Back to results
US 12,223,504 B2Granted
Merchant universal payment identifier system
AssigneeMastercard International Incorporated
InventorSachin Ahuja
Life of this patent
Estimating the term…
Abstract
Briefly, embodiments are directed to a system, method, and article for receiving an authorization request message for a remote commerce transaction with a particular merchant, where the authorization request message comprises a merchant universal payment identifier (MuPi). The MuPi may be extracted from the authorization request message. Validation information may be determined for the MuPi. A message may be transmitted to a payment network to enable authorization of the remote commerce transaction at least partially in response to the determination of the validation information.
Claims22
A method to be performed at a server, the method comprising:
- receiving an authorization request message for a remote commerce transaction between a customer and a merchant, wherein the authorization request message comprises a merchant universal payment identifier (MuPi) and a terminal identifier (ID) associated with the merchant, wherein the MuPi comprises a uniform resource locator (URL)-based merchant identifier and a manifest file deployed at the URL;
- extracting the MuPi from the authorization request message;
- extracting the manifest file from the URL;
- extracting a registration signature for the merchant from the manifest file;
- validating an identity of the merchant based on the MuPi by determining validation information for the MuPi, the validation information comprising a security level indicator indicating a measure of confidence that the identity of the merchant is valid and accessing, based on the MuPi, a risk profile received for the merchant for previous transactions, and
- deterministically determining whether the terminal ID received belong to the same merchant for which the MuPi was initially created,
- wherein the identity of the merchant is validated based at least partially on the extracted registration signature for the merchant and based on the risk profile and on the security level indicator being at or above a threshold confidence level;
- binding the MuPi to a cryptogram for the merchant in response to the validating the identity of the merchant;
- and
- transmitting a message to a payment network and authorizing the remote commerce transaction at least partially in response to the validation of the identity of the merchant, the message comprising the cryptogram for the merchant.
7 more elements
A server comprising:
- a receiver to receive an authorization request message for a remote commerce transaction between a customer and a merchant, wherein the authorization request message comprises a merchant universal payment identifier (MuPi) and a terminal identifier (ID) associated with the merchant, wherein the MuPi comprises a uniform resource locator (URL)-based merchant identifier and a manifest file deployed at the URL;
- a processor to:
- extract the MuPi from the authorization request message and determine validation information for the MuPi;
- extract the manifest file from the URL;
- extract a registration signature for the merchant from the manifest file;
- validate an identity of the merchant based on the MuPi by
- determining validation information for the MuPi, the validation information comprising a security level indicator indicating a measure of confidence that the identity of the merchant is valid and accessing, based on the MuPi, a risk profile received for the merchant for previous transactions, and
- deterministically determining whether the terminal ID received belong to the same merchant for which the MuPi was initially created,
- wherein the identity of the merchant is validated based at least partially on the extracted registration signature for the merchant and based on the risk profile and on the security level indicator being at or above a threshold confidence level;
- and
- bind the MuPi to a cryptogram for the merchant in response to the validating the identity of the merchant;
- and
- a transmitter to transmit a message to a payment network and authorize the remote commerce transaction at least partially in response to the validation of the identity of the merchant, the message comprising the cryptogram for the merchant.
10 more elements
A method performed at a merchant device associated with a merchant, the method comprising:
- registering a merchant universal payment identifier (MuPi) associated with the merchant with an authorized merchant registrar (AMR);
- receiving a JavaScript Object Notation (JSON) Web Token (JWT) from the AMR;
- generating a merchant manifest associated with the merchant, wherein the merchant manifest comprises the JWT;
- storing the merchant manifest at a particular uniform resource locator (URL) address;
- receiving a validation signature from the AMR;
- updating the merchant manifest to include the validation signature, wherein the validation signature is usable to validate an identity of the merchant associated with the MuPi, wherein an association between the MuPi and a network cryptogram is generated;
- responsive to an authorization transaction comprising the MuPi and a terminal identifier (ID) associated with the merchant being subsequently processed for the merchant device, accessing, based on the MuPi, a risk profile received for the merchant for previous transactions, an identity of the merchant device being determined based on the risk profile and on the association between the MuPi and the network cryptogram;
- and
- deterministically determining whether the terminal identifier (ID) received belong to the same merchant for which the MuPi was initially created.
6 more elements
A merchant device associated with a merchant, comprising:
- a transmitter to transmit a first message to an authorized merchant registrar (AMR), wherein the first message comprises a request to register a merchant universal payment identifier (MuPi) associated with the merchant with the AMR;
- a receiver to receive a second message from the AMR, wherein the second message comprises a JavaScript Object Notation (JSON) Web Token (JWT);
- a processor to:
- generate a merchant manifest associated with the merchant, wherein the merchant manifest comprises the JWT;
- initiate storage of the merchant manifest at a particular uniform resource locator (URL) address;
- receive a validation signature from the AMR;
- update the merchant manifest to include the validation signature, wherein the validation signature is usable to validate an identity of the merchant associated with the MuPi, wherein an association between the MuPi and a network cryptogram is generated;
- responsive to an authorization transaction comprising the MuPi and a terminal identifier (ID) associated with the merchant being subsequently processed for the merchant device, accessing, based on the MuPi, a risk profile received for the merchant for previous transactions, an identity of the merchant device being determined based on the risk profile and on the association between the MuPi and the network cryptogram;
- and
- deterministically determining whether the terminal identifier (ID) received belong to the same merchant for which the MuPi was initially created.
7 more elements
An article, comprising:
- a non-transitory storage medium comprising machine-readable instructions executable by one or more processors to:
- register a merchant universal payment identifier (MuPi) associated with a merchant with an authorized merchant registrar (AMR);
- process a received JavaScript Object Notation (JSON) Web Token (JWT) from the AMR;
- generate a merchant manifest associated with the merchant, wherein the merchant manifest comprises the JWT;
- initiate storage of the merchant manifest at a particular uniform resource locator (URL) address;
- receive a validation signature from the AMR;
- update the merchant manifest to include the validation signature, wherein the validation signature is usable to validate an identity of the merchant associated with the MuPi, wherein an association between the MuPi and a network cryptogram is generated;
- responsive to an authorization transaction comprising the MuPi and a terminal identifier (ID) associated with the merchant being subsequently processed for the merchant device, accessing, based on the MuPi, a risk profile received for the merchant for previous transactions, an identity of the merchant device being determined based on the risk profile and on the association between the MuPi and the network cryptogram;
- and
- deterministically determining whether the terminal identifier (ID) received belong to the same merchant for which the MuPi was initially created.
7 more elements
Dependencies are inferred from the claim text.