Systems and methods for data management and the use of salts and keys in data encryption/decryption

1. A method of encrypting sensitive information, comprising:

hashing sensitive information by a hash function;

selecting a salt based, at least in part, on the hashed sensitive information, wherein selecting the salt comprises:

performing a modulo operation on the hashed sensitive information with a number of salts in a numbered list of salts, the number of salts being a total number of salts in the numbered list, and the numbered list being ordered based on numbers associated with each salts,

identifying a number of a respective salt in the numbered list of salts based on a remainder of the modulo operation, and

selecting the respective salt from the ordered list according to the identified number;

combining the selected salt with the sensitive information to yield combined sensitive information;

encrypting the combined sensitive information by a destructive, non-reversible encryption function, wherein the destructive, non-reversible encryption function comprises an authentication code algorithm and an iterative encryption function; and

storing the encrypted combined sensitive information.

2. The method of claim 1 , comprising storing the encrypted combined sensitive information in a secure database.

3. The method of claim 1 , further comprising, prior to encrypting the sensitive information:

generating a number of salts;

forming the numbered list of salts into an ordered listing;

concatenating the salts in the numbered list of into a binary large object in an ordering defined by the ordered list;

sending the binary large object to a cryptographic processing system for encryption with a key encryption key to form an encrypted binary large object; and

storing the encrypted binary large object received from the cryptographic processing system in a database.

4. The method of claim 3 , wherein the database comprises a secure database.

5. The method of claim 3 , further comprising:

retrieving the stored encrypted binary large object;

sending the retrieved encrypted binary large object to the cryptographic processing system for decryption;

parsing the decrypted binary large object into respective salts;

forming the numbered list of salts from the respective salts; and

storing the numbered list of salts in a volatile memory.

6. The method of claim 5 , comprising:

retrieving the binary large object by a processing device after booting of the processing device.

7. The method of claim 1 , wherein the sensitive information comprises a first portion and a second portion, the method further comprising:

hashing the first portion by the hash function; and

combining the hashed first portion with the selected salt.

8. The method of claim 7 , wherein:

the sensitive information comprises received plain text card data;

the first portion of the plain text card data comprises a personal account number; and

the second portion of the plain text card data comprises other data in the plain text card data.

9. The method of claim 8 , wherein the other data comprises:

cardholder name, expiration date, a CVV, a PIN verification Key, a PIN Verification value, a card verification value, a card verification code, and/or EMV information.

10. The method of claim 8 , further comprising:

hashing the second portion by a hash function; and

encrypting the hashed second portion.

11. A method of encrypting information, comprising:

hashing sensitive information by a hash function;

selecting an encryption key based, at least in part, on the hashed sensitive information, wherein selecting the encryption key comprises:

performing a modulo operation on the hashed sensitive information with a number of encryption keys in a numbered list of encryption keys, the number of encryption keys being a total number of encryption keys in the numbered list, and the numbered list being ordered,

identifying a number of a respective encryption keys in the numbered list of encryption keys based on a remainder of the modulo operation, and

selecting the respective encryption keys from the ordered list according to the identified number;

encrypting the sensitive information by the selected encryption key using a destructive, non-reversible encryption function, wherein the destructive, non-reversible encryption function comprises an authentication code algorithm and an iterative encryption function; and

storing the encrypted sensitive information.

12. The method of claim 11 , wherein the encryption key comprises an AES key.

13. The method of claim 11 , comprising storing the encrypted sensitive information in a secure database.

14. The method of claim 11 , further comprising, prior to encrypting the sensitive information:

generating a number of encryption keys;

sending the generated number of encryption keys to a cryptographic processing system for encryption with a key encryption key;

receiving the encrypted encryption keys; and

storing the encrypted encryption keys in a database.

15. The method of claim 14 , wherein the sensitive information comprises a first portion and a second portion, the method further comprising:

hashing the first portion by the hash function; and

encrypting the hashed first portion with the selected encryption key.

16. The method of claim 15 , wherein:

the sensitive information comprises received plain text card data including a personal account number and other data;

the first portion of the plain text card data comprises the other data; and

the second portion of the plain text card data comprises the personal account number.

17. The method of claim 16 , wherein the first portion comprises:

cardholder name, expiration date, a CVV, a PIN verification Key, a PIN Verification value, a card verification value, a card verification code, and/or EMV information.

18. The method of claim 16 , further comprising:

hashing the second portion by a hash function; and

encrypting the hashed second portion.

19. A system for encrypting sensitive information, comprising:

storage; and

a processing device coupled with the storage configured to:

hash sensitive information by a hash function;

select a salt based, at least in part, on the hashed sensitive information, wherein selection of the salt comprises:

performing a modulo operation on the hashed sensitive information with a number of salts in a numbered list of salts, the number of salts being a total number of salts in the numbered list, and the numbered list being ordered based on numbers associated with each salt,

identifying a number of a respective salt in the numbered list of salts based on a remainder of the modulo operation, and

selecting the respective salt from the ordered list according to the identified number;

combine the selected salt with the sensitive information to yield combined sensitive information;

encrypt the combined sensitive information by a destructive, non-reversible encryption function, wherein the destructive, non-reversible encryption function comprises an authentication code algorithm and an iterative encryption function; and

store the combined sensitive information in the storage.

20. The system of claim 19 , wherein the storage comprises a secure database.

21. The system of claim 19 , wherein the processing device is configured to select the salt by:

dividing the hashed sensitive information by a number of salts in a numbered list of salts;

identifying a number of a respective salt in the numbered list of salts based on the remainder; and

selecting the respective salt corresponding to the selected number.

22. The system of claim 19 , wherein:

the storage comprises a secure database; and

the processing device is configured to store the encrypted binary object in the secure database.

23. The system of claim 19 , wherein the processing device is further configured to:

retrieve the stored encrypted binary large object;

send the retrieved encrypted binary large object to the cryptographic processing system for decryption;

parse the decrypted binary large object into respective salts;

form the numbered list of salts; and

store the numbered list of salts in a volatile memory.

24. The system of claim 23 , wherein the processing device is configured to:

retrieve the binary large object by the processing device after booting of the processing device.

25. The method of claim 19 , wherein the sensitive information comprises a first portion and a second portion, the processing device being further configured to:

hash the first portion by the hash function; and

combine the hashed first portion with the selected salt.

26. The system of claim 25 , wherein:

the sensitive information comprises plain text card data;

the first portion of the plain text card data comprises a personal account number; and

the second portion of the plain text card data comprises other data in the plain text card data.

27. The system of claim 26 , wherein the other data comprises:

cardholder name, expiration date, a CVV, a PIN verification Key, a PIN Verification

value, a card verification value, a card verification code and/or EMV data.

28. The system of claim 25 , wherein the processing device is further configured to:

hash the second portion by a hash function; and

encrypt the hashed second portion.

29. A system for encrypting information, comprising:

storage; and

a processing device coupled with the storage and configured to:

hash sensitive information by a hash function;

select an encryption key based, at least in part, on the hashed sensitive information, wherein the selection of the encryption key comprises:

performing a modulo operation on the hashed sensitive information with a number of encryption keys in a numbered list of encryption keys, the number of encryption keys being a total number of encryption keys in the numbered list, and the numbered list being ordered,

identifying a number of a respective encryption keys in the numbered list of encryption keys based on a remainder of the modulo operation, and

selecting the respective encryption keys from the ordered list according to the identified number;

encrypt the sensitive information by the selected encryption key using a destructive, non-reversible encryption function, wherein the destructive, non-reversible encryption function comprises an authentication code algorithm and an iterative encryption function; and

store the encrypted sensitive information in the storage.

30. The system of claim 29 , wherein the encryption key comprises an AES key.

31. The system of claim 30 , wherein the sensitive information comprises a first portion and a second portion, the processing device being further configured to:

hash the first portion by the hash function;

encrypt the hashed first portion by the selected encryption key.

32. The system of claim 31 , wherein:

the sensitive information comprises plain text card data including a personal account number and other data;

the first portion of the plain text card data comprises the other data; and

the second portion of the plain text card data comprises the personal account number.

33. The method of claim 32 , wherein the other data comprises:

cardholder name, expiration date, a CVV, a PIN verification Key, a PIN Verification value, a card verification value, a card verification code and/or EMV data.

34. The system of claim 31 , wherein the processing device is further configured to:

hash the second portion by a hash function; and

encrypt the hashed second portion.

35. The system of claim 29 , wherein:

the storage comprises a secure database; and

the processing device is configured to store the encrypted sensitive information in the secure database.

36. The system of claim 29 , wherein the processing device is further configured to, prior to encrypting the sensitive information:

generate a number of encryption keys;

send the number of encryption keys to the cryptographic processing system for encryption with a key encryption key; and

store the encrypted encryption keys in the database.