Systems and methods for securing data

An apparatus for securing customer data comprising:

• one or more processors of a security server;
• and
• a non-transitory computer readable medium storing a plurality of instructions, which when executed, cause the one or more processors to:
• store an encrypted second key fragment in a second storage area, an encrypted first key fragment being stored in a first storage area distinct from the second storage area, further wherein access to the first storage area and to the second storage area is mutually exclusive and the first key fragment is unique to a customer having access to the encrypted first key fragment;
• receive a request from an application server in communication with the customer, to derive a new master key, the request being received after the storing the encrypted second key fragment;
• receive the encrypted first key fragment from the application server;
• retrieve the encrypted second key fragment from the second storage area;
• decrypt the encrypted first key fragment and the encrypted second key fragment using at least a hardware security module (HSM) to generate a decrypted first key fragment and a decrypted second key fragment;
• derive the new master key using the decrypted first key fragment and the decrypted second key fragment, the deriving comprising modifying the decrypted first key fragment and subsequently combining the modified decrypted first key fragment and the decrypted second key fragment, the new master key being unique to the customer;
• and
• transmit the derived new master key to the requesting application server, the new master key being stored in an in-memory cache of the application server enabling the application server to encrypt customer data stored on the application server.

A non-transitory computer-readable medium having computer-readable program code embodied therein to be executed by one or more processors of a security server, the program code including instructions to:

• store an encrypted second key fragment in a second storage area, an encrypted first key fragment being stored in a first storage area distinct from the second storage area, further wherein access to the first storage area and to the second storage area is mutually exclusive and the first key fragment is unique to a customer having access to the encrypted first key fragment;
• receive a request from an application server in communication with the customer, to derive a new master key, the request being received after the storing the encrypted second key fragment;
• receive the encrypted first key fragment from the application server;
• retrieve the encrypted second key fragment from the second storage area;
• decrypt the encrypted first key fragment and the encrypted second key fragment using at least a hardware security module (HSM) to generate a decrypted first key fragment and a decrypted second key fragment;
• derive the new master key using the decrypted first key fragment and the decrypted second key fragment, the deriving comprising modifying the decrypted first key fragment and subsequently combining the modified first key decrypted fragment and the decrypted second key fragment, the new master key being unique to the customer;
• and
• transmit the derived new master key to the requesting application server, the new master key being stored in an in-memory cache of the application server enabling the application server to encrypt customer data stored on the application server.