Table-connected tokenization
A tokenization system tokenizes sensitive data to prevent unauthorized entities from accessing the sensitive data. The tokenization system accesses sensitive data, and retrieves an initialization vector (IV) from an IV table using a first portion of the sensitive data. A second portion of the sensitive data is modified using the accessed initialization vector. A token table is selected from a set of token tables using a third portion of the sensitive data. The modified second portion of data is used to query the selected token table, and a token associated with the value of the modified second portion of data is accessed. The second portion of the sensitive data is replaced with the accessed token to form tokenized data.
1. A method for improving the security of data in a tokenization environment, comprising:
receiving data to be tokenized;
accessing a first token table selected from a first set of token tables stored at a first server by querying the first server with a first single digit of the received data, the first token table associated with a first index value equal to a value of the first single digit of the received data, a second token table selected from a second set of token tables stored at a second server by querying the second server with a second single digit of the received data, the second token table associated with a second index value equal to a value of the second single digit of the received data, a third token table selected from a third set of token tables stored at a third server by querying the third server with a third single digit of the received data, the third token table associated with a third index value equal to a value of the third single digit of the received data, and a fourth token table selected from a fourth set of token tables stored at a fourth server by querying the fourth server with a fourth single digit of the received data, the fourth token table associated with a fourth index value equal to a value of the fourth single digit of the received data; and
tokenizing the received data by:
replacing, by a hardware processor, a portion of the received data with a first token mapped by the first token table to a value of the portion of the received data to produce first tokenized data;
replacing, by the hardware processor, a portion of the first tokenized data with a second token mapped by the second token table to a value of the portion of the first tokenized data to produce second tokenized data;
replacing, by the hardware processor, a portion of the second tokenized data with a third token mapped by the third token table to a value of the portion of the second tokenized data to produce third tokenized data; and
replacing, by the hardware processor, a portion of the third tokenized data with a fourth token mapped by the fourth token table to a value of the portion of the third tokenized data to produce tokenized data.
2. The method of claim 1 , wherein the received data is one of: a password, an account number, a social security number, a driver's license number, information associated with a transaction, or date information.
3. The method of claim 1 , wherein the received data is modified using an initialization vector before being tokenized, and wherein the initialization vector is received from an initialization vector table server.
4. The method of claim 3 , wherein modifying the received data comprises adding a value of the initialization vector to a value of a portion of the received data.
5. The method of claim 1 , wherein the portion of the received data and the portion of the first tokenized data do not overlap.
6. The method of claim 1 , wherein the portion of the received data and the portion of the first tokenized data overlap at least in part.
7. A tokenization system for improving the security of data in a tokenization environment, comprising:
a non-transitory computer-readable storage medium storing executable instructions that, when executed by a processor, perform steps comprising:
receiving data to be tokenized;
accessing a first token table selected from a first set of token tables stored at a first server by querying the first server with a first single digit of the received data, the first token table associated with a first index value equal to a value of the first single digit of the received data, a second token table selected from a second set of token tables stored at a second server by querying the second server with a second single digit of the received data, the second token table associated with a second index value equal to a value of the second single digit of the received data, a third token table selected from a third set of token tables stored at a third server by querying the third server with a third single digit of the received data, the third token table associated with a third index value equal to a value of the third single digit of the received data, and a fourth token table selected from a fourth set of token tables stored at a fourth server by querying the fourth server with a fourth single digit of the received data, the fourth token table associated with a fourth index value equal to a value of the fourth single digit of the received data; and
tokenizing the received data by:
replacing, by a hardware processor, a portion of the received data with a first token mapped by the first token table to a value of the portion of the received data to produce first tokenized data;
replacing, by the hardware processor, a portion of the first tokenized data with a second token mapped by the second token table to a value of the portion of the first tokenized data to produce second tokenized data;
replacing, by the hardware processor, a portion of the second tokenized data with a third token mapped by the third token table to a value of the portion of the second tokenized data to produce third tokenized data; and
replacing, by the hardware processor, a portion of the third tokenized data with a fourth token mapped by the fourth token table to a value of the portion of the third tokenized data to produce tokenized data; and a hardware processor configured to execute the instructions.
8. The tokenization system of claim 7 , wherein the received data is one of: a password, an account number, a social security number, a driver's license number, information associated with a transaction, or date information.
9. The tokenization system of claim 7 , wherein the received data is modified using an initialization vector before being tokenized, and wherein the initialization vector is received from an initialization vector table server.
10. The tokenization system of claim 9 , wherein modifying the received data comprises adding a value of the initialization vector to a value of a portion of the received data.
11. The tokenization system of claim 7 , wherein the portion of the received data and the portion of the first tokenized data do not overlap.
12. The tokenization system of claim 7 , wherein the portion of the received data and the portion of the first tokenized data overlap at least in part.
13. A non-transitory computer-readable storage medium storing executable computer instructions that when executed by a hardware processor perform steps for improving the security of data in a tokenization environment, comprising:
receiving data to be tokenized;
accessing a first token table selected from a first set of token tables stored at a first server by querying the first server with a first single digit of the received data, the first token table associated with a first index value equal to a value of the first single digit of the received data, a second token table selected from a second set of token tables stored at a second server by querying the second server with a second single digit of the received data, the second token table associated with a second index value equal to a value of the second single digit of the received data, a third token table selected from a third set of token tables stored at a third server by querying the third server with a third single digit of the received data, the third token table associated with a third index value equal to a value of the third single digit of the received data, and a fourth token table selected from a fourth set of token tables stored at a fourth server by querying the fourth server with a fourth single digit of the received data, the fourth token table associated with a fourth index value equal to a value of the fourth single digit of the received data; and
tokenizing the received data by:
replacing, by a hardware processor, a portion of the received data with a first token mapped by the first token table to a value of the portion of the received data to produce first tokenized data;
replacing, by the hardware processor, a portion of the first tokenized data with a second token mapped by the second token table to a value of the portion of the first tokenized data to produce second tokenized data;
replacing, by the hardware processor, a portion of the second tokenized data with a third token mapped by the third token table to a value of the portion of the second tokenized data to produce third tokenized data; and
replacing, by the hardware processor, a portion of the third tokenized data with a fourth token mapped by the fourth token table to a value of the portion of the third tokenized data to produce tokenized data.
14. The non-transitory computer-readable storage medium of claim 13 , wherein the received data is one of: a password, an account number, a social security number, a driver's license number, information associated with a transaction, or date information.
15. The non-transitory computer-readable storage medium of claim 13 , wherein the received data is modified using an initialization vector before being tokenized, and wherein the initialization vector is received from an initialization vector table server.
16. The non-transitory computer-readable storage medium of claim 15 , wherein modifying the received data comprises adding a value of the initialization vector to a value of a portion of the received data.
17. The non-transitory computer-readable storage medium of claim 13 , wherein the portion of the received data and the portion of the first tokenized data do not overlap.