Secure Data Transfer

1 . A process, for migrating controlled data from an existing controlled data environment (CDE) to a new CDE, comprising:

generating first security keys (“1 st Keys”);

wherein the 1 st Keys include a first public key (1PUK) and a first private key (1PRK);

generating an encryption context (EC);

generating, based on the EC, second security keys (“2 nd Keys”);

wherein the 2 nd Keys include an encrypted 2 nd Key (e2SEK) and an unencrypted 2 nd Key (u2SEK);

encrypting, using the u2SEK, the 1PRK to generate an encrypted 1PRK (“e1PRK”);

generating a migration request;

wherein the migration request requests transfer of controlled data from an existing data store (EDS) to a new data store (NDS);

wherein the EDS is controlled by the existing CDE; and

wherein the NDS is controlled by the new CDE;

communicating, by the new CDE, the migration request and the 1PUK to the existing CDE;

wherein, the existing CDE utilizes the 1PUK to encrypt the controlled data and output encrypted controlled data in a transfer file;

receiving the transfer file from the existing CDE;

upon receiving the transfer file:

decrypting the transfer file; and

storing the transfer file in the NDS.

2 . The process of claim 1 ,

wherein the 1 st Keys are asymmetrical keys; and

wherein the 2 nd Keys are symmetrical keys.

3 . The process of claim 2 ,

wherein the 2 nd Keys are generated by a key management system (KMS); and

wherein the KMS is operated independently of the existing CDE and the new CDE.

4 . The process of claim 3 ,

wherein the EC identifies the NDS as a designated storage location for the transfer file.

5 . The process of claim 4 ,

wherein, after the operation of encrypting the 1PRK to generate the e1PRK, the process further comprises:

discarding the 1PRK;

storing the e1PRK in a staging vault controlled by the new CDE; and

storing the e2SEK in the staging vault.

6 . The process of claim 5 ,

wherein the receiving of the transfer further comprises:

receiving, by the new CDE from the existing CDE, a message indicating that a first transfer of the transfer file from an existing CDE data store (EDS) to a first secure file transfer data store (1SFT) associated with the existing CDE has occurred;

second instructing the 1SFT to second transfer the transfer file from the 1SFT to a second secure file transfer data store (2SFT) associated with the new CDE; and

third instructing the 2SFT to third transfer the transfer file from the 2SFT to a staging vault associated with the new CDE.

7 . The process of claim 1 ,

wherein the encrypted controlled data in the transfer file includes corresponding user data (CUD);

wherein the CUD includes user data (UD) filtered, by the existing CDE, from multiple UD entries provided in the EDS; and

wherein the CUD includes UD that corresponds to at least one criteria specified in the migration request.

8 . The process of claim 1 ,

wherein the encrypted controlled data in the transfer file includes corresponding user data (CUD) set forth in two or more rows.

9 . The process of claim 8 ,

wherein each row of the two or more rows includes personally identifiable data (PID) for a given user;

wherein the PID includes data that is payment card industry (PCI) compliant;

wherein the existing CDE is an existing PCI Compliant Controlled Data Environment (EPCI-CDE);

wherein the new CDE is a new PCI Compliant Controlled Data Environment (NPCI-CDE); and

wherein the transfer file is a PCI compliant transfer file (PTF).

10 . The process of claim 8 ,

wherein the decrypting of the transfer file, uses a second instance of the 1PRK (1PRK-2), to generate a second instance of the controlled data and further comprises operations including:

generating third security keys (“3 rd Keys”); and

for a given row of the two or more rows in the transfer file:

separately decrypting the given row to generate a given row of unencrypted CUD;

re-encrypting, using the 3 rd Keys, the given row of unencrypted CUD to generate a given 3 rd Key encrypted row of CUD;

storing the given 3 rd Key encrypted row of CUD in a staging vault (SV); and

publishing a row identifier (RID) for the, as stored, given 3 rd Key encrypted row of CUD; and

repeating the operations above for each of the two or more rows.

11 . The process of claim 10 ,

wherein the 3 rd Keys are symmetric keys and include an encrypted 3 rd Key (e3SEK) and an unencrypted 3 rd Key (u3SEK).

12 . The process of claim 10 ,

wherein the third transfer of the transfer file further comprises:

segmenting the transfer file into two or more chunks;

wherein a given chunk of the two or more chunks includes at least one row of the two or more rows in the transfer file.

13 . The process of claim 10 ,

wherein each row includes personally identifiable data (PID) for a given user.

14 . The process of claim 10 ,

wherein with respect to at least one given row of the two or more rows in the transfer file, the process further comprises:

reading the RID;

retrieving, from the SV, the given 3 rd Key encrypted row of CUD;

decrypting, using the 3 rd Keys, the given 3 rd Key encrypted row of CUD, to re-generate the given row of unencrypted CUD;

obtaining a new account number (NAN) for the given RID;

generating fourth security keys (4 th Keys);

encrypting, using the 4 th Keys, the given row of unencrypted CUD to generate a given 4 th Key encrypted row of CUD; and

storing the given 4 th Key encrypted row of CUD in the NDS.

15 . The process of claim 14 ,

wherein the 4 th Keys are symmetric keys and include an encrypted 4 th Key (e4SEK) and an unencrypted 4 th Key (u4SEK).

16 . The process of claim 14 ,

wherein with respect to at least one given row of the two or more rows in the transfer file, the process further comprises:

retrieving the given 4 th Key encrypted row of CUD from the NDS;

decrypting, using the 4 th Keys, the given 4 th Key encrypted row of CUD to generate user instrument data (UID);

generating, from the UID, a payment instrument fingerprint (PIF);

transmitting the PIF to a PIF data store (PIFDS);

generating fifth security keys (5 th Keys);

encrypting the PIF, using the 5 th Keys, to generate an encrypted PIF (ePIF); and

storing the ePIF in the SV.

17 . The process of claim 16 ,

wherein the 5 th Keys are symmetric keys and include an encrypted 5 th Key (e5SEK) and an unencrypted 5 th Key (u5SEK).

18 . The process of claim 1 , further comprising:

receiving at least one operational parameter (OPPS) for the new CDE; and

wherein the EC is generated based on the OPPS.

19 . The process of claim 18 , further comprising:

generating a globally unique identifier for an encrypted storage token (EST);

storing, based on the EST, the e2SEK and the e1PRK; and

storing, based on the OPPS, the EST in the NDS.

20 . The process of claim 19 , further comprising:

retrieving, based on the EST, the e2SEK and the e1PRK;

generating, based on the OPPS, generating a second instance of the EC (EC-2);

generating a second instance of the u2SEK (u2SEK-2) based on the EC-2; and

wherein the decrypting of the transfer file further comprises:

decrypting, using the u2SEK-2, the e1PRK to generate a second instance of the 1PRK (1PRK-2);

decrypting the transfer file, using the 1PRK-2, to generate a second instance of the controlled data; and

wherein the storing of the transfer file in the NDS further comprises storing the second instance of the controlled data in the NDS.