Tokenization in a centralized tokenization environment

1. A method for tokenizing data, comprising:

receiving a request to tokenize sensitive data;

identifying a token for use in tokenizing the sensitive data based on a value of a portion of the sensitive data, the identified token comprising a token value mapped to the value of the portion of the sensitive data before the request to tokenize sensitive data is received, the portion of the sensitive data comprising less than all of the sensitive data;

querying a token certificate store for a token certificate associated with the identified token, the token certificate comprising a status of the identified token;

responsive to a determination that the token certificate store contains the token certificate associated with the identified token:

tokenizing the sensitive data with the identified token by replacing the portion of the sensitive data with the token value; and

updating the token certificate based on the tokenization of the sensitive data for storage in the token certificate store.

2. The method of claim 1 , further comprising:

responsive to a determination that the token certificate store does not contain the token certificate associated with the identified token:

tokenizing the sensitive data with the identified token; and

generating the token certificate associated with the identified token based on the tokenization of the sensitive data for storage in the token certificate store.

3. The method of claim 1 , wherein tokenizing the sensitive data with the identified token comprises:

accessing the status of the identified token from the token certificate associated with the identified token; and

tokenizing the sensitive data with the identified token responsive to the accessed status indicating that the identified token is available.

4. The method of claim 3 , further comprising:

rejecting the tokenization request responsive to the accessed status indicating that the identified token is checked out or revoked.

5. The method of claim 4 , further comprising:

responsive to rejecting the tokenization request:

identifying a second token for use in tokenizing the sensitive data based on the value of the portion of the sensitive data, the identified second token comprising a second token value mapped to the value of the portion of the sensitive data;

querying the token certificate store for a second token certificate associated with the second identified token;

tokenizing the sensitive data with the second identified token responsive to a determination that the token certificate store contains the second token certificate; and

updating the second token certificate based on the tokenization of the sensitive data for storage in the token certificate store.

6. The method of claim 1 , wherein the token certificate associated with the identified token further comprises a use rule describing a permitted use of the identified token based on characteristics of the tokenization request.

7. The method of claim 6 , wherein tokenizing the sensitive data with the identified token further comprises:

tokenizing the sensitive data with the identified token subject to characteristics of the tokenization request satisfying the use rule.

8. The method of claim 1 , further comprising:

tokenizing the sensitive data with the identified token prior to querying the token certificate store for the token certificate associated with the identified token.

9. The method of claim 1 , wherein the tokenization request is received at an endpoint, and further comprising:

transmitting the tokenized data to a second endpoint for storage.

10. A system for tokenizing data, comprising:

an endpoint configured to:

receive a request to tokenize sensitive data;

identify a token for use in tokenizing the sensitive data based on a value of a portion of the sensitive data, the identified token comprising a token value mapped to the value of the portion of the sensitive data before the request to tokenize sensitive data is received, the portion of the sensitive data comprising less than all of the sensitive data;

query a token certificate store for a token certificate associated with the identified token, the token certificate store configured to store a plurality of token certificates, each token certificate associated with a token and comprising a status of the token;

responsive to a determination that the token certificate store contains the token certificate associated with the identified token:

tokenize the sensitive data with the identified token by replacing the portion of the sensitive data with the token value; and

update the token certificate based on the tokenization of the sensitive data for storage in the token certificate store.

11. The system of claim 10 , wherein the endpoint is further configured to:

responsive to a determination that the token certificate store does not contain the token certificate associated with the identified token:

tokenize the sensitive data with the identified token; and

generate the token certificate associated with the identified token based on the tokenization of the sensitive data for storage in the token certificate store.

12. The system of claim 10 , wherein tokenizing the sensitive data with the identified token comprises:

accessing the status of the identified token from the token certificate associated with the identified token; and

tokenizing the sensitive data with the identified token responsive to the accessed status indicating that the identified token is available.

13. The system of claim 12 , wherein the endpoint is further configured to:

reject the tokenization request responsive to the accessed status indicating that the identified token is checked out or revoked.

14. The system of claim 13 , wherein the endpoint is further configured to:

responsive to rejecting the tokenization request:

identify a second token for use in tokenizing the sensitive data based on the value of the portion of the sensitive data, the identified second token comprising a second token value mapped to the value of the portion of the sensitive data;

query the token certificate store for a second token certificate associated with the second identified token;

tokenize the sensitive data with the second identified token responsive to a determination that the token certificate store contains the second token certificate; and

update the second token certificate based on the tokenization of the sensitive data for storage in the token certificate store.

15. The system of claim 10 , wherein the token certificate associated with the identified token further comprises a use rule describing a permitted use of the identified token based on characteristics of the tokenization request.

16. The system of claim 15 , wherein tokenizing the sensitive data with the identified token further comprises:

tokenizing the sensitive data with the identified token subject to characteristics of the tokenization request satisfying the use rule.

17. The system of claim 10 , wherein the endpoint is further configured to:

tokenize the sensitive data with the identified token prior to querying the token certificate store for the token certificate associated with the identified token.

18. A system for tokenizing data, comprising:

a token certificate store configured to, for each of a plurality of endpoints:

receive, from the endpoint, a request for a token certificate associated with a token identified by the endpoint for use in tokenizing sensitive data, the token certificate comprising a status of the token, the token identified by the endpoint based on a value of a portion of the sensitive data, the identified token comprising a token value mapped to the value of the portion of the sensitive data before the request to tokenize sensitive data is received by the endpoint, the portion of the sensitive data comprising less than all of the sensitive data;

responsive to determining that the requested token certificate is stored at the token certificate store:

providing the requested token certificate to the endpoint;

receiving an updated token certificate from the endpoint in response to the endpoint tokenizing sensitive data with the identified token, the updated token certificate based on the tokenization of the sensitive data; and

storing the updated token certificate.