Encryption service API for enhancing security for payment processing

1 . A method comprising, by one or more servers associated with a receiver processor:

receiving, from a requesting server via a receiver application programming interface (API) associated with the receiver processor and configured as an encryption service API, a first request to transfer resources from a virtual bank account (VBAN) associated with an account holder to a resource account, wherein the VBAN is decoupled from an external resource account associated with the account holder and the VBAN, and wherein the first request comprises an identifier associated with the VBAN;

responsive to receiving the first request, retrieving, from a volatile memory associated with a system management service via the encryption service API, an encryption key associated with a secure storage database, wherein the secure storage database comprises encrypted account data associated with the VBAN and the external resource account, and wherein the encryption key is loaded into the volatile memory from a data storage associated with the system management service that cannot be accessed by the secure storage database;

requesting, via the encryption service API, permission to access the secure storage database;

responsive to receiving permission to access the secure storage database, bundling the identifier with the encryption key to generate a set of bundled data;

transmitting, via the encryption service API to the secure storage database, the set of bundled data generated based on the encryption key and the identifier associated with the VBAN;

receiving, from the secure storage database via the encryption service API, decrypted account data associated with the VBAN, wherein the decrypted account data is determined by a decryption module based on the encryption key and the encrypted account data associated with the VBAN;

determining that account data associated with the VBAN based at least in part on the decrypted account data is required for processing the first request;

authorizing the transfer of resources from the VBAN to the resource account based at least in part on the determined account data; and

transmitting, via the encryption service API, to the requesting server, an authorization of the transfer of resources from the VBAN to the resource account.

2 . The method of claim 1 , wherein the account data comprises one or more of an account identifier, an account alias, an account number, a routing number, an instance identifier, an entity name, an account type, or an account state.

3 . The method of claim 1 , further comprising:

receiving, via the encryption service API, a second request to update the account data associated with the VBAN based on one or more account data updates, wherein the second request comprises an identifier associated with the VBAN;

transmitting, via the encryption service API, to the secure storage database, the encryption key and the identifier associated with the VBAN;

receiving, from the secure storage database via the encryption service API, the decrypted account data associated with the VBAN;

updating the account data based on the one or more account data updates;

storing, in the secure storage database, encrypted updated account data in the secure storage database, wherein the encrypted updated account data is determined by an encryption module based on the encryption key and the updated account data.

4 . The method of claim 3 , wherein the one or more account data updates comprise replacing account data associated with the VBAN with account data associated with a second VBAN.

5 . The method of claim 3 , wherein the one or more account data updates comprise updating an account state to a closed account state.

6 . The method of claim 3 , wherein the one or more account data updates comprise updating an account state to a deleted account state, and wherein, responsive to the account state being updated to the deleted account state, the encrypted account data associated with the VBAN is deleted from the secure storage database.

7 . The method of claim 1 , further comprising:

storing, in an audit history database, for an audit associated with the VBAN, data comprising one or more of:

an audit history identifier associated with the audit;

the identifier associated with the VBAN;

an alias associated with the VBAN;

a first hash based on a routing number associated with the VBAN;

a second hash based on an account number associated with the VBAN;

a third hash based on the routing number and the account number associated with the VBAN;

a fourth hash based on an instance identifier associated with the VBAN;

an account state associated with the VBAN;

the encrypted account data;

an account creation timestamp associated with the VBAN;

an account update timestamp associated with the VBAN;

an audit action timestamp associated with the audit; or

an audit action associated with the audit.

8 . The method of claim 1 , wherein the encryption service API has access to an encrypted database password configured to access the secure storage database.

9 . The method of claim 8 , wherein the encryption service API accesses the secure storage database with the encrypted database password when the encryption service API is initialized.

10 . The method of claim 8 , wherein the encryption service API accesses the secure storage database with the encrypted database password in response to receiving the first request.

11 . The method of claim 1 , wherein the encryption service API is configured to have password-less access the secure storage database.

12 . The method of claim 1 , wherein the identifier associated with the VBAN comprises one or more of:

an alias associated with the VBAN;

a first hash based on a routing number associated with the VBAN;

a second hash based on an account number associated with the VBAN;

a third hash based on the routing number and the account number associated with the VBAN;

a fourth hash based on an instance identifier associated with the VBAN; or

a fifth hash based on an account alias associated with the VBAN.

13 . The method of claim 1 , wherein the encryption service API is configured to store data in the volatile memory storage.

14 . The method of claim 1 , wherein the encryption service API comprises a plurality of endpoints operable to process requests associated with account data stored in the secure storage database.

15 . The method of claim 14 , wherein the plurality of endpoints are configured for one or more of:

searching for the identifier by one or more of a routing number, an account number, an account alias, or an instance identifier associated with the VBAN;

searching for one or more accounts by an instance identifier;

retrieving information by an account identifier;

generating a new encrypted object comprising user account information; or

updating an existing encrypted object comprising the user account information.

16 . The method of claim 1 , further comprising:

receiving, via one or more receiver application programming interfaces (APIs) configured as payment instruction APIs, a request to create a payment origination file associated with instructions to transfer the resources from the VBAN to the resource account;

generating, based on the decrypted account data associated with the VBAN, the requested payment origination file;

transmitting, via the payment instruction APIs, to one or more remote servers associated with an external financial entity, the requested payment origination file;

receiving, via the payment instruction APIs from the one or more remote servers associated with the external financial entity, a payment return file associated with the payment origination file;

storing, in a first database associated with the receiver processor, the payment origination file and the payment return file;

validating, by a parsing module associated with the receiver processor, in response to the payment origination file and the payment return file being stored in the first database, the payment origination file and the payment return file; and

storing, in a second database associated with the receiver processor, the validated payment origination file and the validated payment return file, wherein the second database is configured to receive queries associated with one or more of a plurality of validated payment origination files and validated payment return files stored in the second database.

17 . The method of claim 1 , further comprising:

receiving a first network event corresponding to a first transaction associated with a transfer of resources between the VBAN and a third party, wherein the first network event is assigned a first unique transaction group identifier associated with the first transaction;

identifying, based on the decrypted account data associated with the VBAN, a ledger account recorded in an account ledger, wherein the ledger account represents the VBAN in the account ledger;

authorizing the transfer of resources based at least in part on a balance value of the ledger account;

recording a first update in the account ledger, wherein recording the first update comprises recording the first unique transaction group identifier in association with the first update and the ledger account, and modifying the balance value of the ledger account in the account ledger based on a transfer value associated with the transfer of resources;

receiving a second network event corresponding to a second transaction associated with the transfer of resources between the VBAN and the third party;

determining that a second unique transaction group identifier assigned to the second network event equals the first unique transaction group identifier associated with the first update and the ledger account, wherein the determination of an equivalence indicates that the balance value of the VBAN has already been modified based on the transfer of resources; and

recording a second update in the account ledger, wherein recording the second update comprises recording the second unique transaction group identifier in association with the second update without modifying the balance value of the ledger account in the account ledger.

18 . One or more computer-readable non-transitory storage media embodying software that is operable when executed to:

receive, from a requesting server by a receiver application programming interface (API) associated with a receiver processor and configured as an encryption service API, a first request to transfer resources from a virtual bank account (VBAN) associated with an account holder to a resource account, wherein the VBAN is decoupled from an external resource account associated with the account holder and the VBAN, and wherein the first request comprises an identifier associated with the VBAN;

responsive to receiving the first request, retrieve, from a volatile memory associated with a system management service via the encryption service API, an encryption key associated with a secure storage database, wherein the secure storage database comprises encrypted account data associated with the VBAN and the external resource account, and wherein the encryption key is loaded into the volatile memory from a data storage associated with the system management service that cannot be accessed by the secure storage database;

request, via the encryption service API, permission to access the secure storage database;

responsive to receiving permission to access the secure storage database, bundle the identifier with the encryption key to generate a set of bundled data;

transmit, via the encryption service API to the secure storage database, the set of bundled data generated based on the encryption key and the identifier associated with the VBAN;

receive, from the secure storage database via the encryption service API, decrypted account data associated with the VBAN, wherein the decrypted account data is determined by a decryption module based on the encryption key and the encrypted account data associated with the VBAN;

determine that account data associated with the VBAN based at least in part on the decrypted account data is required for processing the first request;

authorize the transfer of resources from the VBAN to the resource account based at least in part on the determined account data; and

transmit, via the encryption service API, to the requesting server, an authorization of the transfer of resources from the VBAN to the resource account.

19 . A receiver processor comprising: one or more processors; and a non-transitory memory coupled to the one or more processors comprising instructions executable by the one or more processors, the one or more processors operable when executing the instructions to:

receive, from a requesting server by a receiver application programming interface (API) associated with the receiver processor and configured as an encryption service API, a first request to transfer resources from a virtual bank account (VBAN) associated with an account holder to a resource account, wherein the VBAN is decoupled from an external resource account associated with the account holder and the VBAN, and wherein the first request comprises an identifier associated with the VBAN;

responsive to receiving the first request, retrieve, from a volatile memory associated with a system management service via the encryption service API, an encryption key associated with a secure storage database, wherein the secure storage database comprises encrypted account data associated with the VBAN and the external resource account, and wherein the encryption key is loaded into the volatile memory from a data storage associated with the system management service that cannot be accessed by the secure storage database;

request, via the encryption service API, permission to access the secure storage database;

responsive to receiving permission to access the secure storage database, bundle the identifier with the encryption key to generate a set of bundled data;

transmit, via the encryption service API to the secure storage database, the set of bundled data generated based on the encryption key and the identifier associated with the VBAN;

receive, from the secure storage database via the encryption service API, decrypted account data associated with the VBAN, wherein the decrypted account data is determined by a decryption module based on the encryption key and the encrypted account data associated with the VBAN;

determine that account data associated with the VBAN based at least in part on the decrypted account data is required for processing the first request;

authorize the transfer of resources from the VBAN to the resource account based at least in part on the determined account data; and

transmit, via the encryption service API, to the requesting server, an authorization of the transfer of resources from the VBAN to the resource account.