Mapping between tokenization domains

1. A computer-implemented method for mapping between tokenization domains, comprising:

receiving, by a computer, a single-use token from a single-use token table, the single-use token table including one or more single-use tokens each mapped to an associated clear text value;

identifying in the single-use token table a clear text value to which the single-use token is mapped;

querying a multi-use token table with the identified clear text value, the multi-use token table including one or more multi-use tokens each mapped to an associated clear text value;

receiving, by the computer, a multi-use token mapped to the identified clear text value;

storing, by the computer, an association between the received single-use token and the received multi-use token;

accessing, by the computer, tokenized data comprising data tokenized using the single-use token such that a portion of the tokenized data comprises the single-use token;

querying the stored association using the single-use token to identify the multi-use token;

retokenizing the tokenized data by replacing the portion of the tokenized data comprising the single-use token with the multi-use token; and

outputting the retokenized data.

2. The method of claim 1 , further comprising:

responsive to querying the multi-use token table, deleting, by the computer, the identified clear text value from the computer.

3. The method of claim 1 , wherein the single-use token is received in response to a generation of the single-use token by a tokenization system comprising the single-use token table, the tokenization system configured to tokenize sensitive data with the single-use token by replacing a portion of the sensitive data with the single-use token to create tokenized data, wherein the tokenization system is configured to use the single-use data to tokenize data only once.

4. The method of claim 3 , wherein the tokenization system is further configured to delete the single-use token from the single-use token table after a pre-determined amount of time.

5. The method of claim 1 , further comprising:

receiving, by the computer, a second single-use token from the single-use token table;

identifying a second clear text value to which the second single-use token is mapped;

querying the multi-use token table with the identified second clear text value;

receiving, by the computer, a second multi-use token mapped to the identified second clear text value; and

storing, by the computer, an association between the received second single-use token and the received second multi-use token.

6. The method of claim 5 , wherein the identified clear text value and the identified second clear text value comprise the same value.

7. The method of claim 5 , wherein the association between the received single-use token and the received multi-use token and the association between the received second single-use token and the received second multi-use token are stored in a token map mapping single-use tokens to multi-use tokens.

8. A token mapping system for mapping between tokenization domains, comprising:

an input configured to receive a single-use token from a single-use token table, the single-use token table including one or more single-use tokens each mapped to an associated clear text value;

a query module configured to:

identify a clear text value to which the single-use token is mapped;

query a multi-use token table with the identified clear text value, the multi-use token table including one or more multi-use tokens each mapped to an associated clear text value; and

receive a multi-use token mapped to the identified clear text value;

a token map configured to store an association between the received single-use token and the received multi-use token; and

a tokenization engine configured to:

access tokenized data comprising data tokenized using the single-use token such that a portion of the tokenized data comprises the single-use token;

query the token map using the single-use token to identify the multi-use token;

retokenize the tokenized data by replacing the portion of the tokenized data comprising the single-use token with the multi-use token; and

outputting the retokenized data.

9. The system of claim 8 , wherein the query module is further configured to:

responsive to querying the multi-use token table, delete the identified clear text value.

10. The system of claim 8 , wherein the single-use token is received in response to a generation of the single-use token by a tokenization system comprising the single-use token table, the tokenization system configured to tokenize sensitive data with the single-use token by replacing a portion of the sensitive data with the single-use token to create tokenized data, wherein the tokenization system is configured to use the single-use data to tokenize data only once.

11. The system of claim 10 , wherein the tokenization system is further configured to delete the single-use token from the single-use token table after a pre-determined amount of time.

12. The system of claim 8 , the input further configured to receive a second single-use token from the single-use token table, the query module further configured to identify a second clear text value to which the second single-use token is mapped and receive a second multi-use token mapped to the identified second clear text value in response to querying the multi-use table with the identified second clear text value, and wherein the token map is further configured to store an association between the received second single-use token and the received second multi-use token.

13. The system of claim 12 , wherein the identified clear text value and the identified second clear text value comprise the same value.

14. A computer-implemented method for mapping between tokenization domains, comprising:

receiving, by a computer, a single-use token from a single-use token table, the single-use token table including one or more single-use tokens each mapped to an associated clear text value;

querying an external security system with the received single-use token, the security system communicatively coupled to the single-use token table and a multi-use token table including one or more multi-use tokens each mapped to an associated clear text value, the external security system configured to, in response to the query:

identify a clear text value to which the single-use token is mapped within the single-use token table;

query the multi-use token table with the identified clear text value; and

receive a multi-use token mapped to the identified clear text value within the multi-use token table; and

receiving, by the computer, the multi-use token received by the external security system;

storing, by the computer, an association between the received single-use token and the received multi-use token;

accessing, by the computer, tokenized data comprising data tokenized using the single-use token such that a portion of the tokenized data comprises the single-use token;

querying the stored association using the single-use token to identify the multi-use token;

retokenizing the tokenized data by replacing the portion of the tokenized data comprising the single-use token with the multi-use token; and

outputting the tokenized data.

15. The method of claim 14 , wherein the single-use token is received in response to a generation of the single-use token by a tokenization system comprising the single-use token table, the tokenization system configured to tokenize sensitive data with the single-use token by replacing a portion of the sensitive data with the single-use token to create tokenized data, wherein the tokenization system is configured to use the single-use data to tokenize data only once.

16. The method of claim 15 , wherein the tokenization system is further configured to delete the single-use token from the single-use token table after a pre-determined amount of time.

17. The method of claim 14 , further comprising:

receiving, by the computer, a second single-use token from the single-use token table;

querying the external security system with the received second single-use token table;

receiving, by the computer, a second multi-use token mapped to a same second clear text value as the second single-use token; and

storing, by the computer, an association between the received second single-use token and the received second multi-use token.

18. The method of claim 17 , wherein the identified clear text value and the second clear text value comprise the same value.

19. The method of claim 17 , wherein the association between the received single-use token and the received multi-use token and the association between the received second single-use token and the received second multi-use token are stored in a token map mapping single-use tokens to multi-use tokens.

20. A computer-implemented method for mapping between tokenization domains, comprising:

accessing, by a computer, a first token from a first token table defining a first token domain mapping the first token to an associated clear text value;

accessing, by the computer, a second token from a second token table defining a second token domain mapping the second token to the associated clear text value;

storing, by the computer, an association between the accessed first token and the accessed second token in a token map;

retokenizing tokenized data by replacing a portion of the tokenized data comprising the single-use token with the multi-use token mapped to the single-use token by the token map; and

outputting the retokenized data.