High performance tokenization platform for sensitive data
Disclosed herein are system, method, and computer program product embodiments for processing tokenization requests in-memory of an application server. Reliance on remote devices, such as hardware security modules, is reduced because functions associated with processing tokenization requests is performed at the application server instead of the remote devices. Applicant server includes a multi-level cache for storing and accessing data for generating, hashing, and encrypting tokens in response to tokenization requests received from client devices.
1. A computer-implemented method for in-memory tokenization by an application server, the method comprising:
transmitting, from the application server to a hardware security module, a request for an encryption key;
receiving, in response to the request and from the hardware security module, the encryption key;
receiving, from a client device, a tokenization request that includes a user object;
determining, by the application server, that the user object or a hash of the user object has not previously been stored in a multi-level cache in the application server, wherein the multi-level cache is an in-memory database in the application server;
generating, based on the determining that the user object or the hash of the user object has not previously been stored in the multi-level cache, a token, wherein the token is not based on information in the user object and wherein the token is generated based on information stored in the multi-level cache and the encryption key;
encrypting, by the application server, the user object using the encryption key to generate an encrypted user object; and
storing the encrypted user object and the token in the multi-level cache.
2. The computer-implemented method of claim 1 , wherein the multi-level cache comprises a local cache and a key-value store and wherein the local cache and the key-value store are implemented using a main memory of the application server.
3. The computer-implemented method of claim 2 , wherein the key-value store is implemented as an in-memory non-relational key-value store.
4. The computer-implemented method of claim 2 , wherein the local cache is implemented as a non-persistent data store and the key-value store is implemented as a persistent data store.
5. The computer-implemented method of claim 1 , further comprising:
asynchronously replicating, from the key-value store to a second key-value store, the token and the encrypted user object, wherein the second key-value store is located remotely from the application server.
6. The computer-implemented method of claim 1 , wherein the user object is associated with a financial account.
7. The computer-implemented method of claim 1 , wherein the token is generated based on a hash-based message authentication code.
8. The computer-implemented method of claim 1 , further comprising:
transmitting the token to the client device.
9. The computer-implemented method of claim 1 , wherein the application server is associated with a credit card issuer.
10. The computer-implemented method of claim 9 , wherein the tokenization request includes authentication information for an account associated with the credit card issuer, the method further comprising:
verifying, based on the authentication information, an identity of a user associated with the account.
11. The computer-implemented method of claim 1 , wherein the token comprises a randomly generated value.
12. An apparatus for performing scalable in-memory tokenization, comprising:
a memory comprising a multi-level cache; and
a processor communicatively coupled to the memory and configured to:
transmit, to a hardware security module, a request for an encryption key;
receive, in response to the request and from the hardware security module, the encryption key, wherein the hardware security module is remote from the apparatus;
store the encryption key in the multi-level cache;
receive, from a client device, a tokenization request that includes a user object;
determine that the user object or a hash of the user object has not previously been stored in the multi-level cache, wherein the multi-level cache is an in-memory database;
generate, based on the determining, a token, wherein the token is not based on information in the user object and wherein the token is generated based on information stored in the multi-level cache and the encryption key;
encrypt the user object using the encryption key from the multi-level cache to generate an encrypted user object; and
store the encrypted user object and the token in the multi-level cache.
13. The apparatus of claim 12 , the processor further configured to:
asynchronously replicate, from a key-value store to a second key-value store, the token and the encrypted user object, wherein the second key-value store is located remotely from the apparatus.
14. The apparatus of claim 13 , wherein the key-value store is implemented as an in-memory non-relational key-value store.
15. The apparatus of claim 13 , wherein a local cache is implemented as a non-persistent data store and the key-value store is implemented as a persistent data store.
16. The apparatus of claim 12 , the processor further configured to:
transmit the token to the client device.
17. The apparatus of claim 12 , wherein an application server is associated with a credit card issuer.
18. The apparatus of claim 17 , wherein the tokenization request includes authentication information for an account associated with the credit card issuer, the processor further configured to:
verify, based on the authentication information, an identity of a user associated with the account.
19. A non-transitory computer-readable medium storing instructions, the instructions, when executed by a processor, cause the processor to perform operations comprising:
transmitting, to a hardware security module, a request for an encryption key;
receiving, from the hardware security module, the encryption key;
receiving, from a client device, a tokenization request that includes a user object;
validating the user object by:
determining whether the user object or a hash of the user object matches a first plurality of user objects stored in a local cache of a multi-level cache or a second plurality of user objects stored in a key-value store of the multi-level cache, wherein the multi-level cache is an in-memory database of an application server; and
responsive to the determining:
receiving, from the multi-level cache, a cached token associated with the user object wherein the cached token does not use information in the user object as an input value and wherein the cached token is generated based on information stored in the multi-level cache and the encryption key; and
transmitting the cached token to the client device.
20. The non-transitory computer-readable medium of claim 19 , wherein the multi-level cache comprises a local cache and a key-value store,
wherein the cached token is generated based on hashing a token to generate a hashed token, and wherein the hashed token is stored as the cached token in the local cache and the key-value store of the multi-level cache and the encryption key is stored in the local cache and the key-value store of the multi-level cache.