# US 12,003,640 B2 · Efficient token provisioning system and method

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,003,640 B2
- Document ID: US12003640B2
- Status: Granted
- Kind: B2
- Application number: 17/569,841
- Filed: 2022-01-06
- Published: 2023-07-06
- Granted: 2024-06-04
- Earliest claimed: 2022-01-06
- Assignees: Visa International Service Association
- Applicants: Visa International Service Association
- Inventors: Deepak Tomar
- Web page: https://patentgrep.com/patent/US12003640B2

## CPC

- H04L 9/3213: {using tickets or tokens, e.g. Kerberos (network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807)}
- G06Q 20/38215: {Use of certificates or encrypted proofs of transaction rights}
- H04L 9/3236: {using cryptographic hash functions}
- G06Q 2220/00: Business processing using cryptography
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR

## Abstract

A method includes a server computer receiving a cryptogram request message comprising a token associated with a first credential during an interaction between a user of a user device and a resource provider of a resource provider application on the user device. The server computer generates a detokenization request message comprising the token. The server computer then provides the detokenization request message to a token service computer. The server computer receives a detokenization response message comprising a second credential from the token service computer. The server computer obtains a cryptogram for the interaction. The server computer generates a cryptogram response message comprising the second credential and the cryptogram, and then provides it in response to the cryptogram request message.

## Claims

### Claim 1

A method comprising:
receiving, by a server computer, a cryptogram request message comprising a token associated with a first credential during an interaction between a user of a user device and a resource provider of a resource provider application on the user device;
generating, by the server computer, a detokenization request message comprising the token;
providing, by the server computer, the detokenization request message to a token service computer;
receiving, by the server computer, a detokenization response message comprising a second credential from the token service computer;
obtaining, by the server computer, a cryptogram for the interaction;
generating, by the server computer, a cryptogram response message comprising the second credential and the cryptogram; and
providing, by the server computer, the cryptogram response message in response to the cryptogram request message.

### Claim 2 (depends on 1)

The method of claim 1, wherein the server computer is a network processing computer.

### Claim 3 (depends on 1)

The method of claim 1, wherein the token service computer detokenizes the token to obtain the first credential, determines a user identifier that is stored in association with the first credential, determines that the second credential is stored in association with the user identifier, generates the detokenization response message comprising the second credential, and provides the second credential to the server computer.

### Claim 4 (depends on 3)

The method of claim 3, wherein the user identifier is a hashed value.

### Claim 5 (depends on 1)

The method of claim 1, wherein the token is a first token, and wherein the cryptogram response message comprising the second credential is provided to a service provider application on the user device, wherein the service provider application presents an interface which queries the user of the user device whether or not the user wants to obtain a second token for the second credential.

### Claim 6 (depends on 5)

The method of claim 5, wherein if the user inputs a selection to obtain the second token, the service provider application generates a token request message comprising the second credential, and wherein the method further comprises:
receiving, by the server computer, the token request message;
obtaining, by the server computer, the second token for the second credential; and
storing, by the server computer, the second token.

### Claim 7 (depends on 6)

The method of claim 6 further comprising:
generating, by the server computer, a token response message comprising the second token; and
providing, by the server computer, the token response message comprising the second token to the service provider application.

### Claim 8

A server computer comprising:
a processor; and
a computer-readable medium coupled to the processor, the computer-readable medium comprising instructions executable by the processor to cause the processor to:
receive a cryptogram request message comprising a token associated with a first credential during an interaction between a user of a user device and a resource provider of a resource provider application on the user device;
generate a detokenization request message comprising the token;
provide the detokenization request message to a token service computer;
receive a detokenization response message comprising a second credential from the token service computer;
obtain a cryptogram for the interaction;
generate a cryptogram response message comprising the second credential and the cryptogram; and
provide the cryptogram response message in response to the cryptogram request message.

### Claim 9 (depends on 8)

The server computer of claim 8, wherein the server computer is a network processing computer.

### Claim 10 (depends on 8)

The server computer of claim 8, wherein the instructions further comprise: prior to receiving the cryptogram request message, provisioning the token to the user device.

### Claim 11 (depends on 8)

The server computer of claim 8, wherein the server computer comprises a cryptogram module.

### Claim 12 (depends on 8)

The server computer of claim 8, wherein the first credential and the second credential are associated with the user.

### Claim 13 (depends on 11)

The server computer of claim 11, wherein the cryptogram response message is provided to a service provider application installed on the user device, the service provider application provides a user interface which queries the user of the user device whether or not to obtain a second token for the second credential, and if the user selects to obtain the second token, the service provider application generates a token request message comprising the second credential, wherein the instructions further cause the processor to:
receive the token request message;
obtain the second token for the second credential;
store the second token;
generate a token response message comprising the second token; and
provide the token response message to the service provider application.

### Claim 14 (depends on 8)

The server computer of claim 8, wherein the instructions further cause the processor to:
receive an authorization request message for the interaction from the resource provider application, the authorization request message comprising at least the token;
obtain the first credential associated with the token; and
provide the authorization request message comprising at least the first credential to an authorizing entity computer, wherein the authorizing entity computer determines whether or not to authorize the interaction.

### Claim 15 (depends on 8)

The server computer of claim 8, wherein the interaction is an access interaction or a data transfer interaction.