Mirrored token vault
Embodiments are directed to a first token vault managed by a token service provider and a second token vault managed by a second entity. The first token vault is continuously synchronized with the second token vault in real-time. That is, the data in the second token vault is updated simultaneously with or immediately after the data in the first token vault is updated. In some embodiments, the first token vault may be a master token vault and the second token vault may be a mirror token vault. The mirror token vault may store the same information as the master token vault. Alternatively, the mirror token vault may store a subset of the information stored at the master token vault. In other embodiments, the information stored at the first token vault and the information stored at the second token vault may be mutually exclusive.
1. A method for storing a token and data associated with the token at a first token vault and a second token vault, the method comprising:
receiving, by a server computer, an authorization request message including the token, wherein the authorization request message is associated with a transaction;
retrieving, by the server computer, an account identifier represented by the token and data associated with the token from the first token vault, wherein the account identifier is associated with a user account, wherein the first token vault storing a first set of data associated with the token is synchronized with the second token vault storing a second set of data associated with the token;
transmitting, by the server computer to an authorizing entity, a modified authorization request message including the token and the data associated with the token, wherein the data associated with the token includes at least the account identifier;
receiving, by the server computer from the authorizing entity, an authorization response message authorizing or declining the transaction, wherein the authorizing entity retrieves additional data associated with the token from the second token vault and approves or declines the transaction based on at least the additional data.
2. The method of claim 1 , further comprising:
generating, by the server computer, the token representing the account identifier associated with the user account;
storing, by the server computer, the token and a mapping between the token and the account identifier at a first token vault, wherein the server computer manages the first token vault;
synchronizing, by the server computer, the first token vault with the second token vault.
3. The method of claim 1 , further comprising:
upon receiving the authorization request message including the token, retrieving the token from the authorization request message;
transmitting the token to a token generator service computer to retrieve the account identifier represented by the token from the first token vault, wherein the token generator service computer manages the first token vault.
4. The method of claim 1 , wherein the first set of data and the second set of data are mutually exclusive.
5. The method of claim 1 , wherein the first set of data and the second set of data are non-mutually exclusive.
6. The method of claim 1 , wherein the data associated with the token retrieved from the first token vault includes one or more of a token status indicator, a device identifier associated with the token, a token expiration date, an account identifier expiration date, a token assurance level, a token type, and a token requestor identifier.
7. The method of claim 1 , wherein the additional data is only stored at the second token vault.
8. The method of claim 1 , wherein the additional data includes a domain restriction associated with the token, wherein the domain restriction limits use of the token to a particular domain.
9. The method of claim 1 , wherein the transaction is approved or declined based on a combination of data retrieved from the first token vault and data retrieved from the second token vault.
10. The method of claim 1 , wherein the second token vault stores override data associated with the token.
11. The method of claim 1 , wherein a computer of the authorizing entity is configured to receive the modified authorization request message, and generate and transmit the authorization response message.
12. The method of claim 1 , wherein the first token vault is continuously synchronized with the second token vault immediately after content of the first token vault is modified.
13. A server computer comprising:
a processor; and
a computer readable medium, the computer readable medium comprising code that, when executed by the processor, causes the processor to:
receive an authorization request message including a token, wherein the authorization request message is associated with a transaction;
retrieve an account identifier represented by the token and data associated with the token from a first token vault, wherein the account identifier is associated with a user account, wherein the first token vault storing a first set of data associated with the token is synchronized with a second token vault storing a second set of data associated with the token;
transmit, to an authorizing entity, a modified authorization request message including the token and the data associated with the token, wherein the data associated with the token includes at least the account identifier;
receive, from the authorizing entity, an authorization response message authorizing or declining the transaction, wherein the authorizing entity retrieves additional data associated with the token from the second token vault and approves or declines the transaction based on at least the additional data.
14. The server computer of claim 13 , wherein the code, when executed by the processor, further causes the processor to:
generate the token representing the account identifier associated with the user account;
store the token and a mapping between the token and the account identifier at the first token vault, wherein the server computer manages the first token vault;
synchronize the first token vault with the second token vault.
15. The server computer of claim 13 , wherein the code, when executed by the processor, further causes the processor to:
upon receiving the authorization request message including the token, retrieve the token from the authorization request message;
transmit the token to a token generator service computer to retrieve the account identifier represented by the token from the first token vault, wherein the token generator service computer manages the first token vault.
16. The server computer of claim 13 , wherein a computer of the authorizing entity is configured to receive the modified authorization request message, and generate and transmit the authorization response message.
17. The server computer of claim 13 , wherein the first token vault is continuously synchronized with the second token vault immediately after content of the first token vault is modified.
18. A method for storing a token and data associated with the token at a first token vault and a second token vault, the method comprising:
generating, by a server computer, a token representing an account identifier associated with a user account;
storing, by the server computer, the token and a mapping between the token and the account identifier at the first token vault, wherein the server computer manages the first token vault;
synchronizing, by the server computer, the first token vault with the second token vault, wherein the first token vault stores a first set of data associated with the token and the second token vault stores a second set of data associated with the token;
receiving, by the server computer, an authorization request message including the token and data associated with the token, wherein the data associated with the token includes at least the account identifier, wherein the authorization request message is associated with a transaction;
generating, by the server computer, an authorization response message authorizing or declining the transaction; and
transmitting, by the server computer to a transaction processing computer, the authorization response message authorizing or declining the transaction.
19. The method of claim 18 , further comprising:
retrieving, by the server computer, additional data associated with the token from the second token vault, and
determining, by the server computer, whether to approve or decline the transaction based on at least the additional data.
20. The method of claim 18 , wherein the second set of data stored at the second token vault is a subset of the first set of data stored at the first token vault.