Data protection with translation

A computer-implemented method comprising:

• receiving, by a payment processing network computer from a host server, an authorization request message for a transaction, wherein the authorization request message includes an encrypted personal identification number (PIN) encrypted using a first zone encryption key and encrypted sensitive data encrypted using a second zone encryption key, wherein the first zone encryption key and the second zone encryption key are associated with the payment processing network computer, unique from each other, and both derived from an initial key derived from a base derivation key that is associated with a key serial number;
• decrypting, by the payment processing network computer, the encrypted PIN using a first zone decryption key;
• decrypting, by the payment processing network computer, the encrypted sensitive data using a second zone decryption key;
• verifying, by the payment processing network computer, the decrypted sensitive data and the decrypted PIN;
• and
• based on the verified decrypted sensitive data and PIN, performing authorization processing for the transaction, including transmitting an authorization response message to the host server, the authorization response message indicating whether the transaction is approved,
• wherein the first zone encryption key and the second zone encryption key are selected from a set of zone encryption keys based on a determination that the authorization request message is to be routed to the payment processing network computer, of a plurality of potential payment processing network computers, based on the decrypted sensitive data, and
• wherein a third zone encryption key and a fourth zone encryption key are associated with a second payment processing network computer and used for encryption when routing a second authorization request message to the second payment processing network computer, and wherein the second payment processing network computer uses a third zone decryption key and a fourth zone decryption key to decrypt and validate a second sensitive data and a second PIN, respectively, for a second transaction, wherein the host server:
• received the sensitive data and the PIN encrypted in a first format, wherein the PIN and the sensitive data are encrypted using Triple DES Encryption Algorithm (TDEA),
• derived the initial key from the base derivation key,
• generated a first derived decryption key and a second derived decryption key from the initial key according to a derived unique key per transaction (DUKPT) key management scheme,
• decrypted the PIN using the first derived decryption key, and
• decrypted the sensitive data using the second derived decryption key,
• prior to re-encrypting the PIN using the first zone encryption key and re-encrypting the sensitive data using the second zone encryption key.