JR/T 0149-2016 in English

Core Framework of Payment Tokenization Technology

This standard builds a payment tokenization system with Token Service Provider (TSP) as the core, and replaces the original payment account with payment token to achieve sensitive information protection. The technical architecture includes three key roles:

Key technology implementation requirements

1. Token generation specifications

Token adopts a 13-34-bit three-segment structure: class=instrument>TIN(6-12 digits)+custom digits+check code, global uniqueness must be guaranteed. Example encoding rules:

2. Domain control management mechanism

The use scope of Token is limited through five-dimensional domain control parameters:

1. Transaction channel: ATM/mobile phone/PC and other multi-channel permission bitmap control
2. Merchant range: Single merchant or multiple merchant identification
3. Amount limit: Not exceeding the original account transaction limit
4. Number of uses: The maximum number of transactions can be set
5. Validity period: Must be earlier than the original account expiration date

Security compliance points

1. Data transmission protection

According to clause 10.4.6 of the standard, all sensitive information transmission must meet the following requirements:

• Use commercial encryption algorithms certified by the National Cryptography Administration
• Communication links use TLS 1.2+ protocol
• Message integrity check (MAC value)

2. Client security requirements

Standard 10.4.13 clearly stipulates that mobile clients need to:

Implementation suggestions

1. System construction path

Institutions are recommended to advance in three stages:

1. Infrastructure construction period (3-6 months): Complete TSP system architecture design and pass PCI DSS certification
2. Pilot operation period (6-12 months): Select low-risk scenarios such as QR code payment for verification
3. Full promotion period: Gradually expand to high-sensitivity scenarios such as online consumption and cross-border payment

2. Risk control strategy

It is recommended to establish a hierarchical risk control model: