Invented by Ghani; Usman, Nanjappa; Almaz, Khan; Sadi

Payment cards are everywhere. We use them for almost every purchase, both online and in stores. But sending payment card information over the internet can be risky. Hackers are always looking for ways to steal sensitive card data. That’s why businesses and payment processors are constantly searching for better ways to keep payment information safe. A new patent application describes a technology that uses something called “ephemeral compute” to address these risks. In this article, we’ll explore the background, the science, and the key ideas behind this new approach to secure payment card processing.

Background and Market Context

Let’s start with the basics. Whenever you pay for something with a card, some very private information is sent from your device to a payment processor. This information includes the card number, the expiration date, and the security code on the back of the card. If someone intercepts this information, they can use it to make fake purchases or even steal your money.

Because of these risks, the payment industry has created rules to protect card data. These rules are called the Payment Card Industry Data Security Standard, or PCI DSS. Any business that handles card payments must follow these rules. PCI DSS requires businesses to do things like:

• Encrypt card data when it’s sent over the internet
• Keep card data behind firewalls



• Make sure only certain people can see card information
• Watch for hackers and update security software often

Following these rules is not easy. It requires a lot of work, money, and expertise. Small businesses, in particular, find it hard to keep up. They have to maintain special servers, update software all the time, and make sure their networks are always secure. If they make a mistake, they could face big fines or lose the ability to accept card payments.

At the same time, customers expect fast and easy payment experiences. They want to pay with their cards on websites, in apps, and at physical stores. The more steps a business adds for security, the less convenient it is for customers. So, there’s a big challenge: How can businesses keep card data safe while still making payments quick and easy for everyone?

This is where the new technology comes in. The patent application describes a way to process payments that uses the cloud and something called “ephemeral compute” to handle sensitive card information. The goal is to reduce the work that businesses have to do to stay secure, while still protecting customer data.

Scientific Rationale and Prior Art

To understand why this new approach is important, we need to look at how card payments usually work and what has been done before.

Normally, when you enter your card information into a website or app, that information goes to a server owned by the business. The server then sends the information to a payment processor, which checks if the card is valid and approves or denies the purchase. The problem is that the business’s server has to handle the card data, even if only for a short time. If the server is hacked or not set up correctly, the card data can be exposed.

To reduce this risk, some companies use special tools called “payment gateways” or “tokenization.” A payment gateway is like a middleman that sends card data straight to the payment processor without storing it. Tokenization replaces card data with a random string of numbers (a “token”) before it’s sent to the business’s server. Both of these methods help, but they still leave some risk. If the software or the gateway is not updated, or if there is a problem with the configuration, card data can still leak.

Another approach is to use “cloud computing.” In cloud computing, instead of running software on a computer in your office, you run it in a data center owned by a cloud provider like Amazon or Google. The cloud provider takes care of the hardware, the network, and the basic security. But even in the cloud, if you have a server that always runs and processes card data, you still need to make sure it is secure. You have to keep it updated, control who has access, and monitor it for attacks.

This is where the idea of “ephemeral compute” comes into play. Ephemeral means “short-lived.” In this context, an ephemeral compute instance is a temporary computer in the cloud that is created only when it’s needed and is destroyed right after it does its job. It’s like having a clean, locked room appear out of thin air for a few seconds just to handle the most sensitive part of the payment process, and then disappear completely. No one can get into the room before or after the transaction. The idea is that if you never store card data on a machine that sticks around, hackers have nothing to find, even if they break in later.

Some companies have used similar ideas with “serverless” computing, where code runs only in response to specific events (like a button click or a form submission) and then stops. But until now, most payment systems still relied on persistent (always-on) servers or complex integrations to keep card data safe. There was no simple, out-of-the-box way for any business to process card payments using only ephemeral, short-lived cloud resources.

The patent application we’re discussing takes this idea further. It lays out a detailed method and system for using ephemeral compute to process payment card data. The goal is to make it much harder for attackers to access card data and to make compliance with PCI DSS easier for businesses.

Invention Description and Key Innovations

The heart of this invention is the use of ephemeral compute instances for handling sensitive card data during payment transactions. Let’s break down what that means and how it works, step by step, in simple terms.

When a customer wants to make a payment, the process begins with a client application. This could be a point-of-sale (POS) terminal in a store, a mobile app, or a website. The client application needs a special form to collect the customer’s card information. Instead of building this form itself, the application sends a request to a secure cloud service for the form. This request includes an authorization token, which proves that the client is allowed to handle payments.

The cloud service checks the token to make sure the request is valid. If everything looks good, it sends back a form that can capture card data. This form is usually displayed in a protected area called an IFrame. An IFrame is like a window inside a web page that only shows content from a trusted source. It keeps the card data separate from the rest of the application, so even if the main website is hacked, the card data is still safe.

Once the customer enters their card details into the form, the information is not sent to the business’s own servers. Instead, it’s sent directly (usually over HTTPS, for extra security) to the cloud service. Here is where the magic happens. The cloud service creates an ephemeral compute instance—a temporary computer just for this one transaction. This instance is pre-configured with the right code to securely send the card data to the payment processor. The only thing this instance does is transmit the card data. As soon as the data is sent, the ephemeral compute instance is destroyed. Nothing is stored or left behind.

The cloud service also has a persistent backend service that handles non-sensitive information about the transaction, like the amount, the items being bought, or the time of purchase. This information is less risky, so it can be managed with less strict controls. Both the sensitive card data (from the ephemeral compute) and the non-sensitive transaction details are sent to the payment processor, which decides whether to approve the transaction.

There are several key innovations in this approach:

1. Ephemeral Compute for Sensitive Data: By using short-lived cloud instances that are created only for the purpose of securely sending card data, the system greatly reduces the chances of data being stolen. Even if an attacker gains access to the system later, the ephemeral instance is already gone—there is nothing left to steal.

2. Isolation of Sensitive and Non-Sensitive Data: The system separates the handling of card data from other transaction information. Only the ephemeral compute instance ever sees the card number, making it easier to meet PCI DSS rules and reducing the risk for the business.

3. Use of IFrame for Data Entry: By displaying the payment form in an IFrame, the card data is kept isolated from the rest of the application. This prevents malicious code on the website from grabbing the card data.

4. Network Whitelisting: The ephemeral compute instance is only allowed to send data to trusted, whitelisted services—like the payment processor. It cannot communicate with any other network address. This further cuts down the risk of data being sent to a bad actor.

5. Token-Based Authorization: Every step is protected with tokens that prove the identity of the client. This makes sure that only authorized clients can request payment forms and send transaction data.

6. No Storage of Card Data: At no point is card data stored on a persistent server. The ephemeral compute instance is destroyed after use, and the business never touches raw card data. This is a huge advantage for PCI compliance.

7. Scalability and Ease of Use: Since everything runs on-demand in the cloud, the system can handle any number of transactions without the business having to manage servers or worry about scaling.

The result is a payment processing system that is safer, easier to maintain, and easier to keep compliant with security regulations. For businesses, this means fewer headaches, lower costs, and a reduced risk of data breaches.

How It All Comes Together

To put it all together, imagine a customer is shopping on a website. When they check out, the website asks the secure cloud service for a payment form. The form appears in an IFrame, and the customer enters their card details. The card data is sent directly to the cloud service, which spins up an ephemeral compute instance, transmits the data to the payment processor, and then shuts down the instance. The payment processor checks the card and sends back an approval or denial. At no point does the business’s own server ever see the card number. If a hacker breaks into the website, all they can get is non-sensitive information like order numbers or product details. The sensitive card data is always handled in a secure, isolated, and temporary environment.

This approach can work for online stores, mobile apps, and even physical point-of-sale terminals. It can also be extended for other types of sensitive data, not just payment cards.

Conclusion

Payment card security is a top concern for both businesses and customers. The traditional ways of handling card data require a lot of effort and still leave room for mistakes and breaches. The patent application we’ve explored introduces a new model that uses ephemeral compute instances in the cloud to handle sensitive card data. By creating a temporary, isolated environment for each transaction, and by never storing card data on persistent servers, this system makes it much harder for attackers to succeed. It also makes compliance easier and can save businesses time and money. As more transactions move to digital platforms, solutions like this will become even more important for keeping our payment information safe.

Click here https://ppubs.uspto.gov/pubwebapp/ and search 20250217791.