Bank of America Corporation

Shankar Ramasubramanian Iyer

Navanith R Keerthi

Maria Auxilia Dominique

Edison M Castro

Dhrumit Desai

Suresh G Nair

Ramesh Pichaiyan

Sangappa Galagali

Sundar Krishnamoorthy

Ankit A Khandelwal

Lavanya Tangutur

Raghavendra Razanala

Sachin Mahalasakant Latkar

Aspects of the disclosure provide a technological improvement to a cipher by improving data security of format-preserving encryption (FPE), by, inter alia, embedding specific key identifiers for rotating keys directly into ciphertext. Aspects of the disclosure relate to methods, computer-readable media, and apparatuses for improving data security in a format-preserving encryption (FPE) context by using specific methods of rotating and identifying the appropriate encryption key from among numerous rotating keys stored in a key data store. Specific to FPE, a plaintext of the data and its corresponding ciphertext of the data remain the same in length/size; yet the methods, computer-readable media, and/or apparatuses disclosed herein permit embedding of an identification of a specific key among the plurality of rotating keys for the particular ciphertext without compromising the technical requirements of FPE.

Progressive key rotation for format preserving encryption (FPE)

Embodiments of the present disclosure provide a system for continuous and real-time management and monitoring of robotic process automation bots. In particular, the architecture of the system may comprise a centralized hub which provides various features and functions for bot management and monitoring, such as real-time health status updates, granular logging and notification functions, failure detection and reporting for debugging, bot inventory systems, or the like. Through the use of the components and/or features as described herein, the system may provide an efficient way to manage and monitor robotic process automation bots within a computing environment.

System for continuous management and monitoring of robotic process automation bots

Hardware Security Modules (HSMs) are used to secure data, such as encryption keys. Access to HSMs may be shared across applications, and virtualized to allow the HSMs to generate, store, and provide encryption and decryption processes to various applications when the HSMs are located apart from the particular systems on which the applications are stored. This configuration allows for application owners or developers to easily interface with the HSMs, such that applications may simply request an encryption key from the HSMs, utilize the encryption key for encrypting data, store the encryption key within the HSMs, and/or retrieve the encryption key for decryption without the disadvantages associated with HSMs. Utilizing centralized HSMs improves the efficiency of use, memory storage, and security of the HSMs, due at least in part to allowing application owners and/or developers to interface with HSMs without forcing cryptographic processes that are specific to the application.

Centralized system for a hardware security module for access to encryption keys

The disclosure includes novel encryption and/or decryption methods and systems that provide various security benefits. More specifically, the disclosure includes a description of a file encryption process and its ability to dynamically control permissions on who is allowed to decrypt the file. Moreover, the disclosed process permits an encrypted file to be freely distributed without losing the ability to govern/regulate decryption.

Secure, autonomous file encryption and decryption

Embodiments of the invention are directed to a system, method, or computer program product for triple format preserving encryption for activity data transmissions. In particular the invention provides a secure platform for transmission and storage of data based on multi-level compounded encryption while preserving native data format post-encryption to allow compatibility of post-encryption data with existing systems. In particular, the invention is configured for generating a plurality of encryption keys such that each of the encryption keys are structured to preserve pre-encryption data format, post-encryption. The invention is further configured for sequentially compounding encryption of native format data using the plurality of encryption keys.

System for triple format preserving encryption

Hardware Security Modules (HSMs) may be utilized to store master keys that are used to secure (e.g., wrap) encryption keys that are stored outside of the HSMs. The wrapping of the encryption keys may include using the master key to mask each of the plurality of encryption keys. The master keys are then stored within the HSMs and the wrapped encryption keys may be stored outside of the HSMs. Since the plurality of encryption keys are wrapped, the wrapped encryption keys may be stored outside of the HSMs with a reduced potential for the wrapped encryption keys to be misappropriated. As such, the plurality of encryption keys may be stored in systems that do not have as many security requirements, and thus, have more memory available. As such, the memory needed to store keys within the HSMs is reduced.

Scalable hardware encryption

The present invention includes securing data using vaultless tokenization and encryption. The present invention uses static random token tables in conjunction with encryption methods in order to tokenize sensitive data for the purposes of secure transfer and storage. The present invention is configured to identify data for secure storage, split the data into two or more data segments, access one or more static random token tables containing random tokens, retrieve two or more random tokens from the one or more static random tables for each of the two or more data segments, combine the two or more random tokens into a tokenized sequence, and return the tokenized sequence. Moreover, additional encryption may occur before or after the data is split and/or before or after combining the random tokens into a tokenized sequence.

Security system utilizing vaultless tokenization and encryption

An apparatus with one or more masking rules stored in a memory receives unmasked data associated with a first session identifier via a network and converts the received unmasked data into masked data by applying the one or more masking rules to the unmasked data. The apparatus generates a first mapped identifier associated with the unmasked data and first session identifier. The apparatus also receives, via a network, a second mapped identifier associated with a second session identifier. Upon receiving the second mapped identifier and second session identifier, the apparatus determines whether the second session identifier corresponds to the first session identifier and finds the first mapped identifier corresponding to the received second mapped identifier. The apparatus retrieves and sends the unmasked data associated with the first mapped identifier.

Masking and unmasking data over a network

A computer system deploys monitoring agents that monitor the status and health of the computing resources. An analysis engine aggregates and analyzes event information from monitoring agents in order to support self-configuration, self-healing, self-optimization, and self-protection for managing the computer resources. If the analysis engine determines that a computing resource for a software application is approaching a critical status, the analysis engine may issue a command to that computing resource in accordance with a selected policy based on a detected event pattern. The command may indicate how the computing resource should change its behavior in order to minimize downtime for the software application as supported by that computing resource. The computer system may also support a distributed approach with a plurality of servers interacting with a central engine to manage the computer resources located at the servers.

Modification of computing resource behavior based on aggregated monitoring information

Aspects described herein provide systems and methods for computer system security monitoring. Multiple event monitoring agents may be deployed across an enterprise-wide computing system such that each event monitoring agent monitors at least one event generator of the enterprise-wide computing system. The event monitoring agents may be connected to an event processing server. The event processing server may receive event information generated by the event monitoring agents that describe events occurring at the event generators. The event processing server may perform a security analysis on at least a portion of the event information received that includes applying a security policy to the event information. The event processing server may execute a security response based on the security analysis performed such as, for example, a response specified in the security policy applied.

Growing community of inventors

East Windsor, NJ, United States of America

Shankar Ramasubramanian Iyer