Multi-tenant data protection in a centralized network environment

1. A method for securing data in a centralized environment comprising:

receiving, by a central server from a client device associated with a user account, an encrypted security value, the client device configured to access the encrypted security value from a hardware security device separate from and coupled to the client device;

in response to receiving a request to protect data from the client device, providing, by the central server, the encrypted security value previously provided by the client device and stored by the central server to the client device for decryption and receiving a decrypted security value from the client device in response;

accessing, by the central server, a static token table corresponding to the user account, the static token table mapping each of a plurality of input values to a different token value;

generating, by the central server, a reshuffled static token table by reshuffling the token values within the static token table based at least in part on the decrypted security value such that at least one input value is mapped by the reshuffled static token table to a different token value than by the static token table;

receiving, by the central server from the client device, data to be protected;

tokenizing, by the central server, the received data using the reshuffled static token table by querying the reshuffled static token table with a value of a portion of the received data to identify a token value mapped to the value of the portion of the accessed data and replacing the portion of the received data with the identified token value; and

providing, by the server, the tokenized data to a database for storage in conjunction with tokenized data corresponding to other user accounts such that an unauthorized access to tokenized data corresponding to a first user account does not compromise tokenized data corresponding to a second user account.

2. The method of claim 1 , wherein the accessed static token table corresponds to an enterprise, a company, or set of user accounts including the user account and each of the other user accounts, such that the accessed static token table is only accessed for a user associated with the enterprise, the company, or the set of user accounts.

3. The method of claim 1 , wherein the hardware security device comprises 1) a random number generator configured to produce a security value, 2) an encryption key, and 3) an encryption engine configured to encrypt the security value using the encryption key.

4. The method of claim 1 , wherein reshuffling the token values comprises seeding a random number generator using the decrypted security value, the random number generator configured to select a token value from the static token table to map to each of the input values of the reshuffled static token table.

5. The method of claim 1 , wherein reshuffling the token values comprises modifying one or more token values within the static token table using the decrypted security value to produce the reshuffled static token table.

6. The method of claim 1 , further comprising:

receiving, by the central server from a second client device associated with a second user account, a second security value;

generating, by the central server, a second reshuffled static token table different from the reshuffled static token table by reshuffling the token values within the static token table based at least in part on the second security value;

receiving, by the central server from the second client device, second data to be protected;

tokenizing, by the central server, the received second data using the second reshuffled static token table by querying the second reshuffled static token table with a value of a portion of the second received data to identify a second token value mapped to the value of the portion of the second received data and replacing the portion of the second received data with the identified second token value; and

providing, by the server, the tokenized second data to the database for storage.

7. A non-transitory computer-readable storage medium storing executable computer instructions that, when executed by a processor, cause the processor to perform steps comprising:

receiving, by a central server from a client device associated with a user account, an encrypted security value, the client device configured to access the encrypted security value from a hardware security device separate from and coupled to the client device;

in response to receiving a request to protect data from the client device, providing, by the central server, the encrypted security value previously provided by the client device and stored by the central server to the client device for decryption and receiving a decrypted security value from the client device in response;

accessing, by the central server, a static token table corresponding to the user account, the static token table mapping each of a plurality of input values to a different token value;

generating, by the central server, a reshuffled static token table by reshuffling the token values within the static token table based at least in part on the decrypted security value such that at least one input value is mapped by the reshuffled static token table to a different token value than by the static token table;

receiving, by the central server from the client device, data to be protected;

tokenizing, by the central server, the received data using the reshuffled static token table by querying the reshuffled static token table with a value of a portion of the received data to identify a token value mapped to the value of the portion of the accessed data and replacing the portion of the received data with the identified token value; and

providing, by the server, the tokenized data to a database for storage in conjunction with tokenized data corresponding to other user accounts such that an unauthorized access to tokenized data corresponding to a first user account does not compromise tokenized data corresponding to a second user account.

8. The non-transitory computer-readable storage medium of claim 7 , wherein the accessed static token table corresponds to an enterprise, a company, or set of user accounts including the user account and each of the other user accounts, such that the accessed static token table is only accessed for a user associated with the enterprise, the company, or the set of user accounts.

9. The non-transitory computer-readable storage medium of claim 7 , wherein the hardware security device comprises 1) a random number generator configured to produce a security value, 2) an encryption key, and 3) an encryption engine configured to encrypt the security value using the encryption key.

10. The non-transitory computer-readable storage medium of claim 7 , wherein reshuffling the token values comprises seeding a random number generator using the decrypted security value, the random number generator configured to select a token value from the static token table to map to each of the input values of the reshuffled static token table.

11. The non-transitory computer-readable storage medium of claim 7 , wherein reshuffling the token values comprises modifying one or more token values within the static token table using the decrypted security value to produce the reshuffled static token table.

12. The non-transitory computer-readable storage medium of claim 7 , wherein the instruction, when executed by the processor, cause the processor to perform further steps comprising:

receiving, by the central server from a second client device associated with a second user account, a second security value;

generating, by the central server, a second reshuffled static token table different from the reshuffled static token table by reshuffling the token values within the static token table based at least in part on the second security value;

receiving, by the central server from the second client device, second data to be protected;

tokenizing, by the central server, the received second data using the second reshuffled static token table by querying the second reshuffled static token table with a value of a portion of the second received data to identify a second token value mapped to the value of the portion of the second received data and replacing the portion of the second received data with the identified second token value; and

providing, by the server, the tokenized second data to the database for storage.

13. A system for securing data in a centralized environment comprising:

a non-transitory computer-readable storage medium storing executable computer instructions for:

receiving, by a central server from a client device associated with a user account, an encrypted security value, the client device configured to access the encrypted security value from a hardware security device separate from and coupled to the client device;

in response to receiving a request to protect data from the client device, providing, by the central server, the encrypted security value previously provided by the client device and stored by the central server to the client device for decryption and receiving a decrypted security value from the client device in response;

accessing, by the central server, a static token table corresponding to the user account, the static token table mapping each of a plurality of input values to a different token value;

generating, by the central server, a reshuffled static token table by reshuffling the token values within the static token table based at least in part on the decrypted security value such that at least one input value is mapped by the reshuffled static token table to a different token value than by the static token table;

receiving, by the central server from the client device, data to be protected;

tokenizing, by the central server, the received data using the reshuffled static token table by querying the reshuffled static token table with a value of a portion of the received data to identify a token value mapped to the value of the portion of the accessed data and replacing the portion of the received data with the identified token value; and

providing, by the server, the tokenized data to a database for storage in conjunction with tokenized data corresponding to other user accounts such that an unauthorized access to tokenized data corresponding to a first user account does not compromise tokenized data corresponding to a second user account; and

a processor to execute the instructions.

14. The system of claim 13 , wherein the accessed static token table corresponds to an enterprise, a company, or set of user accounts including the user account and each of the other user accounts, such that the accessed static token table is only accessed for a user associated with the enterprise, the company, or the set of user accounts.

15. The system of claim 13 , wherein the hardware security device comprises 1) a random number generator configured to produce a security value, 2) an encryption key, and 3) an encryption engine configured to encrypt the security value using the encryption key.

16. The system of claim 13 , wherein reshuffling the token values comprises seeding a random number generator using the decrypted security value, the random number generator configured to select a token value from the static token table to map to each of the input values of the reshuffled static token table.

17. The system of claim 13 , wherein reshuffling the token values comprises modifying one or more token values within the static token table using the decrypted security value to produce the reshuffled static token table.