Key rotation for sensitive data tokenization

A method for rotating keys used to tokenize data being stored in a data store of a data layer, the method comprising:

• within the data layer providing data services to external client applications:
• during a limited time period [T]:
• receiving a first plurality of arriving data values from one or more of the external client applications;
• for each of the first plurality of arriving data values, performing a write operation to the data store during the limited time period [T];
• the write operation comprising, for a particular arriving data value:
• (i) tokenizing the particular arriving data value using each of a first and a second key, thereby creating for the particular arriving data value a version tokenized with the first key, and a version tokenized with the second key;
• and,
• (ii) instead of writing the particular arriving data value to the data store, writing both the version of the particular arriving data value tokenized with the first key and the version of the particular arriving data value tokenized with the second key;
• upon expiry of the limited time period [T], rotating keys said rotation comprising discarding the first key, continuing use of the second key, and obtaining a third key;
• and,
• after said rotation of keys:
• receiving a second plurality of arriving data values to be written to the data store;
• for each of the second plurality of arriving data values, performing the write operation, but wherein the write operation uses the second and the third keys, thereby creating for each arriving data value a version tokenized with the second key, and a version tokenized with the third key, and thereby
• writing both the version tokenized with the second key and the version tokenized with the third key;
• wherein the first, second, and third keys are all different from one another.

A system, comprising circuitry forming one or more processors and memory holding computer program instructions for execution on the one or more processors to form a data layer that has a data store and that tokenizes arriving data values and recovers the arriving data values from tokenized versions thereof for external client applications, thus providing data services thereto, the instructions comprising:

• instructions for:
• within a data layer providing data services to external client applications:
• receiving a first plurality of arriving data values during a limited time period [T] from one or more of the external client applications;
• for each of the first plurality of arriving data values, performing a write operation to the data store during the limited time period [T];
• the write operation comprising, for a particular arriving data value:
• (i) creating two tokenized versions of the particular arriving data value, one tokenized version created from the particular arriving data value using a current key and another tokenized version created from the particular arriving data value using a previous key, the current and previous keys being different;
• and,
• (ii) storing both of the tokenized versions of each arriving data value in the data store, rather than the arriving data value;
• rotating keys after the limited time period [T], wherein said key rotation comprises:
• discarding the previous key, retaining the current key, and obtaining a new key, the new key being different from the previous and current keys;
• and,
• after the key rotation, performing the write operation for each of a second plurality of arriving data values but wherein the write operation uses the current key and the new key rather than the current key and the previous key.

A system, comprising circuitry forming one or more processors and memory holding computer program instructions for execution on the one or more processors to form a data layer that has a data store and that tokenizes arriving data values and recovers the arriving data values from tokenized versions thereof for external client applications, thus providing data services thereto, the instructions comprising:

• instructions for:
• within the data layer providing data services to external client applications:
• during a limited time period [T]:
• receiving a first plurality of arriving data values from one or more of the external client applications;
• for each of the first plurality of arriving data values, performing a write operation to the data store during the limited time period [T];
• the write operation comprising, for a particular arriving data value:
• (i) tokenizing the particular arriving data value using each of a first and a second key, thereby creating for the particular arriving data value a version tokenized with the first key, and a version tokenized with the second key;
• and,
• (ii) instead of writing the particular arriving data value to the data store, writing both the version of the particular arriving data value tokenized with the first key and the version of the particular arriving data value tokenized with the second key;
• upon expiry of the limited time period [T], rotating keys, said rotation comprising discarding the first key, continuing use of the second key, and obtaining a third key;
• and,
• after said rotation of keys:
• receiving a second plurality of arriving data values to be written to the data store;
• for each of the second plurality of arriving data values, performing the write operation, but wherein the write operation uses the second and the third keys, thereby creating for each arriving data value a version tokenized with the second key, and a version tokenized with the third key and thereby
• writing both the version tokenized with the second key and the version tokenized with the third key;
• wherein the first, second, and third keys are all different from one another.