System, method, and apparatus for securely transmitting data via a third-party webpage
Provided is a computer-implemented method for securely receiving data via a third-party webpage, including: generating configuration data in response to a request from a first system, the configuration data including a public key of a first key pair; digitally signing the configuration data based on a private key of a second key pair; transmitting the configuration data to the first system, the configuration data including code configured to facilitate the first system to embed a plurality of frames in a webpage, wherein the plurality of frames loads content from a domain that is independent from a domain that hosts the webpage; and verifying the configuration data based on a public key of the second key pair. The computer-implemented method may also include receiving, from a master frame of the plurality of frames, encrypted data. Systems and computer program products are also provided.
1. A computer-implemented method for securely collecting data via a third-party webpage, comprising:
receiving configuration data from a payment system, the configuration data comprising an address for at least one script and a temporary public key;
verifying, with a user device executing the at least one script, the configuration data based on a public key identified by the at least one script;
rendering, on the user device, a webpage comprising a plurality of embedded frames based on the configuration data and a server computer;
encrypting, with the user device executing the at least one script, input data received by at least one embedded frame of the plurality of embedded frames with the temporary public key;
receiving, with the user device, a transient token from the payment system through at least one embedded frame of the plurality of embedded frames; and
passing, with the user device executing the at least one script, the transient token to the server computer.
2. The computer-implemented method of claim 1 , wherein the at least one script comprises a plurality of different scripts.
3. The computer-implemented method of claim 1 , wherein the server computer comprises a merchant web server, and wherein the merchant web server receives the configuration data from the payment system and causes the user device to render the webpage.
4. The computer-implemented method of claim 1 , further comprising:
in response to receiving the transient token from the user device, generating, with the server computer, a transaction request message comprising the transient token; and
communicating the transaction request message to the payment system.
5. The computer-implemented method of claim 4 , wherein the transient token is digitally signed with a temporary private key corresponding to the temporary public key, further comprising:
verifying, with the server computer, the transient token based on the temporary public key,
wherein the transaction request message is generated in response to verifying the transient token.
6. The computer-implemented method of claim 1 , wherein rendering the webpage is based on verifying that the configuration data is valid.
7. The computer-implemented method of claim 1 , further comprising:
requesting, with the server computer, the configuration data from the payment system in response to a payment transaction initiated by a user of the user device.
8. A system for securely collecting data via a third-party webpage, comprising:
at least one processor programmed or configured to:
verify, by executing at least one script, configuration data based on a public key identified by the at least one script, the configuration data received by a server computer from a payment system, the server computer in communication with the at least one processor, the configuration data comprising an address for the at least one script and a temporary public key;
render a webpage comprising a plurality of embedded frames based on the configuration data and the server computer;
encrypt, by executing the at least one script, input data received by at least one embedded frame of the plurality of embedded frames with the temporary public key;
receive a transient token from the payment system through at least one embedded frame of the plurality of embedded frames; and
pass, by executing the at least one script, the transient token to the server computer.
9. The system of claim 8 , wherein the at least one script comprises a plurality of different scripts.
10. The system of claim 8 , wherein the server computer comprises a merchant web server, and wherein the merchant web server receives the configuration data from the payment system and causes a user device to render the webpage.
11. The system of claim 8 , further comprising the server computer, the server computer programmed or configured to:
in response to receiving the transient token from a user device, generate a transaction request message comprising the transient token; and
communicate the transaction request message to the payment system.
12. The system of claim 11 , wherein the transient token is digitally signed with a temporary private key corresponding to the temporary public key, further comprising the server computer, the server computer programmed or configured to:
verify the transient token based on the temporary public key,
wherein the transaction request message is generated in response to verifying the transient token.
13. The system of claim 8 , wherein rendering the webpage is based on verifying that the configuration data is valid.
14. The system of claim 8 , further comprising the server computer, the server computer programmed or configured to:
request the configuration data from the payment system in response to a payment transaction initiated by a user of a user device.
15. A computer program product comprising at least one non-transitory computer-readable medium comprising one or more instructions that, when executed by at least one processor, cause the at least one processor to:
verify, by executing at least one script, configuration data based on a public key identified by the at least one script, the configuration data received by a server computer from a payment system, the server computer in communication with the at least one processor, the configuration data comprising an address for the at least one script and a temporary public key;
render a webpage comprising a plurality of embedded frames based on the configuration data and the server computer;
encrypt, by executing the at least one script, input data received by at least one embedded frame of the plurality of embedded frames with the temporary public key;
receive a transient token from the payment system through at least one embedded frame of the plurality of embedded frames; and
pass, by executing the at least one script, the transient token to the server computer.
16. The computer program product of claim 15 , wherein the at least one script comprises a plurality of different scripts.
17. The computer program product of claim 15 , wherein the server computer comprises a merchant web server, and wherein the merchant web server receives the configuration data from the payment system and causes a user device to render the webpage.
18. The computer program product of claim 15 , wherein rendering the webpage is based on verifying that the configuration data is valid.
19. The computer program product of claim 15 , further comprising at least one second non-transitory computer-readable medium comprising one or more instructions that, when executed by at least one server computer, cause the at least one server computer to:
in response to receiving the transient token from a user device, generate a transaction request message comprising the transient token; and
communicate the transaction request message to the payment system.
20. The computer program product of claim 19 , wherein the transient token is digitally signed with a temporary private key corresponding to the temporary public key, wherein the at least one server computer is further caused to:
verify the transient token based on the temporary public key,
wherein the transaction request message is generated in response to verifying the transient token.