Securing lender output data
A multi-lender architecture is configured to provide a loan applicant with automated pre-qualification and automobile loan eligibility evaluation for multiple candidate lenders. Lender output data may include sensitive data. The lender output data is stored in a data object of a first format and one or more fields of the data object are encrypted at the field level. The encrypted data object may be transmitted through multiple application layers or terminals. The encrypted data object may be reformatted at one or more application layers or terminals without decryption. A reformatted encrypted data object containing the lender output data may be decrypted at the last layer before forwarding the lender output data to the loan applicant.
1. A method for decrypting data, the method comprising:
processing, by a processor, applicant data to generate lender output data comprising sensitive data and non-sensitive data;
receiving a data object comprising encrypted data that comprises the sensitive data encrypted using an unencrypted data key, unencrypted data that comprises the non-sensitive data, a first path identifying a first data element of the data object in a first format, and an encrypted data key, wherein the unencrypted data key is discarded after encryption of the encrypted data;
generating a new data object in a second format by:
capturing the first path identifying the first data element of the data object and a second path of a second data element of the new data object using a dynamic proxy; and
copying the encrypted data and the encrypted data key from the data object to the new data object in response to capturing the first and second path; and
decrypting, based on a decrypted data key, the encrypted data of the new data object by:
authenticating the encrypted data key determined from encryption metadata of the new data object; and
receiving, based on the authenticated encrypted data key sent to an encryption service, the decrypted data key from the encryption service.
2. The method of claim 1 , wherein the encrypted data is copied from second encryption metadata of the data object to a first encryption metadata of the new data object.
3. The method of claim 1 , wherein the first encryption metadata comprises:
the second path identifying the second data element of the new data object, the encrypted data, and the encrypted data key.
4. The method of claim 3 , wherein the first path is different from the second path, or a path identifying the second data element of the new data object is different from a new path identifying a corresponding data element in the new data object of the second format.
5. The method of claim 1 , further comprising creating the dynamic proxy by mapping the data object to the new data object.
6. The method of claim 1 , wherein the lender output data comprises an approval for an automobile loan or a rejection for the automobile loan.
7. The method of claim 1 , further comprising:
identifying a master key using a decryption identifier appended to the encrypted data key; and
decrypting the encrypted data key using the master key.
8. A system for decrypting data, the system comprising:
a memory; and
a processor coupled to the memory, the processor configured to:
process applicant data to generate lender output data comprising sensitive data and non-sensitive data;
receive a data object comprising encrypted data that comprises the sensitive data encrypted using an unencrypted data key, unencrypted data that comprises the non-sensitive data, a first path identifying a first data element of the data object in a first format, and an encrypted data key, wherein the unencrypted data key is discarded after encryption of the encrypted data;
generate a new data object in a second format by:
capturing the first path identifying the first data element of the data object and a second path of a second data element of the new data object using a dynamic proxy; and
copying the encrypted data and the encrypted data key from the data object to the new data object in response to capturing the first and second path; and
decrypt, based on a decrypted data key, the encrypted data of the new data object by:
authenticating the encrypted data key determined from encryption metadata of the new data object; and
receiving, based on the authenticated encrypted data key sent to an encryption service, the decrypted data key from the encryption service.
9. The system of claim 8 , wherein the encrypted data is copied from second encryption metadata of the data object to a first encryption metadata of the new data object.
10. The system of claim 8 , wherein the first encryption metadata comprises:
the second path identifying the second data element of the new data object, the encrypted data, and the encrypted data key.
11. The system of claim 10 , wherein the first path is different from the second path, or a path identifying the second data element of the new data object is different from a new path identifying a corresponding data element in the new data object of the second format.
12. The system of claim 8 , wherein the processor is further configured to create the dynamic proxy by mapping the data object to the new data object.
13. The system of claim 8 , wherein the processor is further configured to:
identify a master key using a decryption identifier appended to the encrypted data key; and
decrypt the encrypted data key using the master key.
14. A method for encrypting data, the method comprising:
generating, by a processor, lender output data comprising sensitive data and non-sensitive data;
encrypting the sensitive data, using an unencrypted version of a data key, while leaving the non-sensitive data unencrypted;
discarding the unencrypted version of the data key after encryption of the sensitive data;
storing the lender output data in a data object formatted in a first format, the data object comprising:
a first data element;
a second data element comprising the unencrypted non-sensitive data and encryption metadata comprising:
the encrypted sensitive data;
a first path identifying the first data element in the first format; and
an encrypted data key;
decrypting, based on a decrypted data key, the encrypted sensitive data by:
authenticating the encrypted data key identified from the encryption metadata; and
receiving, based on the authenticated encrypted data key sent to an encryption service, the decrypted data key from the encryption service; and
transmitting the data object comprising the decrypted sensitive data to a layer of a multi-layered architecture, wherein the layer is configured to interface with a user device.
15. The method of claim 14 , wherein the data key comprises a symmetric encryption key.
16. The method of claim 14 , further comprising encrypting the data key using a master key to generate the encrypted data key.
17. The method of claim 14 , wherein the lender output data comprises an approval for an automobile loan or a rejection for the automobile loan.
18. The method of claim 14 , further comprising:
appending a decryption identifier to the encrypted data and the encryption data key;
identifying a master key using the decryption identifier; and
decrypting the encrypted data key using the master key.