Systems and methods for maintaining data security across multiple active domains

A method of protecting sensitive data in a multiple domain environment, said method comprising the computer-implemented steps of:

• establishing a first data vault located at a first domain, and a replica of said first data vault at each of a plurality of second domains;
• establishing a plurality of second data vaults, each located at one of said plurality of second domains, and establishing a replica of each said plurality of second data vaults at said first domain;
• receiving at said first domain a sensitive data string for tokenization from a client process;
• searching said first data vault to determine if a first token corresponding to said sensitive data string exists therein and, if found, returning said first token to said client process and, if not found:
• searching each said replica of each of said plurality of second data vaults to determine if a second token corresponding to said sensitive data string exists therein and, if found, returning said second token to said client process and, if not found:
• generating a new token according to a token generation algorithm wherein said new token is independent of at least a portion of the data in said sensitive data string, and wherein said token generation algorithm is configured to embed within said new token a domain designator corresponding to said first domain;
• storing said new token in said first data vault;
• returning said new token to said client process;
• and
• updating said replica of said first data vault at each of said plurality of second domains.

A method of identifying multiple tokens associated with the same sensitive data string in a multiple domain environment, said method comprising the computer-implemented steps of:

• establishing a primary data vault located at a primary domain, and a replica of said primary data vault at each of a plurality of secondary domains;
• establishing a plurality of secondary data vaults, each located at one of said plurality of secondary domains, and establishing a replica of each said plurality of secondary data vaults at said primary domain;
• receiving at said primary domain a sensitive data string for tokenization;
• generating a token according to a token generation algorithm wherein said token is independent of at least a portion of the data in said sensitive data string, and wherein said token generation algorithm is configured to embed within said token a domain designator corresponding to said primary domain;
• receiving at said primary domain a token lookup request from a client process;
• searching said primary data vault, which optionally contains a primary token including a primary domain designator wherein said primary token is associated with said sensitive data string;
• searching said replica of each said plurality of secondary data vaults, which optionally contains a secondary token including a secondary domain designator wherein said secondary token is associated with said sensitive data string;
• and
• returning to said client process a set of tokens including said primary token and said secondary token.