Granted Patent B2

US 10,491,388 · App. 16/290,604 · Granted Nov 26, 2019

Abstract

Claims (50)

1. A method for encrypting and storing data, comprising:

receiving, at a computing system, from a computing device associated with a user of the computing system, a request to encrypt a plurality of units of data, each unit of data associated with a context describing a feature of a transaction facilitated by the computing system;

for each unit of data:

generating a tokenized representation of the unit of data, the tokenized representation uniquely identifying the unit of data;

encrypting the unit of data using a first encryption key uniquely generated for the unit of data;

storing the encrypted unit of data in a protected data store;

encrypting the first encryption key with a second encryption key, the second encryption key generated based at least on the tokenized representation and the context associated with the unit of data; and

storing the tokenized representation and the encrypted first encryption key in a token store, the token store being physically separate from the protected data store.

2. The method of claim 1 , wherein generating the tokenized representation further comprises:

receiving a request to generate a token;

receiving, as input, the unit of data, associated context, and token metadata; and

sending the input to a policy module for selection of the key, a cipher, and storage restrictions for storing the encrypted unit of data.

3. The method of claim 1 , wherein the context is associated with an entity that owns the unit of data.

4. The method of claim 1 , further comprising:

salting and hashing the context; and

storing the hashed context in the token store.

5. The method of claim 1 , wherein the tokenized representation is opaque.

6. The method of claim 1 , wherein the tokenized representation is semi-opaque.

7. The method of claim 1 , wherein the tokenized representation has a token type that describes contents of the unit of data and a format of the tokenized representation.

8. The method of claim 1 , further comprising applying authorization mechanisms for the encrypted unit of data.

9. A method for accessing protected data, comprising:

receiving, at a computing system, from a computing device associated with a user of the computing system, a request for dereferencing a tokenized representation of a unit of data of a plurality of units of data that is encrypted and stored in a protected data store, the request including the tokenized representation and a context associated with an entity to which the unit of data belongs, the context describing a feature of a transaction facilitated by the computing system;

identifying a first encryption key stored in a token store that was used to encrypt the unit of data;

generating a second encryption key based at least on the tokenized representation and the context;

decrypting the first encryption key using the generated second encryption key;

decrypting the unit of data stored in the protected data store using the decrypted first encryption key; and

transmitting the decrypted unit of data to a requesting application.

10. The method of claim 9 , further comprising generating a salted hash of the context.

11. The method of claim 9 , wherein the tokenized representation is opaque.

12. The method of claim 9 , wherein the tokenized representation is semi-opaque.

13. The method of claim 9 , wherein the tokenized representation has a token type that describes contents of the unit of data and a format of the tokenized representation.

14. A non-transitory computer-readable storage medium storing computer-executable instructions that, in response to executing, cause a device comprising a processor to perform operations, comprising:

receiving, at a computing system, from a computing device associated with a user of the computing system, a request to encrypt a plurality of units of data, each unit of data associated with a context describing a feature of a transaction facilitated by the computing system;

for each unit of data:

generating a tokenized representation of the unit of data, the tokenized representation uniquely identifying the unit of data;

encrypting the unit of data using a first encryption key uniquely generated for the unit of data;

storing the encrypted unit of data in a protected data store;

encrypting the first encryption key with a second encryption key, the second encryption key generated based at least on the tokenized representation and the context associated with the unit of data; and

storing the tokenized representation and the encrypted first encryption key in a token store, the token store being physically separate from the protected data store.

15. The computer-readable medium of claim 14 , wherein generating the tokenized representation further comprises:

receiving a request to generate a token;

receiving, as input, the unit of data, associated context, and token metadata; and

sending the input to a policy module for selection of the key, a cipher, and storage restrictions for storing the encrypted unit of data.

16. The computer-readable medium of claim 14 , wherein the context is associated with an entity that owns the unit of data.

17. The computer-readable medium of claim 14 , wherein the instructions further comprise instructions for:

salting and hashing the context; and

storing the hashed context in the token store.

18. The computer-readable medium of claim 14 , wherein the tokenized representation is opaque.

19. The computer-readable medium of claim 14 , wherein the tokenized representation is semi-opaque.

20. The computer-readable medium of claim 14 , wherein the tokenized representation has a token type that describes contents of the unit of data and a format of the tokenized representation.

Assignments (7)