Capital One Services, LLC

Rohit Joshi

Hao Cheng

Ashish Gupta

Lan Xie

Marek Bazler

Matthew Van Adelsberg

Siqi Wang

Bozhao Tan

Jonathan Weimer

Vishal Parikh

Fedor N Dzegilenko

Swapna Mandala

Michael James Caughey

Vikash Tiwari

Jeffrey Michel

Meenakshi Panda

Vinayak Hulawale

Glen Hao Cheng

In some embodiments, reducing authentication delays related to security module processing may be facilitated. In some embodiments, a first authentication code may be generated based on a first verification code associated with an account. The first authentication code may be stored in association with the account. An authentication request may be obtained to authenticate an action, and the authentication request may comprise a second verification code. A security module request may be generated for a security module response related to the second verification code. A second authentication code may be generated based on the second verification code. Based on a determination that the second authentication code corresponds to the first authentication code, an authentication response for the authentication request may be provided.

System and method for reducing authentication delays related to security module processing

Techniques are disclosed for performing scanning and profiling of stored data to identify the location of data entries that comprise sensitive data that require storage in accordance with enhanced security requirements. The techniques advantageously move a portion of the scanning and profiling operations closer to the data storage locations, and involve deploying processing resources near the locations at which the data is stored rather than relying solely upon centralizing processing at a separate location. This approach has the advantages of reducing network traffic and latency, which can help improve performance and reduce costs, and may also facilitate organizations to better take advantage of distributed computing architectures, which can scale more effectively than centralized processing.

System and methods for scanning and profiling data for security compliance

A system and method for authentication a user attempting access to a service is disclosed herein. When a user attempts to gain access, a client associated with the user generates a unique authentication code that is stored at a callback server associated with the client. The user accesses an authentication server associated with the service and provides the authentication server with standard login credentials. The authentication server also obtains the authentication code from the user. If the authentication server successfully verifies the user's credentials, then the authentication server transmits a code validation request to the callback server to validate the authentication code. The callback server verifies that the received code matches a stored code and is current, and then issues a reply message to the authentication server. The authentication server grants or denies the user's access request based on the reply.

System and method for multi-factor authentication

Methods and systems disclosed herein describe tokenizing data to generate a secure token that is limited in scope (e.g., directed to a specific recipient) and limited in time (e.g., valid for only a specified period of time). A detokenization process may be employed to recover encrypted data of the secure token without the need for any relational database lookup processes, thereby reducing cost while maintaining robust protection against unintended recipients that attempt to recover the encrypted data.

Secure data exchange using format-preserving encryption

Disclosed herein are system, method, and computer program product embodiments for vaultless tokenization. Alphanumeric values may be determined based on numeric values generated from a hash of numeric user information shuffled through a plurality of randomly generated alphanumeric tables. The numeric user information and the alphanumeric values may be used to generate a table index. Shuffled numeric user information may be generated based on the table index and a plurality of randomly generated numeric tables, and transformed to alphanumeric user information (e.g., via format-preserving encryption, additive cipher, etc.). Each character of the alphanumeric user information may be shuffled through a different alphanumeric table of the plurality of alphanumeric tables identified for the character based on the table index. Moreover, an alphanumeric token may be generated based on the shuffled characters of the alphanumeric user information.

Vaultless tokenization

Disclosed are systems and methods for leader node election, comprising a cluster system including a plurality of nodes, a node registry, wherein nodes are configured to transmit registration requests to the node registry, receive node data is response, and to determine a leader node based on the earliest registered node, and wherein the leader node is configured to dynamically allocate data slots between the plurality of nodes, and each of the nodes are configured to store data associated with allocated data slots in an in-memory least recently used component and data associated with all of the data slots in a persistent storage component.

Systems and methods for leader node election in cluster server configurations

Disclosed are systems and methods for adaptive partitioning of memory and storage resources of a first cluster node of a cluster system, comprising a plurality of nodes; wherein the first node includes one or more shards; and a client device in data communication with the plurality of nodes, wherein the first node is configured to: receive a client request, identify one of the one or more shards based on the client request, retrieve shard rules of the identified shard, determine an allocation of one or more memory slots of the identified shard based on the client request, lock the one or more memory slots, and perform one or more operations on the one or more memory slots associated with the client request based on the allocation.

Systems and methods for adaptive data partitioning within cluster systems

Methods and systems disclosed herein describe obfuscating plaintext cryptographic material stored in memory. A random location in an obfuscation buffer may be selected for each byte of the plaintext cryptographic material. The location of each byte of the plaintext cryptographic material may be stored in a position tracking buffer. To recover the scrambled plaintext cryptographic material, the location of each byte of the plaintext cryptographic material may be read from the position tracking buffer. Each byte of the plaintext cryptographic material may then be read from the obfuscation buffer and written to a temporary buffer. When each byte of the plaintext cryptographic material is recovered, the plaintext cryptographic material may be used to perform one or more cryptographic operations. The scrambling techniques described herein reduce the likelihood of a malicious user recovering plaintext cryptographic material while stored in memory.

Obfuscating cryptographic material in memory

Disclosed are systems and methods for node management performed by a client driver of a client device comprising receiving cluster topology data from the cluster system; transmitting, a data request to each of a plurality of nodes in a cluster system; receiving a reply from each of the nodes that are responsive; assigning, by the client driver, based on the received replies, a responsive status for each of the nodes that are responsive or a non-responsive status for each of nodes that are non-responsive; updating a listing of management data, wherein the management data includes: an identification of each of the plurality of nodes, and a current status of each of the plurality of nodes; and routing, by the client driver, a client request to one of the plurality of nodes that are responsive based on the cluster topology data.

Systems and methods for achieving near zero impact during node failure in a cluster system

Disclosed herein are system, method, and computer program product embodiments for processing tokenization requests in-memory of an application server. Reliance on remote devices, such as hardware security modules, is reduced because functions associated with processing tokenization requests is performed at the application server instead of the remote devices. Applicant server includes a multi-level cache for storing and accessing data for generating, hashing, and encrypting tokens in response to tokenization requests received from client devices.

High performance tokenization platform for sensitive data

In some implementations, a system may obtain a first model that is trained to identify feature data associated with a client system using one or more services of a service platform. The system may train, based on the feature data, a second model to identify anomalies associated with devices accessing the one or more services in association with a client identifier of the client system. The system may receive access data associated with an acting device accessing a service of the service platform. The system may determine, using the second model, that the acting device accessing the service corresponds to potential anomalous activity based on the access information. The system may obtain, from a verification device, a verification that the acting device accessing the service is anomalous activity. The system may perform, based on obtaining the verification, an action associated with the acting device.

Detection of anomalies associated with fraudulent access to a service platform

A system including: at least one processor; and at least one memory having stored thereon computer program code that, when executed by the at least one processor, controls the system to: receive a data model identification and a dataset; in response to determining that the data model does not contain a hierarchical structure, perform expectation propagation on the dataset to approximate the data model with a hierarchical structure; divide the dataset into a plurality of channels; for each of the plurality of channels: divide the data into a plurality of microbatches; process each microbatch of the plurality of microbatches through parallel iterators; and process the output of the parallel iterators through single-instruction multiple-data (SIMD) layers; and asynchronously merge results of the SIMD layers.

Growing community of inventors

Glen Allen, VA, United States of America

Rohit Joshi