High performance tokenization platform for sensitive data

1. A computer-implemented method for in-memory tokenization by an application server, the method comprising:

transmitting, from the application server to a hardware security module, a request for an encryption key,

receiving, in response to the request and from the hardware security module, the encryption key;

receiving, from a client device, a request to tokenize a user object;

hashing the user object to generate a hashed user object;

determining, by the application server, that the hashed user object has not previously been stored in a multi-level cache in the application server, wherein the multi-level cache is an in-memory database in the application server;

generating, based on the determining, a token using the hashed user object;

hashing the token to generate a hashed token;

encrypting, by the application server, the token using the encryption key to generate an encrypted token; and

storing the hashed token and the encrypted token in the multi-level cache.

2. The method of claim 1 , wherein the multi-level cache comprises a local cache and a key-value store, and wherein the hashed token and the encrypted key are stored in the local cache and the key-value store of the multi-level cache.

3. The method of claim 2 , further comprising:

asynchronously replicating, from the key-value store to a second key-value store, the hashed token and the encrypted token, wherein the second key-value store is located remotely from the application server.

4. The method of claim 2 , wherein prior to the encrypting step, the method further comprises:

determining a match between the hashed user object and a plurality of hashed user objects stored in the multi-level cache;

responsive to determining the match, receiving, from the multi-level cache, a cached encrypted token associated with the hashed user object; and

transmitting the cached encrypted token to the client device.

5. The method of claim 4 , wherein determining the match comprises:

determining whether a first match exists between the hashed user object and a first plurality of hashed user objects stored in the local cache; and

when no first match exists, determining a second match between the hashed user object with a second plurality of hashed user objects stored in the key-value store.

6. The method of claim 1 , the method further comprises:

storing the hashed user object in the multi-level cache; and

replicating the hashed user object in a cloud-based relational database that is located remotely from the application server.

7. The method of claim 1 , further comprising:

replicating the hashed token and the encrypted token in a first cloud-based relational database that is located remotely from the application server; and

replicating, from the first cloud-based relational database to a second cloud-based relational database, the hashed token and the encrypted token, wherein the second cloud-based relational database is located remotely from the first cloud-based relational database.

8. The method of claim 1 , wherein the encrypting comprises performing an in-memory operation of processing the token while the token is stored in the multi-level cache of the application server.

9. The method of claim 1 , further comprising:

decrypting, by the application server, the encrypted token to generate a decrypted token; and

transmitting the decrypted token to the client device.

10. The method of claim 9 , wherein the decrypting comprises an in-memory operation of processing the encrypted token while the encrypted token is stored in the multi-level cache of the application server.

11. An apparatus for performing scalable in-memory tokenization, comprising:

a memory comprising a multi-level cache; and

a processor communicatively coupled to the memory and configured to:

transmit, to a hardware security module, a request for an encryption key;

receive, in response to the request and from the hardware security module, the encryption key, wherein the hardware security module is remote from the apparatus;

store the encryption key in the multi-level cache;

receive, from a client device, a request to tokenize a user object;

hash the user object to generate a hashed user object;

determine that the hashed user object has not previously been stored in the multi-level cache, wherein the multi-level cache is an in-memory database;

generate, based on the determining, a token using the hashed user object;

hash the token to generate a hashed token;

encrypt the token using the encryption key from the multi-level cache to generate an encrypted token; and

store the hashed token and the encrypted token in the multi-level cache.

12. The apparatus of claim 11 , wherein the multi-level cache comprises a local cache and a key-value store and wherein the hashed token and the encrypted key are stored in the local cache and the key-value store of the multi-level cache.

13. The apparatus of claim 12 , the processor further configured to:

asynchronously replicate, from the key-value store to a second key-value store, the hashed token and the encrypted token, wherein the second key-value store is located remotely from the apparatus.

14. The apparatus of claim 11 , wherein in determining that the hash user object is not in the multi-level cache, the processor is further configured to:

store the hashed user object in the multi-level cache; and

replicate the hashed user object in a cloud-based relational database that is located remotely from the apparatus.

15. The apparatus of claim 11 , the processor further configured to:

replicate the hashed token and the encrypted token in a first cloud-based relational database, wherein the first cloud-based relational database is located remotely from an application server; and

replicate, from the first cloud-based relational database to a second cloud-based relational database, the hashed token and the encrypted token, wherein the second cloud-based relational database is located remotely from the first cloud-based relational database.

16. The apparatus of claim 11 , wherein in encrypting the token, the processor is further configured to:

perform an in-memory operation of processing the token while the token is stored in the multi-level cache of the application server.

17. The apparatus of claim 11 , the processor further configured to:

decrypt, by the application server, the encrypted token to generate a decrypted token; and

transmit the decrypted token to the client device.

18. The apparatus of claim 17 , wherein in decrypting the encrypted token, the processor is further configured to:

perform an in-memory operation of processing the encrypted token while the encrypted token is stored in the multi-level cache of the application server.

19. The apparatus of claim 11 , the processor further configured to:

validate the hashed user object by determining a match between the hashed user object with a plurality of hashed user objects stored in the multi-level cache; and

responsive to determining the match:

receive, from the multi-level cache, a cached encrypted token associated with the hashed user object; and

transmit the cached encrypted token to the client device.

20. A non-transitory computer-readable medium storing instructions, wherein the instructions, when executed by a processor, cause the processor to perform operations comprising:

transmitting, to a hardware security module, a request for an encryption key;

receiving, from the hardware security module, the encryption key;

receiving, from a client device, a request to tokenize a user object;

hashing the user object to generate a hashed user object;

validating the hashed user object by:

determining whether the hashed user object matches with a first plurality of hashed user objects stored in a local cache of a multi-level cache or a second plurality of hashed user objects stored in a key-value store of the multi-level cache, wherein the multi-level cache is an in-memory database of an application server; and

responsive to the determining:

receiving, from the multi-level cache, a cached encrypted token associated with the hashed user object; and

transmitting the cached encrypted token to the client device.