Token keys to generate cryptograms for token interactions

1. A method comprising:

generating, by a processor computer, a first master key for a token requestor, the first master key being generated as an output of a cryptographic function that processes (a) a second master key managed by the processor computer and (b) an identifier of the token requestor;

transmitting, by the processor computer to a token requestor computer corresponding to the token requestor, the first master key;

receiving, by the processor computer from the token requestor computer, a request for a token;

responsive to receiving the request for the token, transmitting, by the processor computer, the token to the token requestor computer;

receiving, by the processor computer from the token requestor computer, an authorization request message comprising the token and a cryptogram generated by the token requestor computer using the first master key and the token;

validating, by the processor computer, the cryptogram;

identifying, by the processor computer, a primary account identifier corresponding to the token;

generating, by the processor computer, a modified authorization request message comprising an indication of the validation of the cryptogram and the primary account identifier; and

transmitting, by the processor computer to an authorization computer, the modified authorization request message.

2. The method of claim 1 , wherein the token requestor computer generates a cryptogram generation key using the first master key, and the cryptogram is generated using the cryptogram generation key and the token.

3. The method of claim 1 , further comprising receiving, by the processor computer, an authorization response message from the authorization computer, the authorization response message comprising an authorization result generated by the authorization computer based on the modified authorization request message.

4. The method of claim 1 , wherein the token is domain restricted.

5. The method of claim 1 , wherein the second master key is stored in a hardware secure module (HSM) in the processor computer.

6. The method of claim 1 , wherein the first master key has a limited use.

7. A processor computer comprising:

a memory;

a processor;

a non-transitory computer-readable medium comprising instructions, which, when executed by the processor, perform the steps of:

generating a first master key for a token requestor, the first master key being generated as an output of a cryptographic function that processes (a) a second master key managed by the processor computer and (b) an identifier of the token requestor;

transmitting, to a token requestor computer corresponding to the token requestor, the first master key;

receiving, from the token requestor computer, a request for a token;

responsive to receiving the request for the token, transmitting the token to the token requestor computer;

receiving, from the token requestor computer, an authorization request message comprising the token and a cryptogram generated by the token requestor computer using the first master key and the token;

validating, by the processor computer, the cryptogram;

identifying, by the processor computer, a primary account identifier corresponding to the token;

generating, by the processor computer, a modified authorization request message comprising an indication of the validation of the cryptogram and the primary account identifier; and

transmitting, by the processor computer to an authorization computer, the modified authorization request message.

8. The processor computer of claim 7 , wherein generating the cryptogram by the token requestor comprises generating a cryptogram generation key using the first master key, and the cryptogram is generated using the cryptogram generation key and the token.

9. The processor computer of claim 7 , the steps further comprising receiving an authorization response message from the authorization computer, the authorization response message comprising an authorization result generated by the authorization computer based on the modified authorization request message.

10. The processor computer of claim 7 , further comprising a hardware secure module (HSM) storing the second master key.

11. The processor computer of claim 7 , wherein the token is domain restricted.

12. The processor computer of claim 7 , wherein the first master key has a limited use.

13. A method comprising:

receiving, by a token requestor computer from a processor computer in a processing network, a first master key and a token, the first master key having been generated by the processor computer as an output of a cryptographic function that processes (a) a second master key managed by the processor computer and (b) an identifier of the token requestor;

generating, by the token requestor computer, a cryptogram generation key using the first master key;

generating, by the token requestor computer, a cryptogram using the cryptogram generation key and the token;

generating, by the token requestor computer, an authorization request message comprising the token and the cryptogram; and

transmitting, by the token requestor computer to the processor computer, the authorization request message, thereby causing the processor computer to validate the cryptogram, identify a primary account identifier corresponding to the token, and generate a modified authorization request message comprising an indication of the validation of the cryptogram and the primary account identifier.

14. The method of claim 13 , further comprising:

after receiving the first master key, transmitting, by the token requestor computer to the processor computer, a request for the token, wherein the token is received responsive to transmitting the request for the token.

15. The method of claim 13 , wherein the first master key was generated by the processor computer using a second master key.