Trie-Based Sensitive Data Identification in Payment Processing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems for processing payment card transactions face challenges in effectively identifying and securing sensitive information, such as account numbers, due to the risk of data theft from hacking, especially when information is stored in memory associated with processing equipment.
Innovation Solution
A method and system that identifies potentially sensitive information by searching for tagged strings of bytes corresponding to characters of interest, using a trie algorithm and delimiter searches across various Unicode Transformation Formats, and further evaluates these strings using known identifiers and checksum algorithms to determine their validity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If comprehensive scanning of all data strings is performed to identify sensitive information, then identification accuracy is improved, but processing time increases significantly
Solution Approach 1:
The patent applies preliminary action by performing delimiter searches and length checks before conducting full sensitive information pattern matching. This preliminary filtering identifies and excludes non-sensitive data segments early in the process, reducing the volume of data requiring comprehensive scanning while maintaining accurate identification of actual sensitive information.
Solution Approach 2:
The patent segments the data processing into distinct stages: delimiter identification, string length verification, and sensitive information pattern matching. Each stage processes only relevant portions of the data, avoiding unnecessary comprehensive scanning of entire data sets and thereby reducing processing time while preserving identification accuracy.
2Reliability
If multiple evaluation methods (known identifiers, checksum algorithms) are applied to verify sensitive information, then confidence in identification is improved, but device complexity increases
Solution Approach 1:
The patent merges multiple verification methods (known identifier matching and checksum algorithm validation) into a unified evaluation system. These methods are combined and executed systematically to verify sensitive information, achieving high confidence in identification while managing system complexity through integrated design.
Solution Approach 2:
The patent introduces an intermediary evaluation layer that coordinates between data scanning and final identification. This intermediary layer manages the execution of multiple verification methods, orchestrating known identifier checks and checksum validations to produce reliable results without requiring direct complex interactions between all system components.
3Reliability
If detailed evaluation of each data string is performed to ensure security compliance, then data security is improved, but productivity decreases
Solution Approach 1:
The patent performs preliminary actions by conducting delimiter searches and length validations before detailed security evaluation. This preliminary processing filters out obviously non-sensitive data, allowing detailed security-compliant evaluation to be applied only to candidate strings, thereby maintaining data security while improving overall processing efficiency.
Solution Approach 2:
The patent applies partial evaluation actions to all data strings (delimiter checks, length verification) and reserves excessive/detailed evaluation (full pattern matching, checksum validation) only for strings that pass preliminary filters. This selective application of evaluation depth maintains security compliance for relevant data while preserving productivity across the entire data set.
Data Source
AI summary
A data string that includes potentially sensitive information, such as an account number for a payment card, may be evaluated to determine whether or not any portion of the data string encodes a known identifier of sensitive information, such as a known bank identification number (BIN). A fixed number of bytes of the data string may be analyzed using a trie algorithm, in which the value of a first byte is compared with the value of a corresponding first character of the known identifier. A second byte is then compared with a set of values of corresponding second characters, which accompany the first character of the known identifier. Then the value of a third byte of the data string is compared with a set of values of corresponding third values, which accompany the first and second characters of the known identifier. The use of a trie algorithm decreases the length of the search process by several orders of magnitude.