# US 12,120,117 B2 · Method and system for token provisioning and processing > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,120,117 B2 - Document ID: US12120117B2 - Status: Granted - Kind: B2 - Application number: 18/457,829 - Filed: 2023-08-29 - Published: 2023-12-14 - Granted: 2024-10-15 - Earliest claimed: 2018-08-22 - Assignees: Visa International Service Association - Applicants: Visa International Service Association - Inventors: Katharina Fuhrmann; Stephanie Zachariae; David Petch; Andrew Whitcombe; David William Wilson; Neil Hilton; Ramesh Shankar; Sayeed Mohammed - Web page: https://patentgrep.com/patent/US12120117B2 ## CPC - G06Q 20/3821: {Electronic credentials} - H04L 63/0884: {by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity} - G06F 21/33: using certificates - G06Q 20/385: {using an alias or single-use codes} - G06Q 20/40: Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists - H04L 9/3213: {using tickets or tokens, e.g. Kerberos (network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807)} - H04L 63/0807: {using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213)} - H04L 2209/56: Financial cryptography, e.g. electronic payment or e-cash - G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A method and system for provisioning credentials is disclosed. The method includes receiving, by a token provider computer, a token request message from a token requestor computer that comprises an initial access identifier. The token provider computer transmits the initial access identifier to a first authorization computer, and then the token provider computer receives an intermediate access identifier. The token provider computer then transmits a token activation request message to a second authorization computer based at least in part on the intermediate access identifier. The token provider computer then receives a token activation response message from the second authorization computer. The token provider computer then provides the token to the token requestor computer. ## Claims ### Claim 1 A first authorization computer comprising: a processor; and a non-transitory computer readable medium coupled to the processor, the computer readable medium comprising code, executable by the processor, for implementing a method comprising: receiving an initial access identifier from a token provider computer; obtaining an intermediate access identifier based at least in part on the initial access identifier; and transmitting the intermediate access identifier to the token provider computer, wherein the token provider computer transmits a token activation request message, based at least in part on the intermediate access identifier, to a second authorization computer to authorize a token to be provisioned to a token requestor computer. ### Claim 2 (depends on 1) The first authorization computer of claim 1, wherein the initial access identifier comprises an alphanumeric value that corresponds to an account identifier of an account. ### Claim 3 (depends on 2) The first authorization computer of claim 2, wherein receiving the initial access identifier further comprises receiving a user identifier of an authorized user that is associated with the account. ### Claim 4 (depends on 3) The first authorization computer of claim 3, wherein obtaining the intermediate access identifier comprises generating a virtual primary account number that is associated with the authorized user and the account. ### Claim 5 A method comprising: receiving, by a processing computer, an authorization request message comprising a token; providing, by the processing computer, the token to a token provider computer in a transaction; receiving, by the processing computer, an intermediate access identifier associated with the token; modifying, by the processing computer, the authorization request message to include the intermediate access identifier; and transmitting, by the processing computer, the authorization request message including the intermediate access identifier to a first authorization computer, wherein the first authorization computer modifies the authorization request message to include an initial access identifier associated with the intermediate access identifier, and transmits the authorization request message with the initial access identifier to a second authorization computer to authorize the transaction. ### Claim 6 (depends on 5) The method of claim 5, wherein the initial access identifier comprises an alphanumeric value that corresponds to an identifier for a resource. ### Claim 7 (depends on 6) The method of claim 6, wherein the resource corresponds to a file on a remote file server. ### Claim 8 (depends on 5) The method of claim 5, wherein the intermediate access identifier is a virtual resource identifier. ### Claim 9 (depends on 8) The method of claim 8, wherein the virtual resource identifier is not operable for being used to directly conduct a transaction. ### Claim 10 (depends on 5) The method of claim 5, wherein the intermediate access identifier is associated with an expiration date. ### Claim 11 (depends on 5) The method of claim 5, the method further comprising: subsequent to the second authorization computer authorizing the transaction, receiving, by the processing computer, an authorization response message from the first authorization computer, the authorization response message including the intermediate access identifier, the first authorization computer having replaced the initial access identifier included in an original authorization response message received from the second authorizing computer with the intermediate access identifier; retrieving, by the processing computer, the token from the token provider computer based at least in part on the intermediate access identifier; including, by the processing computer, the token in a modified authorization response message; and transmitting, by the processing computer, the modified authorization response message to an access device. ### Claim 12 (depends on 5) The method of claim 5, wherein the intermediate access identifier is received from the token provider computer, the token provider computer maintaining a mapping of the token to the intermediate access identifier. ### Claim 13 A processing computer comprising: a processor; and a non-transitory computer readable medium coupled to the processor, the computer readable medium comprising code, executable by the processor, for implementing a method comprising: receiving an authorization request message comprising a token; providing the token to a token provider computer in a transaction; receiving an intermediate access identifier associated with the token; modifying the authorization request message to include the intermediate access identifier; and transmitting the authorization request message including the intermediate access identifier to a first authorization computer, wherein the first authorization computer modifies the authorization request message to include an initial access identifier associated with the intermediate access identifier, and transmits the authorization request message with the initial access identifier to a second authorization computer to authorize the transaction. ### Claim 14 (depends on 13) The processing computer of claim 13, wherein the initial access identifier is comprises an alphanumeric value that corresponds to an identifier for a resource. ### Claim 15 (depends on 14) The processing computer of claim 14, wherein the resource corresponds to a file on a remote file server. ### Claim 16 (depends on 13) The processing computer of claim 13, wherein the intermediate access identifier is a virtual resource identifier. ### Claim 17 (depends on 16) The processing computer of claim 16, wherein the virtual resource identifier is not operable for being used to directly conduct a transaction. ### Claim 18 (depends on 13) The processing computer of claim 13, wherein the intermediate access identifier is associated with an expiration date. ### Claim 19 (depends on 13) The processing computer of claim 13, wherein the method further comprises: subsequent to the second authorizing computer authorizing the transaction, receiving, by the processing computer an authorization response message from the first authorization computer, the authorization response message including the intermediate access identifier, the first authorization computer having replaced the initial access identifier included in an original authorization response message received from the second authorizing computer with the intermediate access identifier; retrieving, by the processing computer, the token from the token provider computer based at least in part on the intermediate access identifier; including, by the processing computer, the token in a modified authorization response message; and transmitting, by the processing computer, the modified authorization response message to an access device. ### Claim 20 (depends on 13) The processing computer of claim 13, wherein the intermediate access identifier is received from the token provider computer, the token provider computer maintaining a mapping of the token to the intermediate access identifier.