Patent ID: 9577991
Date: 2017-02-21
CPC Classifications: H04L

Claim:
1. A method comprising: receiving, at a first server from a browser on a client, a request to access a web page, the web page including one or more elements for receiving sensitive information when the web page is displayed in the browser; generating, at the first server, a security token, the security token including information for determining whether the security token is expired, the generating the security token comprising using a public key of a second server to encrypt the information for determining whether the security token is expired; sending, from the first server to the client, the web page, the security token being embedded in the web page, the web page including embedded executable code configured to run within the browser on the client, wherein the embedded executable code, when executed on the client, is configured to generate an inline frame within the web page and cause the browser to send the sensitive information and the security token to the second server via the inline frame, the inline frame being configured to communicate with the second server; receiving, at the first server from the client, an encrypted transaction token; at the first server, performing operations on the encrypted transaction token to authenticate the second server and identify a transaction token, the transaction token comprising a string of characters associated with the sensitive information; sending, from the first server to a service provider, the transaction token and a request to authorize a transaction based on the transaction token, wherein the sensitive information is required to complete the transaction, and wherein the first server is not required to collect or process the sensitive information to complete the transaction; receiving, at the first server from the service provider, a response to the request; and sending, from the first server to the client, information based on the response.