Tokenized data security
View Patent ↗Provided are devices, methods, systems, computer readable storage media for tokenizing data. In some examples, credit card numbers are tokenized using a pre-generated token map and absent the use of a networked database that stores a relatively large quantity of credit card numbers in a central location. The token map may be generated by a token map generator such that the token map can be used by a tokenizer to replace a portion of an account number with a token, and by a detokenizer to replace the token with the original portion of the account number. A pre-parser and parser may also be used to locate an account number and/or token in a message received over a network.
1. A method of tokenizing an account number comprising:
receiving a message;
determining, by a hardware processor, that the message includes an account number;
determining a length of the account number;
selecting a token map based on the length of the account number;
determining a size of a targeted segment based on the length of the account number;
extracting the targeted segment from the account number;
replacing the targeted segment with a token value and a token map version identifier associated with the token map;
receiving a second message;
determining that the second message includes at least a first predetermined number of characters;
determining that the second message includes a second account number;
determining a second length of the second account number;
locating a vendor code within the second account number;
extracting the vendor code;
analyzing the vendor code to determine an expected length of the second account number;
determining whether the second length of the second account number is the same as the expected length;
executing a Luhn test after determining the second length of the second account number is the same as the expected length; and
providing the second account number to a parser after determining the second length is the same as the expected length.
2. A method of tokenizing an account number comprising:
receiving a message;
determining, by a hardware processor, that the message includes an account number;
determining a length of the account number;
selecting a token map based on the length of the account number;
determining a size of a targeted segment based on the length of the account number;
extracting the targeted segment from the account number;
replacing the targeted segment with a token value and a token map version identifier associated with the token map;
receiving a second message;
determining that the second message includes at least a first predetermined number of characters;
determining that the second message includes a second account number;
determining a second length of the second account number;
locating a vendor code within the second account number;
extracting the vendor code;
analyzing the vendor code to determine an expected length of the second account number;
determining whether the second length of the second account number is the same as the expected length; and
removing digits from the second account number to define a new length after determining the second length of the second account number is different than the expected length.
3. The method of claim 2 further comprising:
determining a new length of the second account number after the digits are removed; and
determining whether the new length of the second account number is the same as the expected length.
4. The method of claim 2 further comprising providing the second account number to a parser after determining the new length is the same as the expected length.
5. The method of claim 2 , wherein the digits that are removed represent an expiration date associated with the second account number.
6. A method of detokenizing an account number comprising:
receiving a message;
searching, by a hardware processor, for a token pattern in the message;
finding the token pattern in the message;
after finding the token pattern in the message, locating a tokenized account number;
parsing a token from the tokenized account number;
extracting a token map identifier from the token;
retrieving a token map based on the token map identifier;
replacing the token with a targeted segment in the account number; and
validating the token map identifier before retrieving the token map.
7. The method of claim 6 further comprising:
parsing a prefix from the account number; and
parsing a suffix from the account number.
8. A method of detokenizing an account number comprising:
receiving a message;
searching, by a hardware processor, for a token pattern in the message;
finding the token pattern in the message;
after finding the token pattern in the message, locating a tokenized account number;
parsing a token from the tokenized account number;
extracting a token map identifier from the token;
retrieving a token map based on the token map identifier;
replacing the token with a targeted segment in the account number; and
converting the token to a base 10 number.
9. The method of claim 8 further comprising executing a Luhn test after converting the token to the base10 number.
10. The method of claim 8 further comprising using the token map to locate the targeted segment.
11. The method of claim 8 further comprising:
parsing a prefix from the account number; and
parsing a suffix from the account number.
12. A system comprising:
at least one hardware processor configured to:
determine that a message includes an account number;
determine a length of the account number;
select a token map based on the length of the account number;
determine a size of a targeted segment based on the length of the account number;
extract the targeted segment from the account number;
receive a second message;
determine that the second message includes at least a first predetermined number of characters;
determine that the second message includes a second account number;
determine a second length of the second account number;
locate a vendor code within the second account number;
extract the vendor code;
analyze the vendor code to determine an expected length of the second account number;
determine whether the second length of the second account number is the same as the expected length;
execute a Luhn test after determining the second length of the second account number is the same as the expected length; and
parse the second account number after determining the second length is the same as the expected length.
13. The system of claim 12 , wherein the at least one hardware processor is further configured to parse the second account number into a prefix value, middle digits value and suffix value.
14. A system of claim 12 , wherein the at least one hardware processor is further configured to:
receive a second message;
search for a token pattern in the second message;
find the token pattern in the second message;
after finding the token pattern in the second message, locate a tokenized account number;
parse a token from the tokenized account number;
extract a token map identifier from the token; and
retrieve a token map based on the token map identifier.
15. A system comprising:
at least one hardware processor configured to:
determine that a message includes an account number;
determine a length of the account number;
select a token map based on the length of the account number;
determine a size of a targeted segment based on the length of the account number;
extract the targeted segment from the account number;
receive a second message;
determine that the second message includes at least a first predetermined number of characters;
determine that the second message includes a second account number;
determine a second length of the second account number;
locate a vendor code within the second account number;
extract the vendor code;
analyze the vendor code to determine an expected length of the second account number;
determine whether the second length of the second account number is the same as the expected length; and
remove digits from the second account number to define a new length after determining the second length of the second account number is different than the expected length.
16. The system of claim 15 , wherein the at least one hardware processor is further configured to parse the second account number into a prefix value, middle digits value and suffix value after determining the new length is the same as the expected length.
17. The system of claim 15 , wherein the at least one hardware processor is further configured to:
receive a second message;
search for a token pattern in the second message;
find the token pattern in the second message;
after finding the token pattern in the second message, locate a tokenized account number;
parse a token from the tokenized account number;
extract a token map identifier from the token; and
retrieve a token map based on the token map identifier.