Token It Up A Notch: Elevating Payment Security
summary
Chime describes a homegrown tokenization service that uses envelope encryption with AWS KMS, S3 and Aurora, stores encrypted DEKs plus encrypted values, and uses HMAC digests for index queries. API surface uses Twirp/protobuf, SQS for async, EKS behind AWS PrivateLink, and Go clients. Key operational wins: rotate DEKs every 100 uses to limit blast radius, push detokenization from ~8+ hours down to under 10 minutes with caching and parallelism. Auth, short JWTs, rate limiting, JIT SSH and Datadog monitoring are in place.
AI-written summary · about
chapters (15)
- 0:00Tokenization at Chime
- 1:27Why Chime needed tokenization
- 3:13PCI compliance basics
- 5:00Tokenization in payment flows
- 6:43Chime’s tokenization architecture
- 12:21Envelope encryption and key hierarchy
- 14:10Token storage design
- 17:02Encryption and decryption code
- 19:30Key reuse challenges
- 21:57Law enforcement requests use case
- 28:04Threat actors and risks
- 34:09Key rotation policies
- 37:19Insider threats and fraud
- 39:21Key takeaways
- 42:13Q&A
related talks
01h 00mBehind the scenes: AWS investments in security innovation
32mEnhancing Security, Reliability, and Global Scalability in FinTech
51mKey Management 101: DEKs, KEKs, and Credentials Living Together, Oh My!
22mToken-Based Architecture Design
33mSecure your Go APIs with Decentralised Identity Tokens
43mCostume Jewelry: How Capital One Uses Tokenization to Protect Data
34mWho Goes There? Detecting Intruders With Honeytokens
54mEnabling Message Level Protection at Uber