Systems and methods for multi-merchant tokenization
Systems and methods for multi-merchant tokenization may include receiving a transaction from a point of sale terminal of a merchant, validating the merchant ID against merchant logs, and generating a token for the transaction. The token includes a primary account number, expiration, and a group ID. Additionally, the system provides the primary account number to a payment system and receives a response back. The response is then output back to the merchant along with the token. In subsequent transactions, the system may receive the token from a one point of sale terminal of the merchant. The system validates the merchant ID against merchant logs and ensures the merchant is configured for tokenization. The token is decrypted and the group ID is compared to the merchant ID in the merchant logs. When they match, the primary account number is provided to the payment system for approval.
1 . A computer-implemented method for multi-merchant tokenization, the method comprising:
receiving, by a multi-merchant tokenization system, an electronic request via an end-to-end encryption from a merchant system, wherein the electronic request is a payment request for a recurring transaction associated with a subscription having a predetermined expiration date, wherein the electronic request comprises an encrypted token, a merchant ID, and a frequency element identifying that the encrypted token is a recurring token enabled for multiple repeated transactions, and wherein the encrypted token comprises, in part, a primary account number (PAN), wherein a reader head of a point of sale (POS) terminal encrypts the primary account number (PAN) upon receiving card information containing the PAN, wherein the multi-merchant tokenization system comprises a tokenizer encryption service and a security module;
requesting, by the merchant tokenization system via the tokenizer encryption service, decryption of the encrypted token from the security module;
decrypting, by the multi-merchant tokenization system via the security module of the multi-merchant tokenization system, the encrypted token, wherein decrypting the encrypted token further comprises generating a decrypted token and retrieving the primary account number (PAN), the merchant ID and the frequency element;
determining, by the multi-merchant tokenization system, a token validity period corresponding to the predetermined expiration date, one or more group IDs, and the primary account number for the decrypted token;
determining, by the multi-merchant tokenization system, that the token validity period has not expired;
determining, by the multi-merchant tokenization system, that the merchant ID matches a group ID of the one or more group IDs;
transmitting, by the multi-merchant tokenization system, the primary account number to a payment system of the multi-merchant tokenization system to complete the electronic request based on determining that the token validity period has not expired and the merchant ID matching the group ID;
receiving, by the multi-merchant tokenization system and from the payment system, an authorization response for the electronic request;
in response to receiving the authorization response, generating, by the multi-merchant tokenization system via the security module, a new token, wherein the new token is generated after a payment request and an authorization response are received regardless of a result of the authorization response to maintain security for a future electronic request; and
transmitting, by the multi-merchant tokenization system, the authorization response and the new token in an encrypted format, via the end-to-end encryption, to a computing system associated with the merchant ID, wherein the computing system is the merchant system.
2 . The method of claim 1 , further comprising:
outputting, by the multi-merchant tokenization system, the authorization response to the point of sale (POS) terminal.
3 . The method of claim 1 , further comprising:
storing, by the multi-merchant tokenization system, a decryption key corresponding to the encrypted token.
4 . The method of claim 1 , wherein each of the one or more group IDs defines a selected group of merchants to redeem the encrypted token.
5 . The method of claim 1 , further comprising:
determining, by the multi-merchant tokenization system, that the token validity period has expired; and
transmitting, by the multi-merchant tokenization system, a denial response to the computing system associated with the merchant ID for the electronic request.
6 . The method of claim 1 , further comprising:
determining, by the multi-merchant tokenization system, that the merchant ID does not match any group ID of the one or more group IDs; and
transmitting, by the multi-merchant tokenization system, a denial response to the computing system associated with the merchant ID for the electronic request.
7 . The method of claim 1 , further comprising:
inserting, by the multi-merchant tokenization system, the encrypted token into a token field of an electronic transaction authorization response; and
transmitting, by the multi-merchant tokenization system, the electronic transaction authorization response to the payment system.
8 . A multi-merchant tokenization system comprising:
one or more processors; and
one or more computer readable media storing instructions which, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
receiving an electronic request via an end-to-end encryption from a merchant system, wherein the electronic request is a payment request for a recurring transaction associated with a subscription having a predetermined expiration date, wherein the electronic request comprises an encrypted token, a merchant ID, and a frequency element identifying that the encrypted token is a recurring token enabled for multiple repeated transactions, and wherein the encrypted token comprises, in part, a primary account number (PAN), wherein a reader head of a point of sale (POS) terminal encrypts the primary account number (PAN) upon receiving card information containing the PAN, wherein the multi-merchant tokenization system further comprises a tokenizer encryption service and a security module;
requesting, via the tokenizer encryption service, decryption of the encrypted token from the security module;
decrypting via the security module of the multi-merchant tokenization system, the encrypted token, wherein decrypting the encrypted token further comprises generating a decrypted token and retrieving the primary account number (PAN), the merchant ID and the frequency element;
determining a token validity period corresponding to the predetermined expiration date, one or more group IDs, and the primary account number for the decrypted token;
determining, that the token validity period has not expired;
determining, by the multi-merchant tokenization system, that the merchant ID matches a group ID of the one or more group IDs;
transmitting the primary account number to a payment system of the multi-merchant tokenization system to complete the electronic request based on determining that the token validity period has not expired and the merchant ID matching the group ID;
receiving, from the payment system, an authorization response for the electronic request;
in response to receiving the authorization response, generating, via the security module, a new token, wherein the new token is generated after a payment request and an authorization response are received regardless of a result of the authorization response to maintain security for a future electronic request; and
transmitting, the authorization response and the updated new token in an encrypted format, via the end-to-end encryption, to a computing system associated with the merchant ID, wherein the computing system is the merchant system.
9 . The multi-merchant tokenization system of claim 8 , the operations further comprising:
outputting the authorization response to the point of sale (POS) terminal.
10 . The multi-merchant tokenization system of claim 8 , the operations further comprising:
storing a decryption key corresponding to the encrypted token.
11 . The multi-merchant tokenization system of claim 8 , wherein each of the one or more group IDs defines a selected group of merchants to redeem the encrypted token.
12 . The multi-merchant tokenization system of claim 8 , the operations further comprising:
determining that the token validity period has expired; and
transmitting a denial response to the computing system associated with the merchant ID for the electronic request.
13 . The multi-merchant tokenization system of claim 8 , the operations further comprising:
determining that the merchant ID does not match any group ID of the one or more group IDs; and
transmitting a denial response to the computing system associated with the merchant ID for the electronic request.
14 . The multi-merchant tokenization system of claim 8 , the operations further comprising:
inserting the encrypted token into a token field of an electronic transaction authorization response; and
transmitting the electronic transaction authorization response to the payment system.
15 . A non-transitory computer readable medium comprising instructions which, when executed by one or more processors of a multi-merchant tokenization system, cause the one or more processors to perform operations comprising:
receiving an electronic request via an end-to-end encryption from a merchant system, wherein the electronic request is a payment request for a recurring transaction associated with a subscription having a predetermined expiration date, wherein the electronic request comprises an encrypted token, a merchant ID, and a frequency element identifying that the encrypted token is a recurring token enabled for multiple repeated transactions, and wherein the encrypted token comprises, in part, a primary account number (PAN), wherein a reader head of a point of sale (POS) terminal encrypts the primary account number (PAN) upon receiving card information containing the PAN, wherein the multi-merchant tokenization system further comprises a tokenizer encryption service and a security module;
requesting, via the tokenizer encryption service, decryption of the encrypted token from the security module;
decrypting via the security module of the multi-merchant tokenization system, the encrypted token, wherein decrypting the encrypted token further comprises generating a decrypted token and retrieving the primary account number (PAN), the merchant ID and the frequency element;
determining a token validity period corresponding to the predetermined expiration date, one or more group IDs, and the primary account number for the decrypted token;
determining that the token validity period has not expired;
determining that the merchant ID matches a group ID of the one or more group IDs;
transmitting the primary account number to a payment system of the multi-merchant tokenization system to complete the electronic request based on determining that the token validity period has not expired and the merchant ID matching the group ID;
receiving from the payment system, an authorization response for the electronic request;
in response to receiving the authorization response, generating, via the security module, a new token, wherein the updated new token is generated after a payment request and an authorization response are received regardless of a result of the authorization response to maintain security for a future electronic request; and
transmitting the authorization response and the new token in an encrypted format, via the end-to-end encryption, to a computing system associated with the merchant ID, wherein the computing system is the merchant system to a computing system associated with the merchant ID.
16 . The non-transitory computer readable medium of claim 15 , further comprising:
determining that the token validity period has expired; and
transmitting a denial response to the computing system associated with the merchant ID for the electronic request.