Through Intuit’s innovative technology, we are able to provide the best possible products for our customers. Behind that technology are the incredible employees who strive every day to bring superior experiences to customers in order to help them prosper.
In our series, “Why Does it Matter,” Intuit employees discuss the technology behind innovations they helped create at Intuit.
Today, we’re taking a look at one of the Scott Cook Innovation Awards winners, the team who brought Intuit Data Protection Services (IDPS) innovations to Intuit. We’d like to thank Gleb Keselman, Yaron Sheffer, Ernesto Nebel, and the Intuit Data Protection Services (IDPS) team for your hard work and for walking us through Why It Matters!
+++++
The IDPS innovations didn’t solve just one challenge, it provided two secure solutions in critical areas:
Challenge 1
Since Intuit’s products store extremely sensitive information, it is critical to have a secure database. Intuit’s Electronic Filing Engine (EFE) stores more than 100 million filings per tax season in one database. EFE needed to encrypt millions of rows in highly sensitive or secret fields (like SSN’s or dates of birth), while at the same time keeping the fields searchable.
To prevent intrusion from an attacker in the database – which could expose highly classified information like 100 million SSN’s – the EFE team needed an efficient way to shard this database (aka partition the database). Physical sharding of the EFE database was extremely difficult since there are countless fields to account for.
The team came up with the solution to shard the database logically, by using tens of thousands to millions of keys for each encrypted column in the EFE database. To keep the management of encryption keys simple, the team used one base key per type of field (SSN, date of birth, etc.), and encrypted the data not with the base keys, but with thousands of different derived keys. The solution was a success and is now available to all of Intuit.
Challenge 2
Authenticating to IDPS to perform operations required an API key, but if IDPS is used to store keys and secrets, where does one store the API key to communicate with IDPS?
The solution was to perform policy based authentication, where a machine (or cluster of machines) can be identified based on its unique parameters. This required building additional authentication capabilities which are able to query among the Intuit instances fleets in AWS and the company’s data centers, and perform challenge based authentication. This solution (besides being available for use in IDPS) is also being extracted to a separate authentication service, to perform authentication-as-a-service.
Impact
As a result of this effort, the IDPS team not only helped countless customers, we also provided two secure solutions and created four patents. We’re excited to see the impact of our work steam across the entire ecosystem.