Systems and methods for tokenization in the public cloud

1 . A method for tokenizing data in a public cloud, comprising:

receiving, at a tokenization service in a public cloud and from a client application, source data associated with one of a plurality of namespaces;

generating, by the tokenization service, a token for the source data, wherein the token has a token format that is specific to the namespace;

encrypting, by the tokenization service, the source data;

associating, by the tokenization service, the token with the encrypted source data;

persisting, by the tokenization service, the association between the token and the encrypted source data in a token table in the public cloud; and

providing, by the tokenization service, the token to the client application.

2 . The method of claim 1 , further comprising:

computing, by the tokenization service, a hash of the source data; and

persisting, by the tokenization service, the hash with the token in a source hash table in the public cloud.

3 . The method of claim 1 , wherein the source data comprises sensitive data.

4 . The method of claim 3 , wherein the sensitive data comprises personally identifiable data.

5 . The method of claim 1 , further comprising:

validating, by the tokenization service, an entitlement or permission of the client application to tokenize the source data.

6 . The method of claim 1 , wherein each of the plurality of namespaces has a different token format.

7 . The method of claim 6 , wherein the token format is based on a length of the token.

8 . The method of claim 2 , wherein the association is partitioned in the token table using an application identifier and/or the namespace, and hash and the token are partitioned in the source hash table using the application identifier and/or the namespace.

9 . The method of claim 1 , further comprising:

persisting, by the tokenization service, the token format for the namespace, a prefix for the token, and an encryption master key identifier for the namespace in a metadata table.

10 . The method of claim 1 , wherein the step of encrypting, by the tokenization service, the source data comprises:

obtaining, by the tokenization service, encryption keys from an encryption keys service; and

encrypting, by tokenization service, the source data using the encryption keys.

11 . A method for querying data, comprising:

receiving, at a tokenization service in a public cloud and from a client application, a request for source data for a token, the request comprising a namespace for the source data and an application identifier;

querying, by the tokenization service, a token table with the token, the namespace, and the application identifier, wherein the token is persisted with encrypted source data in the token table and partitioned by the namespace and the application identifier;

receiving, by the tokenization service, encrypted source data associated with the token from the token table;

decrypting, by the tokenization service, the encrypted source data; and

returning, by the tokenization service, the source data to the client application.

12 . The method of claim 11 , wherein the source data comprises sensitive data.

13 . The method of claim 12 , wherein the sensitive data comprises personally identifiable data.

14 . The method of claim 11 , further comprising:

validating, by the tokenization service, an authorization of the client application to access the source data.

15 . The method of claim 14 , wherein the step of validating comprises:

checking, by the tokenization service, that a record for a combination of the application identifier and the namespace is present in a metadata table; and

confirming, by the tokenization service, that an entitlement for combination of the application identifier and namespace is provided in an authentication token received from the client application with the request.

16 . A method for token lookup, comprising:

receiving, at a tokenization service in a public cloud and from a client application, source data, a namespace for the source data, and an application identifier;

computing, by the tokenization service, a computed source hash of the source data;

querying, by the tokenization service, a source hash table for the computed source hash, wherein the source hash table comprises a plurality of hashes, each hash associated with a token;

returning, by the tokenization service and to the client application, a token not found indication in response to the computed source hash not being in the source hash table; and

returning, by the tokenization service and to the client application, a token associated with the computed source hash in response to the computed source hash being in the source hash table.

17 . The method of claim 16 , wherein the computed source hash further comprises the application identifier.

18 . The method of claim 16 , wherein the client application is configured to use the token as a proxy for the source data.

19 . The method of claim 16 , wherein the source data comprises sensitive data.

20 . The method of claim 19 , wherein the sensitive data comprises personally identifiable data.