Back to results
US 11,775,968 B2Granted
Method and system for secure key rotation
AssigneeLightspeed Commerce USA, Inc.
InventorsYasser Abou-Nasr, Michael Boland
Life of this patent
Estimating the term…
Abstract
This invention discloses a novel system for securing and using payment token data in a system for processing electronic payment transactions that does not require down-time for rekeying encryption keys when the keys are rotated.
Claims8
A computer system for executing an electronic payment transaction while conducting a key rotation and re-keying comprising:
- a transaction server comprised of:
- a card vault component, comprised of a payment token in encrypted form and a corresponding token encryption key identifier;
- a data structure comprised of a first data encryption key stored in encrypted form and a second data encryption key stored in encrypted form and a corresponding first key identifier and second key identifier;
- a data memory comprised of program code that when executed causes the transaction server to:
- decrypt the first and second data encryption keys;
- store the decrypted first and second data encryption keys only in a local data memory of the transaction server that is executing the electronic payment transactions;
- determine the condition that either the first data encryption key or the second data encryption key identifiers match the token encryption key identifier;
- determine which of the members of a set of the first data encryption key and the second data encryption key is one generation older than the other data encryption key in the set;
- decrypt the payment token using the determined data encryption key;
- and
- process the electronic payment transaction using the decrypted payment token.
8 more elements
A method of conducting an electronic payment transaction by a transaction server while conducting a key rotation and re-keying comprising:
- storing in a card vault component, a payment token in encrypted form and a corresponding token encryption key identifier;
- generating a data structure comprised of a first data encryption key stored in encrypted form and a second data encryption key stored in encrypted form and a corresponding first key identifier and second key identifier;
- decrypting the first and second data encryption keys;
- storing the decrypted first and second data encryption keys only in a local data memory of the transaction server that is executing the electronic payment transactions;
- determining the condition that at least one of the first and second data encryption key identifiers match the token encryption key identifier;
- determining which of the members of a set of the first data encryption key and the second data encryption key is at least one generation older than the other data encryption key in the set;
- decrypting the payment token using the determined encryption key;
- and
- processing the transaction using the decrypted payment token.
6 more elements
Dependencies are inferred from the claim text.