Derived unique token per transaction
Examples described herein relate to systems, apparatuses, and methods for using tokens between two entities comprising a client device and a server, including receiving, by the server, a token from the client device, wherein the token is unique to a transaction, deriving, by the server, a server-derived token from the original data based on a transaction count, wherein the transaction count corresponds to a number of times that the original data is involved in transactions, comparing, by the server, the received token with the server-derived token, and responsive to determining that the received token and the server-derived token are same, sending, by the server, a verification message.
1. A method for using tokens between two entities comprising a client device and a server, the method comprising:
initiating, by the client device, a transaction involving original data, wherein the original data needs to be verified by the server;
deriving, by the client device, a token from the original data for the transaction based on a transaction count, wherein the token is unique to the transaction, and the transaction count corresponds to a number of times that the original data is involved in transactions, deriving the token from the original data comprising:
running a first one-way function with a previous intermediate value as input to determine a first intermediate value, the previous intermediate value being an output of the first one-way function for a previous transaction; and
running a second one-way function one or more times with the first intermediate value as input to determine the token; and
sending, by the client device, the token to the server for verification.
2. The method of claim 1 , wherein the original data comprises on e or more of a payment card number, a financial account number, a password, a social security number, a name, an address, an email address, any Personally Identifiable Information (PII), a security object, and a seed for key-generation.
3. The method of claim 1 , wherein the original data is deleted after the first intermediate value is generated.
4. The method of claim 1 , wherein the previous intermediate value is deleted after the first intermediate value is generated.
5. The method of claim 1 , further comprising one or more of:
generating a digital signature on the token; and
encrypting the token.
6. The method of claim 1 , further comprising using a signcryption function to generate a digital signature on the token and encrypting the token.
7. The method of claim 1 , further comprising:
initiating, by the client device, another transaction involving original data, wherein the original data needs to be verified by the server;
deriving, by the client device, another token indirectly from the original data based on another transaction count for the another transaction, wherein the another token is unique to the transaction and is different from the token; and
sending, by the client device, the another token to the server for verification and the another transaction count.
8. The method of claim 7 , wherein deriving the another token from the original data comprises
running the first one-way function with the first intermediate value as input to determine a second intermediate value; and
running the second one-way function with the second intermediate value as input to determine the another token.
9. The method of claim 1 , further comprising sending the transaction count to the server.
10. A client device, comprising:
a network interface; and
a processing circuit configured to:
initiate, by the client device, a transaction involving original data, wherein the original data needs to be verified by the server;
derive, by the client device, a token from the original data for the transaction based on a transaction count, wherein the token is unique to the transaction, and the transaction count corresponds to a number of times that the original data is involved in transactions, deriving the token from the original data comprising:
running a first one-way function with a previous intermediate value as input to determine a first intermediate value, the previous intermediate value being an output of the first one-way function for a previous transaction; and
running a second one-way function one or more times with the first intermediate value as input to determine the token; and
send, by the client device, the token to the server for verification.
11. A method for using tokens between a client device and a server, the method comprising:
receiving, by the server, a token from the client device, wherein the token is unique to a transaction;
deriving, by the server, a server-derived token from the original data based on a transaction count, wherein the transaction count corresponds to a number of times that the original data is involved in transactions, deriving the server-derived token from the original data comprising:
running a number of iterations of the first one-way function with the original data as input to determine a third intermediate value, wherein the number of iterations equals to the transaction count; and
running a second one-way function with the third intermediate value as input to determine the server-derived token;
comparing, by the server, the received token with the server-derived token; and
responsive to determining that the received token and the server-derived token are same, sending, by the server, a verification message.
12. The method of claim 11 , further comprising receiving, by the server, the transaction count.
13. The method of claim 11 , further comprising:
receiving, by the server, another token from the client device, wherein the another token is unique to another transaction; and
receiving, by the server, another transaction count.
14. The method of claim 13 , further comprising:
deriving, by the server, another server-derived token from the original data based on the transaction count;
comparing the another received token with the another server-derived token; and
responsive to determining that the another received token and the another server-derived token are same, sending another verification message.
15. The method of claim 14 , wherein deriving another server-derived token from the original data based on the transaction count comprises
running a number of iterations of the first one-way function with the original data as input to determine a fourth intermediate value, wherein the number of iterations equals to the another transaction count; and
running one or more iterations of the second one-way function with the fourth intermediate value as input to determine the another token.
16. The method of claim 11 , further comprising:
receiving a unique ID associated with the original data from the client device; and
determining the original data based on the ID.
17. A server, comprising:
a network interface; and
a processing circuit configured to:
receive a token from the client device, wherein the token is unique to a transaction;
derive a server-derived token from the original data based on a transaction count, wherein the transaction count corresponds to a number of times that the original data is involved in transactions, deriving the server-derived token from the original data comprising:
running a number of iterations of the first one-way function with the original data as input to determine a third intermediate value, wherein the number of iterations equals to the transaction count; and
running a second one-way function with the third intermediate value as input to determine the server-derived token;
compare the received token with the server-derived token; and
responsive to determining that the received token and the server-derived token are same, send a verification message.