Architectures, systems, and methods for card based transactions
A method and apparatus for processing a transaction between a merchant and a customer of the merchant are described. The method may include generating, at an ingress server, an initial transaction message by generating a deterministic identifier for a card used in the transaction from card data received for the transaction and encrypting the received card data. The method may also include providing the initial transaction message from the ingress server to a payment server. Furthermore, the method may include updating, by the payment server in response to an authorization of the transaction determined based at least in part on the deterministic identifier for the card, the initial transaction message with authorization data, and providing the updated initial transaction message from the payment server to an egress server. The method may also include communicating a final transaction message to an authorization system for processing the transaction between the merchant and the customer based on the card data.
1 . A method for reducing latency of authorization during processing of a network operation in a distributed network system comprising an ingress server, a server, and a plurality of egress servers, the method comprising:
receiving, by the server of the distributed network system, a network operation message from the ingress server of the distributed network system, the network operation message comprising:
encrypted data of a customer,
a deterministic card identifier associated with the encrypted data for the network operation between a merchant and the customer of the merchant, the deterministic card identifier generated by applying a cryptographic function on data of the customer and a cryptographic salt selected based on the data, the deterministic card identifier used to index the encrypted data in a vault data store, and
one or more network operation attributes;
performing, by the server, an analysis based on the one or more network operation attributes and the deterministic card identifier to detect network operation fraud;
in response to detection of a legitimate network operation based on the analysis, authorizing, by the server, the network operation;
in response to authorizing the network operation, generating, by the server, a token to reference the network operation in the distributed network system, wherein the token is a non-sensitive data element;
causing, by the server, transmission of the token to a merchant server to initiate the authorized network operation;
performing, by the server, load balancing across the plurality of egress servers of the distributed network system;
selecting, by the server, an egress server among the plurality of egress servers of the distributed network system to which the network operation message for the authorized network operation is to be transmitted based on at least a geographical location of the egress server in relation to an authorization server and performance of the load balancing across the plurality of egress servers, such that a latency in transmitting the network operation message is reduced and the distributed network system is continuously available;
transmitting, by the server to the selected egress server, the network operation message for the authorized network operation to cause the selected egress server to decrypt the encrypted data for storage in the vault store and communicate the token with the merchant server to clear the authorized network operation; and
wherein communications originating from outside the distributed network system are blocked to prevent access to the selected egress server.
2 . The method of claim 1 , wherein the encrypted data is obtained from the customer for the network operation between the merchant and the customer, and the encrypted data is not exposed to the server in unencrypted form.
3 . The method of claim 1 , wherein in response to a detection of the legitimate network operation based on the analysis, the method further comprises:
generating, by the server, a token that identifies the network operation; and
transmitting, by the server, the token to one or more of the merchant and the ingress server.
4 . The method of claim 1 , wherein the egress server is selected based on:
a geographic proximity between an authorization network server and the selected egress server,
a geography of card issuer/bank,
a legal requirement for the network operation and/or card associated with a geographic region in which egress of a final network operation message will occur, or
a combination thereof.
5 . The method of claim 1 , wherein the distributed network system comprises a plurality of ingress servers including the ingress server, a plurality of servers including the server, and a plurality of egress servers including the egress server, and the distributed network system is continuously active architecture for providing network operation processing services in event of a failure of one or more of the plurality of ingress servers, servers, and/or egress servers.
6 . The method of claim 1 , wherein the one or more network operation attributes comprise originating region of the network operation, issuing bank, card type, card brand, and network operation amount.
7 . The method of claim 1 ,
wherein network operation messages that do not originate from ingress servers of the distributed network system, and electronic communications originating from a public network are blocked from being sent to the server; and
wherein network operation messages for authorized network operations that do not originate from within the distributed network system, and electronic communications originating from the public network are blocked from being sent to the egress server.
8 . The method of claim 7 , wherein rejection of messages and electronic communications by the server and the egress server enforce a strict flow of communications within the distributed network system.
9 . The method of claim 1 , wherein the network operation is a card present network operation or a card not present network operation.
10 . The method of claim 1 , wherein communications exchanged between the ingress server and the server, and communications exchanged between the server and the egress server, are each transmitted using a secure communications protocol.
11 . A non-transitory computer readable storage medium including instructions that, when executed by a plurality of processors of a distributed processing system comprising an ingress server, a server, and a plurality of egress servers, cause the plurality of processors to perform operations for reducing latency of authorization during processing of a network operation in the distributed processing system, the operations comprising:
receiving, by the server of the distributed processing system, a network operation message from the ingress server of the distributed processing system, the network operation message comprising:
encrypted data of a customer,
a deterministic card identifier associated with the encrypted data for the network operation between a merchant and the customer of the merchant, the deterministic card identifier generated by applying a cryptographic function on data of the customer and a cryptographic salt selected based on the data, the deterministic card identifier used to index the encrypted data in a vault data store, and
one or more network operation attributes;
performing, by a detection system of the server, an analysis based on the one or more network operation attributes and the deterministic card identifier to detect network operation fraud;
in response to detection of a legitimate network operation based on the analysis, authorizing, by the server, the network operation;
in response to authorizing the network operation, generating, by the server, a token to reference the network operation in the distributed network system, wherein the token is a non-sensitive data element;
causing, by the server, transmission of the token to a merchant server to initiate the authorized network operation;
performing, by the server, load balancing across the plurality of egress servers of the distributed network system;
selecting, by the server, an egress server among the plurality of egress servers of the distributed processing system to which the network operation message for the authorized network operation is to be transmitted based on at least a geographical location of the egress server in relation to an authorization server and load balancing across the plurality of egress servers, such that a latency in transmitting the network operation message is reduced and the distributed network system is continuously available;
transmitting, by the server to the selected egress server, the network operation message for the authorized network operation to cause the selected egress server to decrypt the encrypted data for storage in the vault store and communicate the token with the merchant server to clear the authorized network operation; and
wherein communications originating from outside the distributed network system are blocked to prevent access to the selected egress server.
12 . The non-transitory computer readable storage medium of claim 11 , wherein the encrypted data is obtained from the customer for the network operation between the merchant and the customer, and the encrypted data is not exposed to the server in unencrypted form.
13 . The non-transitory computer readable storage medium of claim 11 , wherein the distributed processing system comprises a plurality of ingress servers including the ingress server, a plurality of payment servers including the server, and a plurality of egress servers including the egress server, and the distributed processing system is a continuously active architecture for providing processing services in event of a failure of one or more of the plurality of ingress servers, servers, and/or egress servers.
14 . A distributed processing system for reducing latency of authorization during processing of a network operation, comprising:
a server comprising at least one processor coupled with memory configured to:
receive a network operation message from an ingress server of the distributed processing system, the network operation message comprising:
encrypted data of a customer,
a deterministic card identifier associated with the encrypted data for a network operation between a merchant and the customer of the merchant, the deterministic card identifier generated by applying a cryptographic function on data of the customer and a cryptographic salt selected based on the data, the deterministic card identifier used to index the encrypted data in a vault data store, and
one or more network operation attributes,
perform, by a detection system of the server, an analysis based on the one or more network operation attributes and the deterministic card identifier to detect network operation fraud;
in response to detection of a legitimate network operation based on the analysis, authorize the network operation;
in response to authorizing the network operation, generate a token to reference the network operation in the distributed network system, wherein the token is a non-sensitive data element;
cause transmission of the token to a merchant server to initiate the authorized network operation;
perform load balancing across the plurality of egress servers of the distributed network system;
select an egress server among a plurality of egress servers of the distributed processing system to which the network operation message for the authorized network operation is to be transmitted based on at least a geographical location of the egress server in relation to an authorization server and performance of load balancing across the plurality of egress servers, such that a latency in transmitting the network operation message is reduced and the distributed network system is continuously available;
transmit, to the selected egress server, the network operation message for the authorized network operation to cause the selected egress server to decrypt the encrypted data for storage in the vault store and communicate the token with the merchant server to clear the authorized network operation; and
wherein communications originating from outside the distributed network system are blocked to prevent access to the selected egress server.
15 . The method of claim 1 , wherein the distributed network system is executed across a plurality of computing clusters, and
wherein performing the load balancing further comprises performing the load balancing across the plurality of computing clusters, and
wherein selecting the egress server further comprises selecting, from the plurality of computing clusters, a computing cluster including the egress server based on at least the geographical location of the computing cluster and performance of load balancing across the plurality of computing clusters.
16 . The non-transitory computer readable storage medium of claim 11 , wherein the distributed network system is executed across a plurality of computing clusters, and
wherein performing the load balancing further comprises performing the load balancing across the plurality of computing clusters, and
wherein selecting the egress server further comprises selecting, from the plurality of computing clusters, a computing cluster including the egress server based on at least the geographical location of the computing cluster and performance of load balancing across the plurality of computing clusters.
17 . The distributed processing system of claim 14 , wherein the server is further configured to:
perform the load balancing across a plurality of computing clusters executing the plurality of egress servers; and
select, from the plurality of computing clusters, a computing cluster including the egress server based on at least the geographical location of the computing cluster and performance of load balancing across the plurality of computing clusters.