In-Memory Tokenization Platform for PCI DSS Compliance
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing tokenization systems rely heavily on hardware security modules (HSMs), which become bottlenecks due to high transaction demands, leading to increased costs and inefficiencies as more HSMs are required to scale with increasing requests.
Innovation Solution
A high-performance tokenization platform that minimizes HSM reliance by offloading processing steps to an in-memory multi-level cache and application server, using HSMs only for encryption key provision, enabling faster and more scalable tokenization operations while maintaining PCI DSS compliance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If HSMs are used to ensure security under PCI DSS, then security compliance is improved, but system performance and scalability deteriorate due to transaction bottlenecks
Solution Approach 1:
The patent segments the tokenization system into multiple independent HSM instances, each capable of handling tokenization requests autonomously. This distributes the transaction load across multiple security modules rather than relying on a single HSM, thereby maintaining PCI DSS compliance while eliminating the single-point bottleneck and improving overall system throughput and scalability.
2Productivity
If additional HSMs are added to handle increasing tokenization requests, then system capacity is improved, but cost and complexity increase significantly
Solution Approach 1:
The patent extracts the cryptographic key management functions from the HSM hardware and implements them in software within the tokenization service. This allows the system to maintain security compliance while eliminating the need for multiple expensive HSM hardware devices, thereby reducing infrastructure complexity and cost while still handling increasing tokenization requests through software-based scaling.
3Productivity
If HSM processing capacity is increased to handle more transactions, then transaction throughput is improved, but cost increases due to expensive HSM hardware
Solution Approach 1:
The patent creates virtual copies of HSM functionality through software-based cryptographic key management that replicates the security operations of physical HSMs. Multiple virtual HSM instances can be instantiated in software to handle high transaction volumes, eliminating the need to procure and deploy additional expensive physical HSM hardware while maintaining equivalent security capabilities and achieving the required transaction throughput.
Data Source
AI summary
Disclosed herein are system, method, and computer program product embodiments for processing tokenization requests in-memory of an application server. Reliance on remote devices, such as hardware security modules, is reduced because functions associated with processing tokenization requests is performed at the application server instead of the remote devices. Applicant server includes a multi-level cache for storing and accessing data for generating, hashing, and encrypting tokens in response to tokenization requests received from client devices.