Overview

Visa Cloud Token Framework (CTF) adds an authentication layer on top of Network Tokenization for e-commerce transactions.

It authenticates the end user on the device. Visa verifies the proof of authentication. Visa then forwards indicators to the issuer in the authorization request.

Visa Digital Authentication Framework (DAF) is Visa's framework that uses these signals. It helps improve approval rates and reduce fraud in tokenized CNP flows.

How it works

CTF relies on a device-generated RSA key pair.

1. The merchant/PSP integrates Thales SDK in the merchant application.
2. The SDK generates an RSA key pair on the device.
3. The private key stays on the device. The public key is registered with VTS.
4. A device binding links the device to the token on the server side.
5. During a transaction, the end user authenticates on the device (for example, biometrics).
6. The device uses the private key to sign a Visa-defined payload.
7. The signed payload is exchanged with VTS to obtain a transaction cryptogram.

Browsers are not supported. CTF requires device key storage and device authentication.

End-user experience

Device binding runs once per device and token. It runs before the first authenticated transaction.

Prerequisites

1. The card is already tokenized.
2. The end user has configured a device unlock method (for example, biometrics).

First-time device binding to link the device and the token.

After binding, the end user authenticates on the device during each transaction.

The CTF private key is protected by the device unlock mechanism.

Device unlock authentication (Android/iOS) is separate from any authentication implemented in the merchant application.

Assets and parameters

CTF introduces a few Visa-specific identifiers and device assets.

deviceId

24-character identifier for the device being bound to a token.

Thales SDK generates and manages it.

vProvisionedTokenId

Visa-specific identifier for a cloud token.

Do not confuse it with tokenId. Both identify the same token. Only vProvisionedTokenId is accepted by CTF flows.

Thales backend returns vProvisionedTokenId in:

• Create token response
• Notify token creation request
• Get token response

CTF RSA key pair

Generated once and stored on the device.

• The public key is registered with VTS.
• The private key signs Visa-defined payloads during binding and transactions.

Thales SDK manages key generation and storage.

OTP

During device binding, the issuer can require step-up authentication.

When the selected method is One-time Password (OTP), your merchant application collects the OTP and passes it to Thales SDK.

Binding state

A binding represents a link between a device and a token.

• A binding state is ACTIVE or DELETED.
• Multiple tokens can be bound to the same device.