# US 11,115,397 B2 · System and methods for point to point encryption and tokenization in a hosted environment

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,115,397 B2
- Document ID: US11115397B2
- Status: Granted
- Kind: B2
- Application number: 15/710,300
- Filed: 2017-09-20
- Published: 2018-03-22
- Granted: 2021-09-07
- Earliest claimed: 2016-09-21
- Assignees: Walmart Apollo, LLC
- Applicants: Walmart Apollo, LLC
- Inventors: Aaron Marcus Johnson; Christopher John Gerber; Gerald Duane Corson, III; Charles Alan Watts
- Web page: https://patentgrep.com/patent/US11115397B2

## CPC

- H04L 63/0485: {Networking architectures for enhanced packet encryption processing, e.g. offloading of IPsec packet processing or efficient security association look-up}
- G06Q 20/027: {involving a payment switch or gateway}
- G06Q 20/3823: {combining multiple encryption tools for a transaction}
- G06Q 20/385: {using an alias or single-use codes}
- G06Q 20/409: {Device specific authentication in transaction processing}
- H04L 9/0825: {using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates}
- H04L 9/0861: {Generation of secret information including derivation or calculation of cryptographic keys or passwords}
- H04L 9/3263: {involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823)}
- H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload}
- H04L 63/0442: {wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30)}
- H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)}
- H04L 63/10: {for controlling access to devices or network resources}
- G06Q 2220/00: Business processing using cryptography
- H04L 2209/56: Financial cryptography, e.g. electronic payment or e-cash
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR

## Abstract

Mechanisms for providing point to point encryption and tokenization enabling decryption, tokenization and storage of sensitive encrypted data on one system are discussed.

## Claims

### Claim 1

A point to point encryption and tokenization system for a hosted machine payment card industry (PCI) environment implementing a data security standard, the system comprising:
an internal computing system equipped with one or more hardware processors and operatively coupled to a database in the hosted machine PCI environment, the internal computing system configured to receive encrypted card holder data (CHD) from an external computing system outside the hosted machine PCI environment, the internal computing system including a plurality of processing zones, each processing zone holding at least one of a plurality of processing modules, the plurality of processing modules including:
a decryption module executable using the one or more hardware processors to decrypt the CHD, a tokenization module executable using the one or more hardware processors to generate a token representing the CHD and store the token and the decrypted CHD in the database in the hosted machine PCI environment, the token used to retrieve the stored decrypted CHD in a subsequent request, and
an authorization module executable using the one or more hardware processors to process the decrypted CHD in response to a request from the external computing system and transmit a confirmation of the processing of the CHD and the token representing the CHD to the external computing system in place of the decrypted CHD, at least two of the decryption module, tokenization module and authorization module being located in separate processing zones of the plurality of processing zones; and
a communication interface configured to enable communication with the external computing system wherein the internal computing system in the hosted machine PCI environment is further configured to:
receive a second request from the external computing system to process the CHD, the second request accompanied by the token representing the CHD;
retrieve, with the tokenization module, the decrypted CHD from the database using the token;
process the decrypted CHD using an authentication module based on the second request; and
transmit a confirmation of the processing of the CHD based on the second request and the token representing the CHD to the external computing system.

### Claim 2 (depends on 1)

The system of claim 1 wherein a processing zone includes more than one processing module.

### Claim 3 (depends on 1)

The system of claim 1 wherein the authorization module processes the decrypted CHD using an external authorization service located outside the hosted machine PCI environment.

### Claim 4 (depends on 1)

The system of claim 1 wherein the processing modules further includes:
a web services module implemented as middleware in the internal computing system in the hosted machine PCI environment, the web services module using a representational state transfer (REST) architecture.

### Claim 5 (depends on 1)

The system of claim 1, wherein the decryption module is a Hardware Security Module (HSM).

### Claim 6 (depends on 1)

The system of claim 1, wherein the hosted machine PCI environment and the external computing system are located in different geographic locations.

### Claim 7 (depends on 1)

The system of claim 1, wherein the CHD is encrypted using asymmetric encryption.

### Claim 8 (depends on 1)

The system of claim 1, wherein the plurality of processing modules further include:
a key management module configured to issue public keys and store security certificates.

### Claim 9 (depends on 1)

The system of claim 1 wherein the token is an alphanumeric string.

### Claim 10

A point to point encryption and tokenization method in a hosted machine payment card industry (PCI) environment implementing a data security standard, the method, comprising:
receiving from an external computing system outside the hosted machine PCI environment, encrypted card holder data (CHD) with an internal computing system operatively coupled to a database in the hosted machine PCI environment, the internal computing system including a plurality of processing zones, each processing zone holding at least one of a plurality of processing modules, the plurality of processing modules including a decryption module, a tokenization module and an authorization module, at least two of the decryption module, tokenization module and authorization module being located in separate processing zones of the plurality of processing zones;
decrypting the encrypted CHD with the decryption module;
generating a token representing the decrypted CHD with the tokenization module;
processing the decrypted CHD with the authorization module;
transmitting, a confirmation of the processing of the CHD and a copy of the token to the external computing system;
storing the token representing the decrypted CHD and the decrypted CHD in the database, the token used to retrieve the stored decrypted CHD in a subsequent request;
receiving at the internal computing system in the hosted machine PCI environment a second request from the external computing system to process the CHD, the second request accompanied by the token representing the CHD;
retrieving with the tokenization module, the decrypted CHD from the database using the token;
processing the decrypted CHD using an authentication module based on the second request; and
transmitting a confirmation of the processing of the CHD based on the second request and the token representing the CHD to the external computing system.

### Claim 11 (depends on 10)

The method of claim 10 wherein a processing zone includes more than one processing module.

### Claim 12 (depends on 10)

The method of claim 10 wherein the authorization module processes the decrypted CHD using an external authorization service located outside the hosted machine PCI environment.

### Claim 13 (depends on 10)

The method of claim 10 wherein the processing modules further includes a web services module implemented as middleware in the internal computing system in the hosted machine PCI environment, the web services module using a representational state transfer (REST) architecture.

### Claim 14 (depends on 10)

The method of claim 10, wherein the decryption module is a Hardware Security Module (HSM).

### Claim 15 (depends on 10)

The method of claim 10, wherein the hosted machine PCI environment and the external computing system are located in different geographic locations.

### Claim 16 (depends on 10)

The method of claim 10, further comprising:
issuing public keys and store security certificates via a key management system.

### Claim 17

A non-transitory computer readable memory medium storing instructions, wherein the instructions are executable by a hardware processor to:
receive from an external computing system outside the hosted machine PCI environment, encrypted card holder data (CHD) with an internal computing system operatively coupled to a database in the hosted machine PCI environment, the internal computing system including a plurality of processing zones, each processing zone holding at least one of a plurality of processing modules, the plurality of processing modules including a decryption module, a tokenization module and an authorization module, at least two of the decryption module, tokenization module and authorization module being located in separate processing zones of the plurality of processing zones;
decrypt the encrypted CHD with the decryption module;
generate a token representing the decrypted CHD with the tokenization module;
process the decrypted CHD with the authorization module;
transmit, a confirmation of the processing of the CHD and a copy of the token to the external computing system;
store the token representing the decrypted CHD and the decrypted CHD in the database, the token used to retrieve the stored decrypted CHD in a subsequent request;
receive at the internal computing system in the hosted machine PCI environment a second request from the external computing system to process the CHD, the second request accompanied by the token representing the CHD;
retrieve with the tokenization module, the decrypted CHD from the database using the token;
process the decrypted CHD using the an authentication module based on the second request; and
transmit a confirmation of the processing of the CHD based on the second request and the token representing the CHD to the external computing system.