Sponsored by: Capital One Software | How Capital One Uses Tokenization to Protect Data

Summary

Data tokenization strategy: Capital One shares how tokenization protects sensitive data within Databricks environments without compromising performance or analytics capability.
DataBolt solution: Capital One Software's tokenization product, DataBolt, enables organizations to secure data in Databricks while maintaining utility for AI and analytics applications.
Enterprise compliance: The approach addresses the complexity of managing sensitive data while remaining compliant with evolving regulations and enabling responsible AI adoption.

FAQs

Why is tokenization important for enterprise AI?

AI adoption is often hindered by data security concerns. Tokenization replaces sensitive data with tokens, enabling analytics and AI without exposing original data, thus addressing security-driven barriers to AI.

How has Capital One's tokenization journey evolved?

Capital One began tokenization in 2016 during their cloud migration, deployed it at scale across hundreds of applications processing hundreds of billions of transactions monthly, and now offers it via Capital One Software.

What is DataBolt and how does it work with Databricks?

DataBolt is Capital One Software's tokenization solution that secures data in Databricks environments. It replaces sensitive information with tokens while preserving data utility for analytics and AI applications.

How does tokenization maintain data utility?

Tokenization preserves relational patterns and distributions between tokenized values, allowing analytics, machine learning, and reporting to proceed normally while the original sensitive data remains protected.

Full transcript

All right, we're going to go ahead and get started. So, I'd like to introduce Téja Bapat and Pushkar Ragdar from Capital One Software. They're going to talk about how Capital One uses tokenization to protect data. Take it away. Awesome. Thank you everyone. Uh thanks for coming to our session today. Um before we get started, we're just going to do uh a couple of uh logistic slides as has been asked of us by uh data bricks.
So as an introduction, so I'm the product lead for Capital 1's tokenization solution called data bolt. Um and I have with me here Pushkar. Pushkar, you want to introduce yourself? And I'm the senior manager product on the capital one software team. Wonderful. So, um, a quick peek at our agenda today. Um, we're going to be talking through Capital One's journey of tokenization. So, why tokenization, how we've implemented it at Capital One.
Uh, and then we're going to switch over to talking about data bolt, which is uh our own tokenization solution that we launched last month. And then towards the end I'm going to hand it over to my friend Pushkar here and he's going to walk you through uh data bolt specifically for uh data bricks. Okay. So before we get into the data bolt um I just wanted to go back in time a little bit and talk through the capital one journey for data tokenization.
Right. So back in 2016, we made a bold decision for a bank uh to go fully into the cloud. So 2016 is when we decided we were going to go all into the cloud. Along the way over the next couple of years, we modernized our tech stack. We integrated with data bricks. We built our own tokenization solution. So this tokenization solution is deployed at scale across Capital One, hundreds of applications, hundreds of billions of transactions per month.
And by 20, fast forward a little bit to 2020, we had completed our journey into the cloud. Along the way, a lot of lessons were learned, a lot of tools were built, and that's what that's where the idea of a Capital One software grew. So that's what we launched in 2022. We started off with Slingshot and then as I mentioned last month we launched our data tokenization product called databol. Um okay so the world of data is becoming increasingly complex.
That's not just a headline. That's the reality we all live in. Right? So think about this conference. You registered for data bricks. You entered your personal information, email, things like that. Um for the registration you probably had to fly out to be here which again means you gave your personal information to book your flight to book a hotel you had to again enter your personal information. So imagine if you will the 15 or 20,000 of us that are here that generated all that data and then now extrapolate that to think about the data across the world across all these companies right the volume of it the variety of it there's structured data there's unstructured data there's PDFs there's so much in terms of the variety and also the velocity there's streaming there's AI modeling there's batch processing Um so as at Capital One as we looked at this we realized that there was a problem that we were facing which is that all of this data that these enterprises had within their boundaries while they made the promise to protect that data breaches were still on the rise.
With a show of hands how many people have received a letter in the mail that says some of your data has been breached? I know I have almost on a weekly basis, right? Um so that number is also outdated. I'm sure this number has gone up. But then companies also want to um have data that they can use to train their models for AI, right? But they don't want to have to worry about the fact that this is somebody's sensitive data that they're using.
So that's where we started looking at what makes sense in terms of data protection. How should we look at this? Now the first three boxes if you go from the left to right all of these companies are using this in some way shape or form maybe right deletion gets rid of the data. Masking is just putting another layer on top of it and then redaction is it's if you watch any of these government spy shows you've seen this where you have documents with blacked out data right but the data is lost you can't retrieve it in those three cases.
Now the last two if you look at encryption and tokenization is where you can reverse the data. Encryption has its own you know nuances I'll say uh where you have keys you have complex key management um and then the key is used to decrypt and you put it through an algorithm to be able to protect the data. This is why Capital One chose to use tokenization instead because it's way more it's way easier to manage. It's not as complex.
There are keys, but it's not as complicated as doing encryption. Quick sneak peek at how it works. It's API based. So, an app receives raw data. They have decided they want to protect it. They make an API request to the tokenization engine. The tokenization engine returns a token and what gets saved into the storage is your token. So your sensitive data is nowhere stored. It's the token that's stored instead. Right? Now why why tokenization?
Right? That was one of the things I said I would cover in uh today's talk. So there's a couple of advantages that tokenization has over some of these other techniques. Uh the first one is key management and security. Now like I said, encryption is very complex key management. It's also very vulnerable to brute force attacks. Right now, I'm not going to stand here and say that'll never happen with tokenization, but it's less likely that you're able to really back into the algorithm and get your hands on all the keys with tokenization.
The other advantage it provides is also flexible design. You have metadata that you can store in tokens that you can then use to validate the tokens. You can use them to do bad token detection, right? So there's a lot you can do with just the metadata that can be stored in these uh tokens uh format preservation. So this is where when you tokenize data, it preserves the format. So what that means is you now do not have to go change your entire data schema, data structures, update all your applications, everything can remain the same.
It's just the data is now protected, but you still have the same format. The other advantage it gives is also it preserves the analytical value of the data. So that means even your models if you have training models don't have to change. So it's a way more elegant method of protecting your data without impacting all of your downstream systems as well. So now that I have talked you through all the advantages and why we at Capital One picked tokenization um next up uh we're going to talk through data bolt.
So we took all the learnings and we took the um we took what we had built internally and we decided to bring it to all of you um because you might also benefit from our um lessons learned, right? So what does it provide? Why did we decide to bring it to um customers? It has an advanced security model. Uh we have an architecture and Pushkar is going to go through this in way more detail. Uh but the architecture allows for this data to stay within your infrastructure and your boundaries.
You never have to send that data out. Capital One never touches that data or does anything with that data. The only thing coming back is logs. It's a cloudnative architecture. Again, it works. Um, it's cloud first. Again, like I said, the model is such that you can deploy your data plane anywhere you choose to, as many as you choose to. Um, lightning fast performance. There's some numbers we've been publishing, but really this is infinitely scalable because the way it's architected, and again, Pushkar will touch on some of this in a bit.
Uh, but 4 million tokens per second, I mean, that's pretty amazing. Um and then last but not least uh the reason we are here at this conference today is we've also enabled um seamless integration into data bricks. So with that I'm going to hand it over to and he's going to walk you through what that looks like. Thanks. I think as mentioned uh at Capital One we follow a tenant that we really care about the customer's data and that's why while designing data bolt we kept that at front and center.
So when you look at the architecture over here we have gone for a federated way of architecture where we have differentiated between the control plane and the data plane. The control plane is what resides within Capital 1's environment where you will be coming in. It's a self-service portal UI where you will be coming in and setting up your tokenization configurations. So you'll be setting up your fields, access policies, access groups, everything like that.
And also you will be having a platform management zone from where you can download data bolt related artifacts and also get the customer observability data on the data plane side. That's where the tokenization or data bolt will actually be deployed within a cluster and you can talk to that cluster directly via the APIs that we provide or we are also providing different form of SDKs in different languages like Python, Java, Go, Java Batch and Pispark which can help you interact with the tokenization service and integrate your ecosystem more broadly without your data ever making it back to the Capital One software environment.
Having said that a lot of you might be having a question why data bricks and the idea over here is data bricks like as we are moving fast towards ML models AI and things like that security has become as important and that's why we thought the data bricks ecosystem was the way to go it presented an opportunity to solve big problems for all of you and the customers at data bricks today the first and foremost is capital one has used datab bricks internally at scale We have implemented that solution and leveraged this knowledge.
So we are using the same knowledge to build out data bold for data bricks integration from a datab bricks ecosystem point of view. This solution has been built for datab bricks. We are using the datab bricks unity catalog the secrets API the different compute types like single shared and serverless and the userdefined functions to actually get tokenization to you. And that's really important because you don't have to go ahead and set like all these things already exist in data bricks and this provides you a seamless integration with our solution.
And then the last one is the use cases at scale because AJ already touched upon that data bolt is built for speed and scale which is a perfect fit because a lot of youall are looking for ML model use cases, analytics use cases and you'll have massive data which needs to be tokenized at scale. So at that point of time the speed at which data bolt works really comes into picture. So that's why data bricks was the way to go forward and that's why we thought that integration with data bricks will really help all of you as you look at to go on your AI journeys.
Uh getting into how data bolt has been optimized to work with data bricks. We have the capital one software control plane as you see where we have the customer portal and the catalog service which is directly integrating with the datab bricks control plane through the rest APIs. Uh we have a inbuilt integration with unity catalog which helps us to ingest data like your schema metadata, your tables metadata, your catalog metadata onto the capital one software control plane.
We also ingest user group information, cluster information so that you can define who needs to tokenize the data, how you want to tokenize data and what you want to tokenize as part of the data. It's built on the assumption that you first set up your environment then you decide what you want to protect and then you understand what needs to be consumed. So as you can see once the control plane is set up then the control plane directly talks to the Capital One software tokenization service which is in your customer cloud account.
So no sensitive data from your ecosystem will ever hit the Capital One software ecoplane. So you all have complete control of your data at all times. And the last but not the least is basically this opens up new cases for you in terms of when you're securing the data how can you retain its usefulness because a lot of youall have analytics use cases ML model use cases. So when you tokenize data the biggest question is can I still use it downstream or can I share this data out.
So the first use case is field level security. What we are going ahead and saying is always tokenize your data when it is in storage and have that fieldle security done so that even if there's a breach people who are accessing your data don't see the actual sensitive data you get the tokenized version of it which is useless for bad actors specifically. The other thing is a lot of you might be using delta sharing on data bricks.
So a data sharing use case is at the utmost forefront of what you do as part of data bricks ecosystem. So when you tokenize that data basically this opens up new opportunities of how you want to secure data and share it across like use cases like data bricks clean rooms and things like that so data bold supports that too and the last one is the AI model training wherein because the tokens are deterministic by deterministic I mean is every time an input whatever input you give it gives the always the same output token as part of it so whenever you're using it for analytics cases of model training that connection always stays.
So that's why that referential integrity and deterministic values of the tokens really helps you out in analytics and your ML and AI model use cases. Uh having said that we will be available we are at available at the capital one software booth uh E412. So if you'll definitely feel the value and you see that tokenization might be a use case you are looking for do visit us and we can give you an indepth demo of the same.
So yeah thank you everyone. Thank you everyone.

Learn more about the Databricks Data and AI platform.

The information provided herein is for general informational purposes only and may not reflect the most current product capabilities or configurations.