System and method for a self-calculating token vault
A system and method for electronic payment that involves generating and then using a temporary token based on a legacy PAN (Primary Account Number) to conduct an electronic transaction. The token is generated by transforming the PAN using specific inputs such that the original PAN can be recovered by manipulating the token in various ways as disclosed herein. One potential manipulation that may be used is encryption/decryption. The token is transmitted to a portable electronic device such that the portable electronic device may present the token to a point-of-sale device. The POS communicates the token to a server which validates the token by, among other things, recovering the PAN. If the PAN is recovered as expected a validation message is returned to the POS device.
1. A system for electronic payment comprising:
a portable electronic device including an electromagnetic communication device, a client-side processor, and a client-side non-transitory digital storage coupled to the client-side processor storing logic that when executed by the client-side processor causes the portable electronic device to:
obtain an original PAN and a PIN from a user of the portable electronic device,
transmit the original PAN and the PIN to a server on a token creation date, record the token creation date in association with the client-side non-transitory digital storage,
receive a temporary token from a server and store the temporary token in the client-side non-transitory digital storage,
at the time of a transaction, accept user input of a transaction PIN, decrypt the temporary token using the token creation date, a unique decryption key stored in association with the client-side non-transitory digital storage and the transaction PIN, and
present the decrypted temporary token to a point-of-sale device via the electromagnetic communication device; and
a server including a network interface, a server-side processor, and a server-side non-transitory digital storage coupled to the server-side processor storing the original PAN in association with a unique encryption key associated with the unique decryption key, the PIN and the token creation date, the server-side non-transitory digital storage also storing logic that when executed by the server-side processor causes the server to
receive the original PAN and the PIN from the portable electronic device;
record the token creation date associated with receipt of the original PAN and the PIN;
generate a temporary token based on the original PAN by
(a) splitting the original PAN, S, into S1 and S2,
(b) padding S2 with a predetermined constant to form S2′,
(c) encrypting S2′ to form CS2′ using the unique encryption key, the PIN, and the token creation date, and
(d) concatenating S1 and CS2′;
transmit the temporary token to the portable electronic device via the network interface;
receive the PIN and the decrypted temporary token from the point-of-sale device; and
validate the decrypted temporary token using the PIN and the token creation date and return a validation message to the point-of-sale device upon validation.
2. A method of electronic payment comprising:
obtaining on a portable electronic device, an original PAN and a PIN from a user of the portable electronic device;
transmitting the original PAN and the PIN from the portable electronic device to a server on a token creation date;
saving the token creation date on non-transitory digital storage associated with the portable electronic device;
receiving, on the server, the original PAN and the PIN from the portable electronic device;
recording the token creation date associated with receipt of the original PAN and the PIN on non-transitory digital storage associated with the server;
generating a temporary token based on the original PAN by
(a) splitting the original PAN, S, into S1 and S2,
(b) padding S2 with a predetermined constant to form S2′,
(c) encrypting S2′ to form CS2′ using a unique encryption key, the PIN, and the token creation date, and
(d) concatenating S1 and CS2′;
transmitting the temporary token to the portable electronic device;
receiving the temporary token from the server;
storing the temporary token in the non-transitory digital storage associated with the portable electronic device;
at the time of a transaction, accepting user input of a transaction PIN, decrypting the temporary token using the token creation date, a unique decryption key and the transaction PIN stored in the non-transitory digital storage associated with the portable electronic device, and
using the portable electronic device to present the decrypted temporary token to a point-of-sale device;
validating the decrypted temporary token on the server using the unique encryption key, the transaction PIN and the token creation date; and
returning a validation message to the point-of-sale device.