# US 12,182,305 B2 · Batch tokenization service

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,182,305 B2
- Document ID: US12182305B2
- Status: Granted
- Kind: B2
- Application number: 18/536,393
- Filed: 2023-12-12
- Published: 2024-06-06
- Granted: 2024-12-31
- Earliest claimed: 2020-02-18
- Assignees: Capital One Services, LLC
- Applicants: Capital One Services, LLC
- Inventors: Naveen Teja Koduru; Kishore Doppalapudi; Ramesh Parvataneni
- Web page: https://patentgrep.com/patent/US12182305B2

## CPC

- G06F 21/6245: {Protecting personal data, e.g. for financial or medical purposes}
- G06F 16/211: {Schema design and management}
- G06F 16/903: Querying (for retrieval from the web G06F16/953)
- G06F 21/602: {Providing cryptographic facilities or services}
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

Methods and systems of data tokenization are described herein to provide protection for sensitive data. A tokenization service controller may extract sensitive data by determining a schema, the schema identifying which fields contain sensitive data. A token may be generated corresponding to each instance of the extracted sensitive data. The tokenization service controller may then generate a tokenized data set comprising a plurality of tokenized records arranged according to the same format as the original records, wherein the tokenized records use the generated tokens in place of the corresponding sensitive data.

## Claims

### Claim 1

A method comprising:
receiving, by a computing device, a data set;
determining a schema of the received data set;
identifying, based on a determination of the schema, one or more instances of sensitive data in the received data set;
extracting, based on identification of the one or more instances of sensitive data, the one or more instances of sensitive data from the received data set;
determining whether a first format of a first instance of sensitive data, of the one or more instances of sensitive data, matches a known format of sensitive data;
based on a determination that the first format of the first instance of sensitive data matches a known format of sensitive data, generating a first token corresponding to the first instance of sensitive data;
replacing the first instance of sensitive data in the received data set with the first token, wherein each of the one or more instances of sensitive data in the received data set corresponding to a known format of sensitive data is replaced by a corresponding token to generate a tokenized data set;
determining whether a second format of a second instance of sensitive data, of the one or more instances of sensitive data, matches a known format of sensitive data;
based on a determination that the second format of the second instance of sensitive data does not match a known format of sensitive data, storing, in the tokenized set of data, an original value of the second instance of sensitive data; and
storing, in a data store, the tokenized data set.

### Claim 2 (depends on 1)

The method of claim 1, further comprising receiving a configuration file associated with the received data set, wherein determining the schema of the received data set is based on the configuration file.

### Claim 3 (depends on 1)

The method of claim 1, wherein the determining the schema of the received data set further comprises querying a database to identify historic records with a same schema as the received data set.

### Claim 4 (depends on 1)

The method of claim 1, wherein:
the extracting the one or more instances of sensitive data from the received data set comprises compiling a queue of sensitive data values in an order that the one or more instances of sensitive data are identified in the received data set; and
replacing each of the one or more instances of sensitive data in the received data set corresponding to a known format of sensitive data with a corresponding token comprises replacing the one or more instances of sensitive data in the order that the one or more instances of sensitive data were identified.

### Claim 5 (depends on 1)

The method of claim 1, further comprises:
detecting a third instance of sensitive data in a non-sensitive field of the received data set;
determining whether a third format of the third instance of sensitive data matches a known format of sensitive data;
based on a determination that the third format of the third instance of sensitive data matches a known format of sensitive data, generating a third token corresponding to the third instance of sensitive data; and
replacing, in the tokenized data set, the third instance of sensitive data with the third token.

### Claim 6 (depends on 5)

The method of claim 5, wherein the detecting the third instance of sensitive data in the non-sensitive field of the received data set comprises comparing a value of the non-sensitive filed to one or more rules to determine whether the value corresponds to sensitive data.

### Claim 7 (depends on 1)

The method of claim 1, wherein the generating the first token corresponding to the first instance of sensitive data comprises:
sending, to a token generator, the first instance of sensitive data; and
receiving, from the token generator, the first token.

### Claim 8 (depends on 1)

The method of claim 1, wherein the received data set is encrypted, wherein the method further comprises:
decrypting the received data set; and
encrypting, prior to storing the tokenized data set, the tokenized data set.

### Claim 9

A computing device comprising:
one or more processors; and
memory storing instructions that, when executed by the one or more processors, cause the computing device to:
receive a data set;
determine a schema of the received data set;
identify, based on a determination of the schema, one or more instances of sensitive data in the received data set;
extract, based on identification of the one or more instances of sensitive data, the one or more instances of sensitive data from the received data set;
determine whether a first format of a first instance of sensitive data, of the one or more instances of sensitive data, matches a known format of sensitive data;
based on a determination that the first format of the first instance of sensitive data matches a known format of sensitive data, generate a first token corresponding to the first instance of sensitive data;
replace the first instance of sensitive data in the received data set with the first token, wherein each of the one or more instances of sensitive data in the received data set corresponding to a known format of sensitive data is replaced by a corresponding token to generate a tokenized data set;
determine whether a second format of a second instance of sensitive data, of the one or more instances of sensitive data, matches a known format of sensitive data;
based on a determination that the second format of the second instance of sensitive data does not match a known format of sensitive data, store, in the tokenized set of data, an original value of the second instance of sensitive data; and
store, in a data store, the tokenized data set.

### Claim 10 (depends on 9)

The computing device of claim 9, wherein the instructions, when executed by the one or more processors, cause the computing device to receive a configuration file associated with the received data set, wherein determining the schema of the received data set is based on the configuration file.

### Claim 11 (depends on 9)

The computing device of claim 9, wherein the instructions, when executed by the one or more processors, cause the computing device to determine the schema of the received data set by querying a database to identify historic records with a same schema as the received data set.

### Claim 12 (depends on 9)

The computing device of claim 9, wherein the instructions, when executed by the one or more processors, cause the computing device to:
extract the one or more instances of sensitive data from the received data set by compiling a queue of sensitive data values in an order that the one or more instances of sensitive data are identified in the received data set; and
replace each of the one or more instances of sensitive data in the received data set corresponding to a known format of sensitive data with a corresponding token by replacing the one or more instances of sensitive data in the order that the one or more instances of sensitive data were identified.

### Claim 13 (depends on 9)

The computing device of claim 9, wherein the instructions, when executed by the one or more processors, cause the computing device to:
detect a third instance of sensitive data in a non-sensitive field of the received data set;
determine whether a third format of the third instance of sensitive data matches a known format of sensitive data;
based on a determination that the third format of the third instance of sensitive data matches a known format of sensitive data, generate a third token corresponding to the third instance of sensitive data; and
replace, in the tokenized data set, the third instance of sensitive data with the third token.

### Claim 14 (depends on 13)

The computing device of claim 13, wherein the instructions, when executed by the one or more processors, cause the computing device to detect the third instance of sensitive data in the non-sensitive field of the received data set by comparing a value of the non-sensitive filed to one or more rules to determine whether the value corresponds to sensitive data.

### Claim 15 (depends on 9)

The computing device of claim 9, wherein the instructions, when executed by the one or more processors, cause the computing device to generate the first token corresponding to the first instance of sensitive data by:
sending, to a token generator, the first instance of sensitive data; and
receiving, from the token generator, the first token.

### Claim 16 (depends on 9)

The computing device of claim 9, wherein the received data set is encrypted.

### Claim 17 (depends on 16)

The computing device of claim 16, wherein the instructions, when executed by the one or more processors, cause the computing device to:
decrypt the received data set; and
encrypt, prior to storing the tokenized data set, the tokenized data set.

### Claim 18

A non-transitory computer-readable medium storing instructions that, when executed, configure a computing device to:
receive a data set;
determine a schema of the received data set;
identify, based on a determination of the schema, one or more instances of sensitive data in the received data set;
extract, based on identification of the one or more instances of sensitive data, the one or more instances of sensitive data from the received data set;
determine whether a first format of a first instance of sensitive data, of the one or more instances of sensitive data, matches a known format of sensitive data;
based on a determination that the first format of the first instance of sensitive data matches a known format of sensitive data, generate a first token corresponding to the first instance of sensitive data;
replace the first instance of sensitive data in the received data set with the first token, wherein each of the one or more instances of sensitive data in the received data set corresponding to a known format of sensitive data is replaced by a corresponding token to generate a tokenized data set;
determine whether a second format of a second instance of sensitive data, of the one or more instances of sensitive data, matches a known format of sensitive data;
based on a determination that the second format of the second instance of sensitive data does not match a known format of sensitive data, store, in the tokenized set of data, an original value of the second instance of sensitive data; and
store, in a data store, the tokenized data set.

### Claim 19 (depends on 18)

The non-transitory computer-readable medium of claim 18, wherein the instructions, when executed, configure the computing device to receive a configuration file associated with the received data set, wherein determining the schema of the received data set is based on the configuration file.

### Claim 20 (depends on 18)

The non-transitory computer-readable medium of claim 18, wherein the instructions, when executed, configure the computing device to determine the schema of the received data set by querying a database to identify historic records with a same schema as the received data set.

### Claim 21 (depends on 18)

The non-transitory computer-readable medium of claim 18, wherein the instructions, when executed, configure the computing device to:
extract the one or more instances of sensitive data from the received data set by compiling a queue of sensitive data values in an order that the one or more instances of sensitive data are identified in the received data set; and
replace each of the one or more instances of sensitive data in the received data set corresponding to a known format of sensitive data with a corresponding token by replacing the one or more instances of sensitive data in the order that the one or more instances of sensitive data were identified.

### Claim 22 (depends on 18)

The non-transitory computer-readable medium of claim 18, wherein the instructions, when executed, configure the computing device to:
detect a third instance of sensitive data in a non-sensitive field of the received data set;
determine whether a third format of the third instance of sensitive data matches a known format of sensitive data;
based on a determination that the third format of the third instance of sensitive data matches a known format of sensitive data, generate a third token corresponding to the third instance of sensitive data; and
replace, in the tokenized data set, the third instance of sensitive data with the third token.

### Claim 23 (depends on 22)

The non-transitory computer-readable medium of claim 22, wherein the instructions, when executed, configure the computing device to detect the third instance of sensitive data in the non-sensitive field of the received data set by comparing a value of the non-sensitive filed to one or more rules to determine whether the value corresponds to sensitive data.

### Claim 24 (depends on 18)

The non-transitory computer-readable medium of claim 18, wherein the instructions, when executed, configure the computing device to generate the first token corresponding to the first instance of sensitive data by:
sending, to a token generator, the first instance of sensitive data; and
receiving, from the token generator, the first token.

### Claim 25 (depends on 18)

The non-transitory computer-readable medium of claim 18, wherein the received data set is encrypted.

### Claim 26 (depends on 25)

The non-transitory computer-readable medium of claim 25, wherein the instructions, when executed, configure the computing device to:
decrypt the received data set; and
encrypt, prior to storing the tokenized data set, the tokenized data set.