	US 12,217,251 B2
	System and method for the protection of consumer financial data utilizing dynamic content shredding
Nathan Durant, Annapolis, MD (US); John Michael Suit, Mount Airy, MD (US); and Ermis Sfakiyanudis, Annapolis, MD (US)
Assigned to Cyber Reliant Corporation, Annapolis, MD (US)
Filed by Cyber Reliant Corporation, Annapolis, MD (US)
Filed on Jan. 22, 2020, as Appl. No. 16/749,183.
Application 16/749,183 is a continuation of application No. 14/994,401, filed on Jan. 13, 2016, abandoned.
Claims priority of provisional application 62/102,772, filed on Jan. 13, 2015.
Prior Publication US 2020/0160333 A1, May 21, 2020
Int. Cl. G06Q 20/38 (2012.01); G06Q 20/40 (2012.01)

CPC G06Q 20/3829 (2013.01) [G06Q 20/401 (2013.01)]

12 Claims

1. A computer-implemented method of protecting electronic financial transaction data, the method comprising the steps of:

(i) providing a first network-based computing device including at least one processor and memory storing instructions, said first network-based computing device further comprising one of a credit card reader or a POS system associated with a merchant;

(ii) initiating at said first network-based computing device a dynamic key exchange using an Elliptic Curve Diffie-Hellman (ECDH) algorithm between said first network-based computing device operating in an encryption endpoint mode and a second network-based computing device operating in a decryption endpoint mode, wherein the dynamic key exchange comprises:

(a) generating public/private key pairs for said first network-based computing device and said second network-based computing device;

(b) exchanging public keys between said first network-based computing device and said second network-based computing device through a certificate authority that validates the public keys of each endpoint; and

(c) generating a shared symmetric key configured for use in block cipher encryption at said first network-based computing device, wherein the shared symmetric key is used for a limited interval before being reestablished;

(iii) receiving at said first network-based computing device electronic transaction information associated with a financial transaction and including at least a personal account number in non-persistent memory;

(iv) causing said first network-based computing device to:

(a) encrypt at least a portion of said electronic financial transaction data using an AES-256 block cipher,

(b) remove said encrypted portion of said electronic financial transaction data from said non-persistent memory and remove any trace of the original, unencrypted data that may be left in non-persistent memory,

(c) apply cryptographic bitsplitting comprising a key information dispersal algorithm to break said encrypted portion of said electronic financial transaction data into a predetermined number of discrete data splits, wherein the key information dispersal algorithm pseud-randomly splits the data into a desired number of n pieces, and wherein reconstitution of these pieces can only be achieved if a pre-specified number of the original shreds are available;

(d) store said predetermined number of discrete data splits across a plurality of distinct memory locations, and

(e) generate metadata including routing and transaction information, an identification of an issuing bank, a transaction total, an identification of a merchant, a listing of the last four digits of a purchaser's account number, and a hash-based message authentication code (HMAC), and excluding said encrypted portion of electronic financial transaction data;

(v) transferring said plurality of discrete data splits and said metadata to said second network-based computing device operating in said decryption endpoint mode;

(vi) processing at said second network-based computing device said dynamic key exchange between said second network-based computing device operating in said decryption endpoint mode and said first network-based computing device operating in said encryption endpoint mode;

(vii) receiving at said second network-based computing device said plurality of discrete data splits and metadata from said first network-based computing device operating in said encryption endpoint mode, wherein said discrete data splits and metadata further comprise discrete portions of data corresponding to a single electronic financial transaction data set that has been processed at step (iv) by said first network-based computing device;

(viii) causing said second network-based computing device to decrypt said electronic financial transaction data by

(a) verifying the HMAC to ensure that the metadata and encrypted data have not been tampered with during its lifespan,

(b) consolidating the n number of splits back into a single encrypted data buffer using cryptographic bitsplitting, and

(ix) processing at said second network-based computing device a financial transaction corresponding to said electronic financial transaction data set.