Decentralized token table generation
New tokenization tables are derived at intervals in order to increase the security of tokenized data that is transferred between two endpoints. Generation of the new tokenization tables is based on previous tokenization tables, which advantageously allows the generation process to be performed locally at the two endpoints independently of an external tokenization table provider. New tokenization tables can periodically be distributed to the endpoints as a new starting point for derivation.
1. A method for tokenizing data, comprising:
receiving, by a receiving endpoint, tokenized data from a transmitting endpoint communicatively coupled to the receiving endpoint, the transmitting endpoint configured to generate a second token table based on a first token table and a seed value and to tokenize data using the second token table, the second token table mapping one or more input values to different token values than the first token table;
receiving, by the receiving endpoint, the seed value from the transmitting endpoint;
accessing, by the receiving endpoint, the first token table;
generating, by the receiving endpoint, the second token table based on the accessed first token table and the received seed value; and
detokenizing the received tokenized data by querying the second token table with a portion of the tokenized data to identify a token value mapped to a value of the portion of the tokenized data and replacing the portion of the tokenized data with the identified token value to produce detokenized data.
2. The method of claim 1 , wherein generating the second token table comprises performing a shuffle algorithm to generate a permutation of the token values in the first token table, the permutation generated with the pseudo-random number generator and the seed value.
3. The method of claim 2 , wherein the pseudo-random number generator is seeded using the seed value.
4. The method of claim 1 , wherein the second token table is generated in response to determining that the transmitting endpoint has transmitted tokenized data a threshold number of times to the receiving endpoint.
5. The method of claim 1 , wherein the second token table is generated in response to determining that the transmitting endpoint has transmitted a threshold amount of tokenized data to the receiving endpoint.
6. The method of claim 1 , wherein the transmitting endpoint is configured to also provide an identity of the first token table to the receiving endpoint.
7. The method of claim 1 , wherein at least one token value of the second token table is not included in the first token table.
8. A system for tokenizing data, the system comprising a non-transitory computer-readable storage medium storing executable computer instructions and a processor configured to execute the instructions to perform steps comprising:
receiving, by a receiving endpoint, tokenized data from a transmitting endpoint communicatively coupled to the receiving endpoint, the transmitting endpoint configured to generate a second token table based on a first token table and a seed value and to tokenize data using the second token table, the second token table mapping one or more input values to different token values than the first token table;
receiving, by the receiving endpoint, the seed value from the transmitting endpoint;
accessing, by the receiving endpoint, the first token table;
generating, by the receiving endpoint, the second token table based on the accessed first token table and the received seed value; and
detokenizing the received tokenized data by querying the second token table with a portion of the tokenized data to identify a token value mapped to a value of the portion of the tokenized data and replacing the portion of the tokenized data with the identified token value to produce detokenized data.
9. The system of claim 8 , wherein generating the second token table comprises performing a shuffle algorithm to generate a permutation of the token values in the first token table, the permutation generated with the pseudo-random number generator and the seed value.
10. The system of claim 9 , wherein the pseudo-random number generator is seeded using the seed value.
11. The system of claim 8 , wherein the second token table is generated in response to determining that the transmitting endpoint has transmitted tokenized data a threshold number of times to the receiving endpoint.
12. The system of claim 8 , wherein the second token table is generated in response to determining that the transmitting endpoint has transmitted a threshold amount of tokenized data to the receiving endpoint.
13. The system of claim 8 , wherein the transmitting endpoint is configured to also provide an identity of the first token table to the receiving endpoint.
14. The system of claim 8 , wherein at least one token value of the second token table is not included in the first token table.
15. A non-transitory computer-readable storage medium storing executable computer instructions for tokenizing data, the instructions, when executed, configured to perform steps comprising:
receiving, by a receiving endpoint, tokenized data from a transmitting endpoint communicatively coupled to the receiving endpoint, the transmitting endpoint configured to generate a second token table based on a first token table and a seed value and to tokenize data using the second token table, the second token table mapping one or more input values to different token values than the first token table;
receiving, by the receiving endpoint, the seed value from the transmitting endpoint;
accessing, by the receiving endpoint, the first token table;
generating, by the receiving endpoint, the second token table based on the accessed first token table and the received seed value; and
detokenizing the received tokenized data by querying the second token table with a portion of the tokenized data to identify a token value mapped to a value of the portion of the tokenized data and replacing the portion of the tokenized data with the identified token value to produce detokenized data.
16. The non-transitory computer-readable storage medium of claim 15 , wherein generating the second token table comprises performing a shuffle algorithm to generate a permutation of the token values in the first token table, the permutation generated with the pseudo-random number generator and the seed value.
17. The non-transitory computer-readable storage medium of claim 16 , wherein the pseudo-random number generator is seeded using the seed value.
18. The non-transitory computer-readable storage medium of claim 15 , wherein the second token table is generated in response to determining that the transmitting endpoint has transmitted tokenized data a threshold number of times to the receiving endpoint.
19. The non-transitory computer-readable storage medium of claim 15 , wherein the second token table is generated in response to determining that the transmitting endpoint has transmitted a threshold amount of tokenized data to the receiving endpoint.
20. The non-transitory computer-readable storage medium of claim 15 , wherein the transmitting endpoint is configured to also provide an identity of the first token table to the receiving endpoint.
21. The non-transitory computer-readable storage medium of claim 15 , wherein at least one token value of the second token table is not included in the first token table.