Method and system for time window encryption tokenization of data

Patent metadata

Field	Value
Publication number	US-10747889-B2
Application number	US-201816051390-A
Country	US
Kind code	B2
Filing date	Jul 31, 2018
Priority date	May 3, 2018
Publication date	Aug 18, 2020
Grant date	Aug 18, 2020

Abstract

A first raw value of a first field from the first set of fields is encrypted to generate a first token using a symmetric key encryption mechanism based on a first cryptographic key associated with a first time window after which the first cryptographic key is no longer valid for tokenization of raw fields of raw log records. After the first time window has elapsed, a second raw value of a second field from the second set of fields is encrypted to generate a second token using the symmetric key encryption mechanism based on a second cryptographic key that is different from the first cryptographic key. The second cryptographic key is associated with a third time window that occurs after the first time window and after which the second cryptographic key is no longer valid for tokenization of raw fields of raw log records.

First claim

What is claimed is:

1. A method of using one or more processors to enable temporary detokenization of tokenized data in a computer system that handles log records resulting from operations of one or more applications, the method comprising:
receiving, at the one or more processors, a first raw log record including a first set of one or more fields storing first raw data related to a first event that occurred in a first application;
encrypting, by the one or more processors, a first raw value of a first field from the first set of fields to generate a first token using a symmetric key encryption mechanism based on a first cryptographic key associated with a first time window after which the first cryptographic key is no longer valid for tokenization of raw fields of raw log records and with a second time window after which the first cryptographic key is no longer valid for detokenization of tokens;
outputting, by the one or more processors, a first tokenized log record generated based on the first raw log record and the first token to be used by one or more log record consumers;
receiving, by the one or more processors, after the first time window has elapsed, a second raw log record including a second set of one or more fields storing second raw data related to a second event that occurred in a second application;
encrypting, by the one or more processors, a second raw value of a second field from the second set of fields to generate a second token using the symmetric key encryption mechanism based on a second cryptographic key that is different from the first cryptographic key, wherein the second cryptographic key is associated with a third time window that occurs after the first time window and after which the second cryptographic key is no longer valid for tokenization of raw fields of raw log records and with a fourth time window after which the second cryptographic key is no longer valid for detokenization of tokens; and
outputting, by the one or more processors, a second tokenized log record generated based on the second raw log record and the second token to be used by one or more log record consumers.

2. The method of claim 1 , wherein the first cryptographic key is no longer valid for detokenization of tokens when one of the following events occurs: the first cryptographic keys expires and the first cryptographic key is deleted.

3. The method of claim 1 , further comprising:
receiving a request to detokenize the first token to retrieve the first raw value;
determining based on a first time indicator associated with the first tokenized log record that the first raw value was tokenized during the first time window; and
responsive to determining that the second time window has elapsed, determining that the first cryptographic key is no longer valid resulting in denial of the request to detokenize the first token.

4. The method of claim 3 , wherein the first time indicator indicates at least one of a time and date at which the first raw log record was recorded in the system, a time and date at which the first event occurred in the first application, and/or a time and date at which the first tokenized log record was generated.

5. The method of claim 1 , further comprising:
receiving a request to detokenize the second token to retrieve the second raw value;
determining based on a second time indicator associated with the second tokenized log record that the second raw value was tokenized during the third time window; and
responsive to determining that the fourth time window has not yet elapsed, decrypting the second token based on the second cryptographic key to retrieve the second raw value.

6. The method of claim 5 , wherein the second time indicator indicates at least one of a time and date at which the second raw log record was recorded in the system, a time and date at which the second event occurred in the first application, and/or a time and date at which the second tokenized log record was generated.

7. The method of claim 1 , wherein the second time window and the fourth time window are respectively shorter than a period of time within which personal data is to be forgotten responsive to a request from a user.

8. The method of claim 1 , wherein the first time window and the second time window are different.

9. A non-transitory machine readable medium that stores instructions that, when executed by one or more processors of electronic devices, cause the electronic devices to enabling temporary detokenization of tokenized data in a system that handles log records resulting from operations of one or more applications, by performing the following operations:
receiving a first raw log record including a first set of one or more fields storing first raw data related to a first event that occurred in a first application;
encrypting a first raw value of a first field from the first set of fields to generate a first token using a symmetric key encryption mechanism based on a first cryptographic key associated with a first time window after which the first cryptographic key is no longer valid for tokenization of raw fields of raw log records and with a second time window after which the first cryptographic key is no longer valid for detokenization of tokens;
outputting a first tokenized log record generated based on the first raw log record and the first token to be used by one or more log record consumers;
receiving, after the first time window has elapsed, a second raw log record including a second set of one or more fields storing second raw data related to a second event that occurred in a second application;
encrypting a second raw value of a second field from the second set of fields to generate a second token using the symmetric key encryption mechanism based on a second cryptographic key that is different from the first cryptographic key, wherein the second cryptographic key is associated with a third time window that occurs after the first time window and after which the second cryptographic key is no longer valid for tokenization of raw fields of raw log records and with a fourth time window after which the second cryptographic key is no longer valid for detokenization of tokens; and
outputting a second tokenized log record generated based on the second raw log record and the second token to be used by one or more log record consumers.

10. The non-transitory machine readable medium of claim 9 , wherein the first cryptographic key is no longer valid for detokenization of tokens when one of the following events occurs: the first cryptographic keys expires and the first cryptographic key is deleted.

11. The non-transitory machine readable medium of claim 9 , wherein the operations further comprise:
receiving a request to detokenize the first token to retrieve the first raw value;
determining based on a first time indicator associated with the first tokenized log record that the first raw value was tokenized during the first time window; and
responsive to determining that the second time window has elapsed, determining that the first cryptographic key is no longer valid resulting in denial of the request to detokenize the first token.

12. The non-transitory machine readable medium of claim 11 , wherein the first time indicator indicates at least one of a time and date at which the first raw log record was recorded in the system, a time and date at which the first event occurred in the first application, and/or a time and date at which the first tokenized log record was generated.

13. The non-transitory machine readable medium of claim 9 , wherein the operations further comprise:
receiving a request to detokenize the second token to r

Assignees

• Salesforcecom Inc

Inventors

• Eidson William C
• Boilen Michael Goldberg
• Hacker David

Classifications

• H04L67/53

  using third party service providers · CPC title

• H04L67/535

  Tracking the activity of the user (network monitoring arrangements H04L43/00; recording of computer activity G06F11/34) · CPC title

• H04L2209/42

  Anonymization, e.g. involving pseudonyms · CPC title

• H04L9/088

  Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms (network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068) · CPC title

• G06F2201/865

  Monitoring of software · CPC title