonce.

18. The token revocation list computer system of claim 15 wherein the token validation response comprises one or more of token response status, a TRL computer system ID, a timestamp, a nonce, hashed information, the at least one payment token and a TRL computer system status code.

19. A token validation system comprising:

a requester device; and

a token revocation list computer system in communication with the requester device, the token revocation list computer system comprising (a) a token status list database, and (b) a token status list computer comprising a processor, and a computer readable medium coupled to the processor, the computer readable medium comprising, code executable by the processor, to implement a method comprising;

generating, by a token revocation list computer system, a status for each of a plurality of tokens issued by a server computer that is coupled with a token revocation database of the token revocation list computer system, wherein the plurality of tokens are generated by a plurality of different entities;

maintaining the status for each of the plurality of in a token revocation list, and wherein the token revocation list is centrally stored;

receiving a token validation request from a requester, wherein the token validation request includes at least one payment token of the plurality of tokens, a digital signature of the requester, and a public key;

determining the status of the at least one of the plurality of tokens included in the token validation request by searching the token revocation database for the status of the at least one payment token of the plurality of tokens;

determining, by the token revocation list computer system, if the requester is authorized to validate the at least one payment token by validating the digital signature of the requester with the public key;

generating, by the token revocation list computer system, a token validation response in accordance with the token validation request and the status of the token in the token revocation list; and

sending the token validation response including the determined status of the at least one payment token of the plurality of tokens to the requester,

wherein in response to the determined status of the at least one payment token of the plurality of tokens being valid, completing a payment transaction.

20. The token validation system of claim 19 further comprising:

a token provider system in communication with the token revocation list computer system.

21. The token validation system of claim 19 wherein the token validation request comprises a requester name, hashed information, the at least one payment token, and a nonce.

22. The token validation system of claim 21 wherein the token validation response comprises a token response status, a TRL computer system ID, a timestamp, a nonce, hashed information, the at least one payment token and a TRL computer system status code.

23. The token validation system of claim 21, wherein the requester device comprises a merchant device.