Patent ID: 9154470
Filing Date: 2015-10-06
Classification: H04L

Abstract:
1. A method comprising: receiving, at a first server from a browser on a client, a security token and sensitive information, the security token having been generated by a second server, the second server having embedded the security token in a web page, the web page including embedded executable code configured to run within the browser on the client, wherein the embedded executable code, when executed on the client, is operable to cause the browser to send the sensitive information and the security token to the first server without requiring the sensitive information be sent to the second server, wherein the sensitive information comprises sensitive information the browser sent to the first server via an inline frame, and wherein the sensitive information is required to complete a transaction; at the first server, performing operations on the security token for authenticating the second server and determining whether the security token is expired; in response to authenticating the second server and determining that the security token is not expired, sending, from the first server to a service provider, the sensitive information and a request for a transaction token; receiving, at the first server from the service provider, the transaction token, the transaction token comprising a string of characters associated with the sensitive information; at the first server, using a public key of the second server to encrypt the transaction token; and sending, from the first server to the client, a uniform resource locator (URL) specifying a page hosted by the second server, the URL including the encrypted transaction token as a parameter, wherein the URL is configured to cause the browser on the client to send, to the second server, a request for the page and the encrypted transaction token.