Method for securing sensitive data
A transaction system avoids the storage of any single information item that can be used to provide access to sensitive information. To gain access to the sensitive information, information elements from at least two different databases must be provided, none of the information elements being sufficient to gain access to the sensitive information. In an example embodiment, a payment company encrypts the sensitive information, then partitions the encrypted information into at least two parts. These at least two parts are stored in at least two databases, each database being controlled by a different entity. To gain access to the sensitive information, each of the different entities must provide their part of the encrypted information. Absent any one of the parts of the encrypted information, it is virtually impossible to access the sensitive information.
1 . A method for reproducing partitioned datasets, the method comprising:
partitioning an encrypted dataset at a first party system into a first encrypted part and a second encrypted part, each of the encrypted parts associated with a same unique token;
storing the first encrypted part at a first party system database;
providing the second encrypted part from the first party system to the second party system, wherein the second party system:
partitions the second encrypted part into first encrypted piece and second encrypted piece,
stores the first encrypted piece in association with a client identifier (ID) and the token at a second party system database,
executes code at a client device to trigger storage of the second encrypted piece at an application installed on the client device, and
receives a request to use the encrypted dataset in an online transaction between the client device and the second party system, the request including the unique token and the second encrypted piece provided by the client device;
receiving a combination of the first encrypted piece stored at the second party system and the second encrypted piece received from the client device, the combination sent from the second party system to the first party system;
retrieving, by the first party system, the first encrypted part associated with the unique token from the first party system database;
combining, by the first party system, the combined encrypted pieces received from the second party system and the first encrypted part retrieved from the first party system database into a reproduced encrypted dataset based on shared association with the unique token;
decrypting, by the first party system, the reproduced encrypted dataset to retrieve client's credit card information;
sending, by the first party system to a credit card operator, transaction information including the client's credit card information; and
receiving, by the first party system from the credit card operator, authorization for the online transaction in response to the request based on decryption of the reproduced encrypted dataset.
2 . The method of claim 1 , wherein the installed application is in wireless communication with the second party system.
3 . The method of claim 1 , wherein the installed application is an extension on a browser on the client device.
4 . The method of claim 1 , wherein the installed application is executable to automatically send the second encrypted piece from the client device when contact is re-initiated with the second party system.
5 . The method of claim 1 , wherein the second party system retrieves the token based on the client ID associated with the client device.
6 . A system for reproducing partitioned datasets, the system comprising:
a first party system comprising:
a first party system processor; and a first party system memory storing first party system instructions that when executed by the first party system processor perform operations comprising:
partitioning an encrypted dataset into a first encrypted part and a second encrypted part, each of the encrypted parts associated with a same unique token;
storing the first encrypted part at a first party system database;
providing the second encrypted part to the second party system;
retrieving the first encrypted part associated with the unique token from the first party system database;
combining a combined encrypted pieces received from a second party system and the first encrypted part retrieved from the first party system database into a reproduced encrypted dataset based on shared association with the unique token;
decrypting the reproduced encrypted dataset to retrieve client's credit card information;
sending, to a credit card operator, transaction information including the client's credit card information;
receiving, from the credit card operator, authorization for an online transaction in response to a request based on decryption of the reproduced encrypted dataset; and
the system additionally including the second party system comprising:
a second party system processor; and a second party system memory storing second party system instructions that when executed by the second party system processor performs operations comprising:
partitioning the received second encrypted part into a first encrypted piece and a second encrypted piece;
storing the first encrypted piece in association with a client identifier (ID) and the token at a second party system database;
executing code at a client device to trigger storage of the second encrypted piece at an application installed on the client device;
receiving the request to use the encrypted dataset in an online transaction between the client device and the second party system, the request including the unique token and the second encrypted piece provided by the client device; and
sending, to the first party system, the combination of the first encrypted piece stored at the second party system and the second encrypted piece received from the client device.
7 . The system of claim 6 , wherein the installed application is in wireless communication with the second party system.
8 . The system of claim 7 , wherein the installed application is an extension on a browser on the client device.
9 . The system of claim 7 , wherein the installed application is executable to automatically send the second encrypted piece from the client device when contact is re-initiated with the second party system.
10 . The system of claim 6 , wherein the second party system retrieves the token based on the client ID associated with the client device.
11 . A system comprising a first party non-transitory, computer-readable storage medium, having embodied thereon a first party program executable by a first party processor to perform a method for reproducing partitioned datasets, the method comprising:
partitioning an encrypted dataset into a first encrypted part and a second encrypted part, each of the encrypted parts associated with a same unique token;
storing the first encrypted part at a first party system database;
providing the second encrypted part to a second party system;
retrieving the first encrypted parts associated with the unique token from the first party system database;
combining a combined encrypted pieces received from the second party system and the first encrypted part retrieved from the first party system database into a reproduced encrypted dataset based on shared association with the unique token;
decrypting the reproduced encrypted dataset to retrieve client's credit card information;
sending, to a credit card operator, transaction information including the client's credit card information;
receiving, from the credit card operator, authorization for an online transaction in response to a request based on decryption of the reproduced encrypted dataset; and
the system further including a second party non-transitory computer-readable storage medium comprising second party instructions, that when read by a second party processor cause the second party processor to perform operations comprising:
partitioning the received second encrypted part into a first encrypted piece and a second encrypted piece;
storing the first encrypted piece in association with a client identifier (ID) and the token at a second party system database;
executing code at a client device to trigger storage of the second encrypted piece at an application installed on the client device;
receiving the request to use the encrypted dataset in the online transaction between the client device and the second party system, the request including the unique token and the second encrypted piece provided by the client device; and
sending, to the first party system, the combination of the first encrypted piece stored at the second party system and the second encrypted piece received from the client device.