Sensitive data aliasing for transaction-card and other applications

• US 7,873,577 B1
• Filed: 03/10/2006
• Issued: 01/18/2011
• Est. Priority Date: 01/27/2006
• Status: Active Grant

• Current Assignee: Appriss Retail Information LLC
• Original Assignee: Aspect Loss Prevention, LLC (Verisk Analytics Incorporated)
• Inventors: Duhaime, Brad J., Duhaime, David A.
• Primary Examiner(s): Elisca; Pierre E
• Application Number:
  US11/372,736
• Time in Patent Office: 1,775 Days
• Field of Search: 705/50, 705/51, 705/74
• US Class Current: 705/50
• CPC Class Codes: G06F 16/122 using management policies backup systems G06F11/1446; file migration policies for HSM systems G06F16/185
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06F 21/6254 by anonymising data, e.g. decorrelating personal data from the owner's identification
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06Q 20/356 Aspects of software for card payments
• CPC Class Codes: G06Q 20/383 Anonymous user system
• CPC Class Codes: H04L 9/0625 with splitting of the data block into left and right halves, e.g. Feistel based algorithms, DES, FEAL, IDEA or KASUMI
• CPC Class Codes: H04L 9/0631 Substitution permutation network [SPN], i.e. cipher composed of a number of stages or rounds each involving linear and nonlinear transformations, e.g. AES algorithms
• CPC Class Codes: H04L 9/0643 Hash functions, e.g. MD5, SHA, HMAC or f9 MAC

Abstract

Database management and security is implemented in a variety of embodiments. In one such embodiment, data sets containing retail transaction information are analyzed using aliases representing transaction card identifiers. In another embodiment, the transaction card identifiers are stored in an encrypted form for use from a secure access, while the alias identifier is available for standard access.

Claims

1. A method of using data sets associated with transaction card identifiers directed for use in a retail environment, the method being implemented by a computer-based circuit configured and software-programmed to perform the steps of:

accessing, by the computer-based circuit, alias identifiers that represent the transaction card identifiers;

associating the alias identifiers to encrypted forms of the transaction card identifiers;

using the alias identifiers to analyze retail-environment aspects of the data sets, and generating user-directed output therefrom, independent of the transaction card identifiers and the encrypted forms of the transaction card identifiers;

decrypting the encrypted forms of the transaction card identifiers;

subsequently encrypting the transaction card identifiers using a second encryption method;

maintaining the association between alias identifiers and the transaction card identifiers; and

formatting the transaction card, or the alias, identifiers to represent displayable characters.

2. A database processing arrangement for using data sets associated with transaction card identifiers directed for use in a retail environment, the arrangement comprising:

a database, accessible by a computer-based circuit, for storing the data sets and wherein the data sets include transaction card identifiers;

an encryption arrangement for encrypting the transaction card identifiers using a first encryption scheme;

an alias generator for generating aliases and associating the aliases to the transaction card identifiers;

an interface for access to the database by the computer-based circuit, wherein the encryption arrangement performs a re-encryption function that;

decrypts the encrypted forms of transaction card identifiers;

subsequently encrypts the transaction card identifiers using a second encryption scheme; and

maintains the association between aliases and the transaction card identifiers.

3. The database processing arrangement of claim 2, wherein in response to input from the interface, the encryption arrangement encrypts all of the transaction card identifiers in the database using the second encryption scheme.

4. The database processing arrangement of claim 3, wherein the encryption arrangement uses a first key to perform the first encryption scheme and a second key to perform the second encryption scheme.

5. The database processing arrangement of claim 3, wherein:

the encryption arrangement uses a first key to perform the first encryption scheme;

a second key to perform the second encryption scheme; and

both the first and second keys are input through the interface.

6. A database processing arrangement for using data sets associated with transaction card identifiers directed for use in a retail environment, the arrangement comprising:

a database, accessible by a computer-based circuit, for storing the data sets and wherein the data sets include transaction card identifiers;

an encryption arrangement for encrypting the transaction card identifiers using a first encryption scheme;

an alias generator for generating aliases and associating the aliases to the transaction card identifiers;

an interface for access to the database by the computer-based circuit, wherein the interface;

restricts access to the transaction card identifiers to a set of authorized users; and

provides the aliases in place of the transaction card identifiers for a set of standard users, wherein at least some of the standard users are not included in the set of authorized users.