Abstract: A method, apparatus, system, or computer-readable medium for performing object-level encryption and key rotations is disclosed. A service platform may store data items organized into one or more asset clusters. A first content encryption key may be set as the active encryption key for an asset cluster. The active encryption key may be encrypted using the master encryption key. A first subset of data items may be encrypted using the active encryption key (e.g., the first content encryption key). After the number of data items encrypted using the active encryption key satisfies a threshold value, the first content encryption key may be set as an inactive encryption key and a second content encryption key may be set as the new active encryption key for the asset cluster. A second subset of the plurality of data items may be encrypted using the active encryption key (e.g., the second content encryption key).

Abstract: A method and system for generating a token for securing sensitive data are provided. The method includes receiving first information that relates to a first format of a first type of data and second information that relates to a second format of a second type of data; defining a first algorithm for generating a first token that has the first format and a second algorithm for generating a second token that has the second format; using the first algorithm to generate a set of unique first tokens; using the second algorithm to generate a set of unique second tokens; and when a request for protecting sensitive data that has either the first format or the second format is received, retrieving a first token or a second token and associating the retrieved token with the sensitive data. The method is optimized for issuing tokens of any format.

Abstract: A method, apparatus, system, or computer-readable medium for performing object-level encryption and key rotations is disclosed. A service platform may store data items organized into one or more asset clusters. A first content encryption key may be set as the active encryption key for an asset cluster. The active encryption key may be encrypted using the master encryption key. A first subset of data items may be encrypted using the active encryption key (e.g., the first content encryption key). After the number of data items encrypted using the active encryption key satisfies a threshold value, the first content encryption key may be set as an inactive encryption key and a second content encryption key may be set as the new active encryption key for the asset cluster. A second subset of the plurality of data items may be encrypted using the active encryption key (e.g., the second content encryption key).