Back to results
US 10,541,982 B1Granted
Techniques for protecting electronic data
AssigneeJPMorgan Chase Bank, N.A.
InventorsFelix C. P. Lee, Jacky C. T. Chan, Lydia L. C. Wong
Life of this patent
Estimating the term…
Abstract
Embodiments of the present invention provides a data protection solution which can efficiently tokenize sensitive data submitted by a user device to a public cloud and de-tokenize any tokenized response from the cloud. A small, in-memory token map may be looked up to facilitate the two-way conversions between sensitive data and tokenized data. The token map can be flexibly configured, it may be generated and/or changed on the fly, and its design could preserve data format and provide multilingual support. The innovative tokenization process is fast, secure, scalable through cloud-native design but less costly as compared to prior approaches.
Claims20
A computer-implemented method for protecting sensitive data, the method comprising:
- receiving, via a first communication interface, a first input stream of electronic data from a client device, said first input stream of electronic data having a first predetermined sequence and being destined for a server;
- tokenizing said first input stream of electronic data by:
- splitting said first input stream of electronic data into multiple categories including at least alphanumerical characters, non-English characters, and symbols,
- first substituting each character in the alphanumerical characters category with an alphanumerical character selected based on a first token map, thereby generating at least one protected alphanumerical character set,
- second substituting each character in the non-English characters category with a non-English character selected based on a second token map different from the first token map, thereby generating at least one protected non-English character set, and
- re-assembling a first output stream of tokenized electronic data based at least in part on said at least one protected alphanumerical character set and said at least one protected non-English character set while preserving said first predetermined sequence;
- and
- transmitting, via a second communication interface, said first output stream of tokenized electronic data to said server,
- wherein first token maps are dynamically and randomly generated for the each character of the alphanumerical characters category included in the first input stream of electronic data such that a same first token map is not utilized in a subsequent tokenization of an alphanumerical character, and
- wherein second token maps are dynamically and randomly generated for the each character of the non-English characters category included in the first input stream of electronic data such that a same second token map is not utilized in a subsequent tokenization of a non-English character.
7 more elements
A computer-implemented system for protecting sensitive data, the system comprising:
- a gateway device interposed between a client device and a server, the gateway device having a first communication interface with said client device and a second communication interface with said server;
- a tokenization device having at least one computer processor coupled to said gateway device and a storage medium, the tokenization device being configured to:
- receive, via said first communication interface, a first input stream of electronic data from said client device, said first input stream of electronic data having a first predetermined sequence and being destined for said server;
- tokenize said first input stream of electronic data by:
- splitting said first input stream of electronic data into multiple categories including at least alphanumerical characters, non-English characters, and symbols,
- first substituting each character in the alphanumerical characters category with an alphanumerical character selected based on a first token map, thereby generating at least one protected alphanumerical character set,
- second substituting each character in the non-English characters category with a non-English character selected based on a second token map different from the first token map, thereby generating at least one protected non-English character set, and
- re-assembling a first output stream of tokenized electronic data based at least in part on said at least one protected alphanumerical character set and said at least one protected non-English character set while preserving said first predetermined sequence;
- and
- transmit, via said second communication interface, said first output stream of tokenized electronic data to said server,
- wherein first token maps are dynamically and randomly generated for the each character of the alphanumerical characters category included in the first input stream of electronic data such that a same first token map is not utilized in a subsequent tokenization of an alphanumerical character, and
- wherein second token maps are dynamically and randomly generated for the each character of the non-English characters category included in the first input stream of electronic data such that a same second token map is not utilized in a subsequent tokenization of a non-English character.
9 more elements
A non-transitory computer-readable medium having code for protecting sensitive data, the computer-readable medium comprising processor instructions configured to cause a processor to perform:
- receiving, via a first communication interface, a first input stream of electronic data from a client device, said first input stream of electronic data having a first predetermined sequence and being destined for a server;
- tokenizing said first input stream of electronic data by:
- splitting said first input stream of electronic data into character queues corresponding to multiple categories including at least alphanumerical characters, non-English characters, and symbols,
- first substituting each character in the alphanumerical characters queue with an alphanumerical character selected based on a first token map, thereby generating at least one protected alphanumerical character queue,
- second substituting each character in the non-English characters queue with a non-English character selected based on a second token map different from the first token map, thereby generating at least one protected non-English character queue, and
- re-assembling a first output stream of tokenized electronic data based at least in part on said at least one protected alphanumerical character queue and said at least one protected non-English character queue while preserving said first predetermined sequence;
- and
- transmitting, via a second communication interface, said first output stream of tokenized electronic data to said server,
- wherein first token maps are dynamically and randomly generated for the each character of the alphanumerical characters category included in the first input stream of electronic data such that a same first token map is not utilized in a subsequent tokenization of an alphanumerical character, and
- wherein second token maps are dynamically and randomly generated for the each character of the non-English characters category included in the first input stream of electronic data such that a same second token map is not utilized in a subsequent tokenization of a non-English character.
7 more elements
Dependencies are inferred from the claim text.