# US 11,122,133 B2 · System and method for token domain control

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,122,133 B2
- Document ID: US11122133B2
- Status: Granted
- Kind: B2
- Application number: 15/806,947
- Filed: 2017-11-08
- Published: 2018-03-08
- Granted: 2021-09-14
- Earliest claimed: 2014-05-05
- Assignees: Visa International Service Association
- Applicants: Visa International Service Association
- Inventors: Phillip Kumnick
- Web page: https://patentgrep.com/patent/US11122133B2

## CPC

- H04L 67/53: using third party service providers
- G06Q 20/385: {using an alias or single-use codes}
- G06Q 20/4016: {involving fraud or risk level assessment in transaction processing}
- H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)}
- H04L 67/02: based on web technology, e.g. hypertext transfer protocol [HTTP]
- H04L 67/10: in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR

## Abstract

A method for providing a token code in conjunction with a value token is disclosed. The token code serves as a shared secret for authenticating the use of the value token. Multiple token holders can possess the same value token, but each token holder may have a different token code for use with the value token.

## Claims

### Claim 1

A method comprising:
sending, by a processor in a token requestor computer, a first token request to a token service computer, wherein the first token request includes a payment account number and a first domain identifier,
wherein the token service computer identifies a payment token associated with the payment account number, wherein the payment token is a substitute for the payment account number, wherein the token service computer generates a first token code associated with the payment token, wherein the token service computer assigns the payment token and the first token code to the first domain identifier, such that the first token code is specific to a first domain associated with the first domain identifier;
receiving, by the processor in the token requestor computer, the payment token and the first token code from the token service computer;
storing, by the processor in the token requestor computer, the payment token and the first token code;
using, by the processor in the token requestor computer, the payment token and the first token code in place of the payment account number for a first payment transaction, wherein the payment token and the first token code are valid for the first payment transaction if they are being used within the first domain;
sending, by the processor in the token requestor computer, a second token request to the token service computer, wherein the second token request includes a second domain identifier and the payment account number or the payment token,
wherein the token service computer generates a second token code associated with the payment token, wherein the second token code is different than the first token code, wherein the second token code and the first token code are both associated with the same payment token, wherein the token service computer assigns the second token code to the second domain identifier, such that the second token code is specific to a second domain associated with the second domain identifier, wherein the first domain identifier is different than the second domain identifier, and the first domain is different than the second domain;
receiving, by the processor in the token requestor computer, the second token code from the token service computer;
storing, by the processor in the token requestor computer, the second token code; and
using, by the processor in the token requestor computer, the payment token and the second token code in place of the payment account number for a second payment transaction, wherein the payment token and the second token code are valid for the second payment transaction if they are being used within the second domain.

### Claim 2 (depends on 1)

The method of claim 1, wherein the first payment transaction is within the first domain and the second payment transaction is within the second domain.

### Claim 3 (depends on 1)

The method of claim 1, wherein the first domain includes e-commerce payment transactions, wherein the second domain includes in-person payment transactions, wherein the payment token is valid for the first payment transaction if the first payment transaction is an e-commerce payment transaction, and wherein the payment token is valid for the second payment transaction if the second payment transaction is an in-person payment transaction.

### Claim 4 (depends on 1)

The method of claim 1, wherein the token requestor computer is a mobile device, wherein the mobile device is associated with a user, wherein the payment account number is associated with the user, wherein the first domain identifier is associated with the mobile device, and wherein the first domain includes transactions associated with the mobile device.

### Claim 5 (depends on 1)

The method of claim 1, wherein the token requestor computer is a mobile device, wherein the mobile device is associated with a user, wherein the payment account number is associated with the user, wherein the first domain includes payment transactions with a first merchant, wherein the first domain identifier includes a first merchant identifier, wherein the second domain includes payment transactions with a second merchant, and wherein the second domain identifier includes a second merchant identifier.

### Claim 6 (depends on 1)

The method of claim 1, wherein the token requestor computer is a merchant computer, wherein the payment account number is associated with a user, wherein the merchant computer stores the payment token and the first token code on behalf of the user, wherein the first domain identifier is associated with the merchant computer, and wherein the first domain includes transactions associated with the merchant computer.

### Claim 7 (depends on 1)

The method of claim 1, further comprising:
generating, by the processor in the token requestor computer, an authorization request message for the first payment transaction, the authorization request message including the payment token, the first token code, and the first domain identifier; and
sending, by the processor in the token requestor computer, the authorization request message to the token service computer,
wherein the token service computer determines that the payment token and the first token code are assigned to the first domain identifier, wherein the token service computer identifies the payment account number associated with the payment token, and wherein the token service computer adds the payment account number to the authorization request message and sends the authorization request message to an authorizing entity computer.

### Claim 8 (depends on 1)

The method of claim 1, wherein the payment token is a sixteen digit number.

### Claim 9 (depends on 8)

The method of claim 8, wherein the payment account number is a different sixteen digit number.

### Claim 10 (depends on 1)

The method of claim 1, further comprising:
storing, by the processor in the token requestor computer, the payment token and the first token code;
retrieving, by the processor in the token requestor computer, the payment token and the first token code for a third payment transaction;
providing, by the processor in the token requestor computer, the payment token and the first token code in place of the payment account number for the third payment transaction, wherein the payment token and the first token code are valid for the third payment transaction if they are being used within the first domain;
storing, by the processor in the token requestor computer, the second token code;
retrieving, by the processor in the token requestor computer, the payment token and the second token code for a fourth payment transaction; and
providing, by the processor in the token requestor computer, the payment token and the second token code in place of the payment account number for the fourth payment transaction, wherein the payment token and the second token code are valid for the fourth payment transaction if they are being used within the second domain.

### Claim 11 (depends on 1)

The method of claim 1, wherein the second token request includes the payment account number, and wherein the token service computer identifies the payment token associated with the payment account number in response to receiving the payment account number in the second token request.

### Claim 12 (depends on 1)

The method of claim 1, wherein the payment token is usable for obtaining transaction authorization in place of the payment account number.

### Claim 13

A token requestor computer comprising:
a processor; and
a non-transitory computer readable medium, the non-transitory computer readable medium comprising code, that when executed by the processor, implements a method comprising:
sending a first token request to a token service computer, wherein the first token request includes a payment account number and a first domain identifier,
wherein the token service computer identifies a payment token associated with the payment account number, wherein the payment token is a substitute for the payment account number, wherein the token service computer generates a first token code associated with the payment token, wherein the token service computer assigns the payment token and the first token code to the first domain identifier, such that the first token code is specific to a first domain associated with the first domain identifier;
receiving the payment token and the first token code from the token service computer;
storing the payment token and the first token code;
using the payment token and the first token code in place of the payment account number for a first payment transaction, wherein the payment token and the first token code are valid for the first payment transaction if they are being used within the first domain;
sending a second token request to the token service computer, wherein the second token request includes a second domain identifier and the payment account number or the payment token,
wherein the token service computer generates a second token code associated with the payment token, wherein the second token code is different than the first token code, wherein the second token code and the first token code are both associated with the same payment token, wherein the token service computer assigns the second token code to the second domain identifier, such that the second token code is specific to a second domain associated with the second domain identifier, wherein the first domain identifier is different than the second domain identifier, and the first domain is different than the second domain;
receiving the second token code from the token service computer;
storing the second token code; and
using the payment token and the second token code in place of the payment account number for a second payment transaction, wherein the payment token and the second token code are valid for the second payment transaction if they are being used within the second domain.

### Claim 14 (depends on 13)

The token requestor computer of claim 13, wherein the first payment transaction is within the first domain and the second payment transaction is within the second domain.

### Claim 15 (depends on 13)

The token requestor computer of claim 13, wherein the first domain includes a contactless entry mode and wherein the second domain includes magnetic stripe entry mode.

### Claim 16 (depends on 13)

The token requestor computer of claim 13, wherein the token requestor computer is a mobile device, wherein the mobile device is associated with a user, wherein the payment account number is associated with the user, wherein the first domain identifier is associated with the mobile device, and wherein the first domain includes transactions associated with the mobile device.

### Claim 17 (depends on 13)

The token requestor computer of claim 13, wherein the token requestor computer is a mobile device, wherein the mobile device is associated with a user, wherein the payment account number is associated with the user, wherein the first domain includes payment transactions with a first merchant, wherein the first domain identifier includes a first merchant identifier, wherein the second domain includes payment transactions with a second merchant, and wherein the second domain identifier includes a second merchant identifier.

### Claim 18 (depends on 13)

The token requestor computer of claim 13, wherein the token requestor computer is a merchant computer associated with a merchant, wherein the payment account number is associated with a user, wherein the merchant computer stores the payment token and the first token code on behalf of the user, wherein the first domain identifier is associated with the merchant computer, and wherein the first domain includes transactions associated with the merchant computer.

### Claim 19 (depends on 18)

The token requestor computer of claim 18, wherein the first domain identifier includes a merchant identifier associated with the merchant, and wherein the payment token is valid for the first payment transaction if the payment token is accompanied by the merchant identifier.

### Claim 20 (depends on 13)

The token requestor computer of claim 13, wherein the payment token is a sixteen digit number.