Systems and methods for token versioning and reissue

1 . A method, comprising:

receiving, at a tokenization service and from a token management system, a namespace and a plurality of token parameters for the namespace;

receiving, at the tokenization service, a one-time load of a plurality of primary account numbers from the token management system;

generating, by the tokenization service, a token corresponding to each of the plurality of primary account numbers using the token parameters;

storing, by the tokenization service, a mapping of a plurality of tokens to the primary account numbers in the namespace in a token vault, wherein the namespace comprises a first physical data isolation layer;

providing, by the tokenization service, the plurality of tokens to the token management system;

receiving, by the tokenization service and in response to a token refresh event, a new namespace and new token parameters from the token management system;

generating, by the tokenization service, a new token corresponding to each of the primary account numbers using the new token parameters;

storing, by the tokenization service, a mapping of a plurality of new tokens to the primary account numbers in the new namespace in the token vault, wherein the new namespace comprises a second physical data isolation layer and segments the plurality of new tokens in the new namespace from the plurality of tokens in the namespace; and

providing, by the tokenization service, the plurality of new tokens to the token management system.

2 . The method of claim 1 , wherein the plurality of token parameters comprise a token length, a token format, and/or a token datatype.

3 . The method of claim 1 , wherein the token refresh event comprises a breach of the token vault.

4 . The method of claim 1 , wherein the token refresh event comprises changing the token parameters.

5 . The method of claim 1 , further comprising: deleting, by the tokenization service, the namespace after a period of time.

6 . A system, comprising:

one or more computer processors;

one or more memories storing instructions comprising a tokenization service application and a plurality of token consuming applications; and

a token vault;

wherein the one or more computer processors execute the tokenization service application to:

receive, from a token management system, a namespace and a plurality of token parameters for the namespace;

receive a one-time load of a plurality of primary account numbers from the token management system;

generate a token corresponding to each of the plurality of primary account numbers using the token parameters;

store a mapping of a plurality of tokens to the primary account numbers in the namespace in the token vault, wherein the namespace comprises a first physical data isolation layer;

provide the plurality of tokens to the token management system;

receive, and in response to a token refresh event, a new namespace and new token parameters from the token management system;

generate a new token corresponding to each of the primary account numbers using the new token parameters;

store a mapping of a plurality of new tokens to the primary account numbers in the new namespace in the token vault, wherein the new namespace comprises a second physical data isolation layer and segments the plurality of new tokens in the new namespace from the plurality of tokens in the namespace; and

provide the plurality of new tokens to the token management system.

7 . The system of claim 6 , wherein the plurality of token parameters comprise a token length, a token format, and/or a token datatype.

8 . The system of claim 7 , wherein the token refresh event comprises a breach of the token vault.

9 . The system of claim 6 , wherein the token refresh event comprises changing the token parameters.

10 . The system of claim 6 , wherein the one or more computer processors execute the tokenization service application to delete the namespace after a period of time.

11 . A non-transitory computer readable storage medium, including instructions stored thereon, which when read and executed by one or more computer processors, cause the one or more computer processors to perform steps comprising:

receiving, from a token management system, a namespace and a plurality of token parameters for the namespace;

receiving a one-time load of a plurality of primary account numbers from the token management system;

generating a token corresponding to each of the plurality of primary account numbers using the token parameters;

storing a mapping of a plurality of tokens to the primary account numbers in the namespace in a token vault, wherein the namespace comprises a first physical data isolation layer;

providing the plurality of tokens to the token management system;

receiving, in response to a token refresh event, a new namespace and new token parameters from the token management system;

generating a new token corresponding to each of the primary account numbers using the new token parameters;

storing a mapping of a plurality of new tokens to the primary account numbers in the new namespace in the token vault, wherein the new namespace comprises a second physical data isolation layer and segments the plurality of new tokens in the new namespace from the plurality of tokens in the namespace; and

providing the plurality of new tokens to the token management system.

12 . The non-transitory computer readable storage medium of claim 11 , wherein the plurality of token parameters comprise a token length, a token format, and/or a token datatype.

13 . The non-transitory computer readable storage medium of claim 12 , wherein the token refresh event comprises a breach of the token vault.

14 . The non-transitory computer readable storage medium of claim 11 , wherein the token refresh event comprises changing the token parameters.

15 . The non-transitory computer readable storage medium of claim 11 , further including instructions stored thereon, which when read and executed by the one or more computer processors, cause the one or more computer processors to perform steps comprising:

deleting the namespace after a period of time.