Systems and methods for communicating token attributes associated with a token vault

• US 9,996,835 B2
• Filed: 07/24/2014
• Issued: 06/12/2018
• Est. Priority Date: 07/24/2013
• Status: Active Grant

• Current Assignee: Visa International Service Association (Visa, Inc.)
• Original Assignee: Visa International Service Association (Visa, Inc.)
• Inventors: Dill, Matthew, Narayan, Prasanna L., Powell, Glenn, Sheets, John, Carpenter, Andrew
• Primary Examiner(s): Obeid, Mamon
• Assistant Examiner(s): Martinez-Hernandez, Edgar R
• Application Number:
  US14/340,464
• Publication Number:
  US 20150032627A1
• Time in Patent Office: 1,419 Days
• CPC Class Codes: G06Q 20/385 using an alias or single-use codes
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 20/4016 involving fraud or risk level assessment in transaction processing
• CPC Class Codes: H04L 2209/42 Anonymization, e.g. involving pseudonyms
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 9/32 including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials

Abstract

Systems and methods for interoperable network token processing are provided. A network token system provides a platform that can be leveraged by external entities (e.g., third party wallets, e-commerce merchants, payment enablers/payment service providers, etc.) or internal payment processing network systems that have the need to use the tokens to facilitate payment transactions. A token registry vault can provide interfaces for various token requestors (e.g., mobile device, issuers, merchants, mobile wallet providers, etc.), merchants, acquirers, issuers, and payment processing network systems to request generation, use and management of tokens. The network token system further provides services such as card registration, token generation, token issuance, token authentication and activation, token exchange, and token life-cycle management.

Claims

1. A server computer for use in a payment processing system, the payment processing system comprising at least two entities operating at least two entity computers, where the at least two entities are capable of processing different parts of a single payment transaction, the server computer comprising:

a) a processor;

b) a non-transitory computer readable medium comprising code that, when executed by the processor, cause the processor to;

receive, over a first communications network, a first message from a token requestor via a first communication interface, wherein the server computer is configured to communicate with each entity in the payment processing system via a dedicated communication interface;

analyze the first message;

determine that the first message includes a request for a token;

determine a first token, wherein the first token is a substitute for a primary account identifier;

transmit, over the first communications network, the first token to a consumer device via the token requestor;

receive, over a second communications network from an entity in the payment processing system via a second communication interface, a second message comprising the first token and a token inquiry request associated with the first token in response to the entity receiving an authorization request message from a merchant computer during a transaction initiated using the first token, wherein the entity is different from a merchant associated with the merchant computer and is different from the token requestor;

analyze the second message;

determine that the second message includes the first token;

determine token attributes associated with the first token in response to analyzing the second message, wherein a token attribute represents a feature of or information about a token;

determine an identity of the entity based on at least a communication format of the second communication interface;

when the entity is identified to be an acquirer computer;

determine one or more permissions associated with the acquirer computer;

determine that the acquirer computer is authorized to obtain a subset of the determined token attributes based on the determined one or more permissions associated with the acquirer computer; and

transmit, to the acquirer computer over the second communications network, a reply message in response to the second message, the reply message including the subset of the determined token attributes that indicate whether the authorization request message is valid to be forwarded to a recipient computer in the payment processing system by the acquirer computer;

when the entity is identified to be an issuer computer;

determine one or more permissions associated with the issuer computer;

determine that the issuer computer is authorized to obtain the determined token attributes based on the determined one or more permissions associated with the issuer computer; and

transmit to the issuer computer over the second communications network, a reply message in response to the second message, the reply message including the determined token attributes that control authorization of the transaction identified in the authorization request message by the issuer computer.

2. The server computer of claim 1, wherein the second message includes at least one of a token validation request, a token management request, or a token exchange request.

3. The server computer of claim 1, wherein the first message comprises the primary account identifier, authentication data, and a token requestor identifier, and wherein the first token is transmitted to the token requestor in a token response message, which also comprises a token assurance level code.

4. The server computer of claim 2, wherein the second message includes the token validation request, wherein the token validation request includes transaction data, and wherein determining the token attributes further comprises searching a token database for transaction restrictions associated with the first token in response to receiving the second message, wherein the token attributes include the transaction restrictions.

5. The server computer of claim 2, wherein when the entity is identified to be the issuer computer, the second message includes the token management request, the token management request including instructions to activate, de-activate, or update the first token, wherein the token attributes include a status of the first token.

6. The server computer of claim 5, wherein the token management request includes instructions to update the first token, wherein the instructions to update the first token includes an updated real account identifier associated with the first token, and wherein the server computer updates a token record to include the real updated account identifier associated with the first token in response to analyzing the second message.

7. The server computer of claim 2, wherein determining the token attributes further comprises searching a token database for a token record associated with the received first token in response to analyzing the second message, determining authorized information from the token record for the identified entity, and wherein the token attributes include the authorized information from the token record.

8. The server computer of claim 1, wherein the code when executed by the processor, further cause the processor to, after transmitting the determined token attributes to the identified entity:

receive the first token from a payment processing network computer during processing of the transaction;

retrieve the primary account number associated with the first token; and

transmit the primary account number to the payment processing network computer for processing the transaction.

9. A system comprising:

a server computer for use in a payment processing system, the payment processing system comprising at least two entities operating at least two entity computers, where the at least two entities are capable of processing different parts of a single payment transaction, the server computer comprising

a) a processor,

b) a non-transitory computer readable medium comprising code that, when executed by the processor, cause the processor to

receive, over a first communications network, a first message from a first token requestor via a first communication interface, wherein the server computer is configured to communicate with each entity in the payment processing system via a dedicated communication interface,

analyze the first message,

determine that the first message includes a request for a token,

determine a first token, wherein the first token is a substitute for a primary account identifier,

transmit, over the first communications network, the first token to a consumer device via the token requestor;

receive, over a second communications network from an entity in the payment processing system via a second communication interface, a second message comprising the first token and a token inquiry request associated with the first token in response to the entity receiving an authorization request message from a merchant computer during a transaction initiated using the first token, wherein the entity is different from a merchant associated with the merchant computer and is different from the token requestor;

analyze the second message;

determine that the second message includes the first token;

determine token attributes associated with the first token in response to analyzing the second message, wherein a token attribute represents a feature of or information about a token;

determine an identity of the entity based on at least a communication format of the second communication interface;

when the entity is identified to be an acquirer computer;

determine one or more permissions associated with the acquirer computer;

determine that the acquirer computer is authorized to obtain a subset of the determined token attributes based on the determined one or more permissions associated with the acquirer computer; and

transmit, to the acquirer computer over the second communications network, a reply message in response to the second message, the reply message including the subset of the determined token attributes that indicate whether the authorization request message is valid to be forwarded to a recipient in the payment processing system by the acquirer computer;

when the entity is identified to be an issuer computer;

determine one or more permissions associated with the issuer;

determine that the issuer computer is authorized to obtain the determined token attributes based on the determined one or more permissions associated with the issuer computer; and

transmit to the issuer computer over the second communications network, a reply message in response to the second message the reply message including the determined token attributes that control authorization of the transaction identified in the authorization request message by the issuer computer; and

a database coupled to the server computer, the database comprising a plurality of payment tokens.

10. A method comprising:

receiving, by a server computer over a first communications network, a first message from a token requestor via a first communication interface, wherein the server computer is configured to communicate with each entity in the payment processing system via a dedicated communication interface;

analyzing, by the server computer, the first message;

determining, by the server computer, that the first message includes a request for a token;

determining, by the server computer, a first token, wherein the first token is a substitute for a primary account identifier;

transmitting, by the server computer over the first communications network, the first token to a consumer device via the token requestor;

receiving, by the server computer over a second communications network from an entity in the payment processing system via a second communication interface, a second message comprising the first token and a token inquiry request associated with the first token in response to the entity receiving an authorization request message from a merchant computer during a transaction initiated using the first token, wherein the entity is different from a merchant associated with the merchant computer and is different from the token requestor;

analyzing, by the server computer, the second message;

determining, by the server computer, that the second message includes the first token;

determining, by the server computer, token attributes associated with the first token in response to analyzing the second message, wherein a token attribute represents a feature of or information about a token;

determining, by the server computer, an identity of the entity based on at least communication format of the second communication interface;

when the entity is identified to be an acquirer computer;

determining, by the server computer, one or more permissions associated with the acquirer computer;

determining, by the server computer, that the acquirer computer is authorized to obtain a subset of the determined token attributes based on the determined one or more permissions associated with the acquirer computer; and

transmitting, by the server computer to the acquirer computer over the second communications network, a reply message in response to the second message, the reply message including the subset of the determined token attributes that indicate whether the authorization request message is valid to be forwarded to a recipient in the payment processing system by the acquirer computer;

when the entity is identified to be an issuer computer;

determine one or more permissions associated with the issuer computer;

determine that the issuer computer is authorized to obtain the determined token attributes based on the determined one or more permissions associated with the issuer computer; and

transmit, to the issuer computer over the second communications network a reply message in response to the second message the reply message including the determined token attributes that control authorization of the transaction identified in the authorization request message by the issuer computer.

11. The method of claim 10, wherein the second message includes at least one of a token validation request, a token exchange request, or a token management request.

12. The method of claim 10, wherein the first message comprises the primary account identifier, authentication data, and a token requestor identifier, and wherein the first token is transmitted to the token requestor in a token response message which also comprises a token assurance level code.

13. The method of claim 11, wherein the second message includes the token validation request, wherein the token validation request includes transaction data, and wherein determining the token attributes further comprises searching a token database for transaction restrictions associated with the first token in response to receiving the second message, wherein the token attributes include the transaction restrictions.

14. The method of claim 11, wherein when the entity is identified to be the issuer computer, the second message includes the token management request, the token management request including instructions to activate, de-activate, or update the first token, wherein the token attributes include a status of the first token.

15. The method of claim 14, wherein the token management request includes instructions to update the first token, wherein the instructions to update the first token includes an updated real account identifier associated with the first token, and wherein the server computer updates a token record to include the real updated account identifier associated with the first token in response to analyzing the second message.

16. The method of claim 11, wherein determining the token attributes further comprises searching a token database for a token record associated with the received first token in response to analyzing the second message, determining authorized information from the token record for the identified entity, and wherein the token attributes include the authorized information from the token record.

17. The method of claim 11 further comprising, after transmitting the determined token attributes to the identified entity:

receiving the first token from a payment processing network computer during processing of the transaction;

retrieving the primary account number associated with the first token; and

transmitting the primary account number to the payment processing network computer for processing the transaction.