System and methods for point to point encryption and tokenization in a hosted environment

Patent metadata

Field	Value
Publication number	US-11115397-B2
Application number	US-201715710300-A
Country	US
Kind code	B2
Filing date	Sep 20, 2017
Priority date	Sep 21, 2016
Publication date	Sep 7, 2021
Grant date	Sep 7, 2021

Abstract

Mechanisms for providing point to point encryption and tokenization enabling decryption, tokenization and storage of sensitive encrypted data on one system are discussed.

First claim

We claim:

1. A point to point encryption and tokenization system for a hosted machine payment card industry (PCI) environment implementing a data security standard, the system comprising:
an internal computing system equipped with one or more hardware processors and operatively coupled to a database in the hosted machine PCI environment, the internal computing system configured to receive encrypted card holder data (CHD) from an external computing system outside the hosted machine PCI environment, the internal computing system including a plurality of processing zones, each processing zone holding at least one of a plurality of processing modules, the plurality of processing modules including:
a decryption module executable using the one or more hardware processors to decrypt the CHD, a tokenization module executable using the one or more hardware processors to generate a token representing the CHD and store the token and the decrypted CHD in the database in the hosted machine PCI environment, the token used to retrieve the stored decrypted CHD in a subsequent request, and
an authorization module executable using the one or more hardware processors to process the decrypted CHD in response to a request from the external computing system and transmit a confirmation of the processing of the CHD and the token representing the CHD to the external computing system in place of the decrypted CHD, at least two of the decryption module, tokenization module and authorization module being located in separate processing zones of the plurality of processing zones; and
a communication interface configured to enable communication with the external computing system wherein the internal computing system in the hosted machine PCI environment is further configured to:
receive a second request from the external computing system to process the CHD, the second request accompanied by the token representing the CHD;
retrieve, with the tokenization module, the decrypted CHD from the database using the token;
process the decrypted CHD using an authentication module based on the second request; and
transmit a confirmation of the processing of the CHD based on the second request and the token representing the CHD to the external computing system.

2. The system of claim 1 wherein a processing zone includes more than one processing module.

3. The system of claim 1 wherein the authorization module processes the decrypted CHD using an external authorization service located outside the hosted machine PCI environment.

4. The system of claim 1 wherein the processing modules further includes:
a web services module implemented as middleware in the internal computing system in the hosted machine PCI environment, the web services module using a representational state transfer (REST) architecture.

5. The system of claim 1 , wherein the decryption module is a Hardware Security Module (HSM).

6. The system of claim 1 , wherein the hosted machine PCI environment and the external computing system are located in different geographic locations.

7. The system of claim 1 , wherein the CHD is encrypted using asymmetric encryption.

8. The system of claim 1 , wherein the plurality of processing modules further include:
a key management module configured to issue public keys and store security certificates.

9. The system of claim 1 wherein the token is an alphanumeric string.

10. A point to point encryption and tokenization method in a hosted machine payment card industry (PCI) environment implementing a data security standard, the method, comprising:
receiving from an external computing system outside the hosted machine PCI environment, encrypted card holder data (CHD) with an internal computing system operatively coupled to a database in the hosted machine PCI environment, the internal computing system including a plurality of processing zones, each processing zone holding at least one of a plurality of processing modules, the plurality of processing modules including a decryption module, a tokenization module and an authorization module, at least two of the decryption module, tokenization module and authorization module being located in separate processing zones of the plurality of processing zones;
decrypting the encrypted CHD with the decryption module;
generating a token representing the decrypted CHD with the tokenization module;
processing the decrypted CHD with the authorization module;
transmitting, a confirmation of the processing of the CHD and a copy of the token to the external computing system;
storing the token representing the decrypted CHD and the decrypted CHD in the database, the token used to retrieve the stored decrypted CHD in a subsequent request;

receiving at the internal computing system in the hosted machine PCI environment a second request from the external computing system to process the CHD, the second request accompanied by the token representing the CHD;
retrieving with the tokenization module, the decrypted CHD from the database using the token;
processing the decrypted CHD using an authentication module based on the second request; and
transmitting a confirmation of the processing of the CHD based on the second request and the token representing the CHD to the external computing system.

11. The method of claim 10 wherein a processing zone includes more than one processing module.

12. The method of claim 10 wherein the authorization module processes the decrypted CHD using an external authorization service located outside the hosted machine PCI environment.

13. The method of claim 10 wherein the processing modules further includes a web services module implemented as middleware in the internal computing system in the hosted machine PCI environment, the web services module using a representational state transfer (REST) architecture.

14. The method of claim 10 , wherein the decryption module is a Hardware Security Module (HSM).

15. The method of claim 10 , wherein the hosted machine PCI environment and the external computing system are located in different geographic locations.

16. The method of claim 10 , further comprising:
issuing public keys and store security certificates via a key management system.

17. A non-transitory computer readable memory medium storing instructions, wherein the instructions are executable by a hardware processor to:
receive from an external computing system outside the hosted machine PCI environment, encrypted card holder data (CHD) with an internal computing system operatively coupled to a database in the hosted machine PCI environment, the internal computing system including a plurality of processing zones, each processing zone holding at least one of a plurality of processing modules, the plurality of processing modules including a decryption module, a tokenization module and an authorization module, at least two of the decryption module, tokenization module and authorization module being located in separate processing zones of the plurality of processing zones;
decrypt the encrypted CHD with the decryption module;
generate a token representing the decrypted CHD with the tokenization module;
process the decrypted CHD with the authorization module;
transmit, a confirmation of the processing of the CHD and a copy of the token to the external computing system;
store the token representing the decrypted CHD and the decrypted CHD in the database, the token used to retrieve the stored decrypted CHD in a subsequent request;

receive at the internal computing system in the hosted machine PCI environment a second request from

Assignees

• Walmart Apollo Llc

Inventors

• Johnson Aaron Marcus
• Gerber Christopher John
• Corson Iii Gerald Duane
• Watts Charles Alan

Classifications

• G06Q20/409 Primary

  Device specific authentication in transaction processing · CPC title

• H04L63/0428

  wherein the data content is protected, e.g. by encrypting or encapsulating the payload · CPC title

• G06Q20/027

  involving a payment switch or gateway · CPC title

• H04L63/10

  for controlling access to devices or network resources · CPC title

• G06Q20/3823

  combining multiple encryption tools for a transaction · CPC title