Decentralized token table generation
New tokenization tables are derived at intervals in order to increase the security of tokenized data that is transferred between two endpoints. Generation of the new tokenization tables is based on previous tokenization tables, which advantageously allows the generation process to be performed locally at the two endpoints independently of an external tokenization table provider. New tokenization tables can periodically be distributed to the endpoints as a new starting point for derivation.
1. A method for tokenizing data, comprising:
generating, by a central tokenization management system, an initial token table;
providing, by the central tokenization management, the initial token table to a transmitting endpoint and a receiving endpoint;
generating, by the central tokenization management system, a seed value corresponding to a shuffle algorithm and a regeneration interval;
providing, by the central tokenization management system, the generated seed value to the transmitting endpoint, and transmitting endpoint configured to, during the regeneration interval, generate an updated token table based on the initial token table, the seed value, and the shuffle algorithm;
providing, by the central tokenization management system, the generated seed value to the receiving endpoint, the receiving endpoint configured to receive data from the transmitting endpoint tokenized using the updated token table, to generate the updated token table using the seed value, and to detokenize the tokenized data using the updated token table;
generating, by the central tokenization management system, the updated token table using the initial token table, the seed value, and the shuffle algorithm; and
storing, by the central tokenization management system, the updated token table in association with information identifying the regeneration interval without providing the updated token table to the transmitting endpoint or the receiving endpoint.
2. The method of claim 1 , wherein generating the updated token table comprises performing the shuffle algorithm on the initial token table to generate a permutation of token values in the initial token table, the permutation generated with a pseudo-random number generator and the seed value.
3. The method of claim 2 , wherein the pseudo-random number generator is seeded using the seed value.
4. The method of claim 1 , wherein the updated token table is generated by the central tokenization management system in response to determining that the transmitting endpoint has transmitted tokenized data a threshold number of times to the receiving endpoint.
5. The method of claim 1 , wherein the updated token table is generated by the central tokenization management system in response to determining that the transmitting endpoint has transmitted a threshold amount of tokenized data to the receiving endpoint.
6. The method of claim 1 , wherein the transmitting endpoint is configured to provide an identity of the initial token table to the receiving endpoint.
7. The method of claim 1 , wherein at least one token value of the updated token table is not included in the initial token table.
8. A central tokenization management system for tokenizing data, the central tokenization management system comprising a non-transitory computer-readable storage medium storing executable computer instructions and a processor configured to execute the instructions to perform steps comprising:
generating an initial token table;
providing the initial token table to a transmitting endpoint and a receiving endpoint;
generating a seed value corresponding to a shuffle algorithm and a regeneration interval;
providing the generated seed value to the transmitting endpoint, and transmitting endpoint configured to, during the regeneration interval, generate an updated token table based on the initial token table, the seed value, and the shuffle algorithm;
providing the generated seed value to the receiving endpoint, the receiving endpoint configured to receive data from the transmitting endpoint tokenized using the updated token table, to generate the updated token table using the seed value, and to detokenize the tokenized data using the updated token table;
generating the updated token table using the initial token table, the seed value, and the shuffle algorithm; and
storing the updated token table in association with information identifying the regeneration interval without providing the updated token table to the transmitting endpoint or the receiving endpoint.
9. The central tokenization management system of claim 8 , wherein generating the updated token table comprises performing the shuffle algorithm on the initial token table to generate a permutation of token values in the initial token table, the permutation generated with a pseudo-random number generator and the seed value.
10. The central tokenization management system of claim 9 , wherein the pseudo-random number generator is seeded using the seed value.
11. The central tokenization management system of claim 8 , wherein the updated token table is generated by the central tokenization management system in response to determining that the transmitting endpoint has transmitted tokenized data a threshold number of times to the receiving endpoint.
12. The central tokenization management system of claim 8 , wherein the updated token table is generated by the central tokenization management system in response to determining that the transmitting endpoint has transmitted a threshold amount of tokenized data to the receiving endpoint.
13. The central tokenization management system of claim 8 , wherein the transmitting endpoint is configured to provide an identity of the initial token table to the receiving endpoint.
14. The central tokenization management system of claim 8 , wherein at least one token value of the updated token table is not included in the initial token table.
15. A non-transitory computer-readable storage medium storing executable computer instructions for tokenizing data, the instructions, when executed by a processor of a central tokenization management system, configured to perform steps comprising:
generating an initial token table;
providing the initial token table to a transmitting endpoint and a receiving endpoint;
generating a seed value corresponding to a shuffle algorithm and a regeneration interval;
providing the generated seed value to the transmitting endpoint, and transmitting endpoint configured to, during the regeneration interval, generate an updated token table based on the initial token table, the seed value, and the shuffle algorithm;
providing the generated seed value to the receiving endpoint, the receiving endpoint configured to receive data from the transmitting endpoint tokenized using the updated token table, to generate the updated token table using the seed value, and to detokenize the tokenized data using the updated token table;
generating the updated token table using the initial token table, the seed value, and the shuffle algorithm; and
storing the updated token table in association with information identifying the regeneration interval without providing the updated token table to the transmitting endpoint or the receiving endpoint.
16. The non-transitory computer-readable storage medium of claim 15 , wherein generating the updated token table comprises performing the shuffle algorithm on the initial token table to generate a permutation of token values in the initial token table, the permutation generated with a pseudo-random number generator and the seed value.
17. The non-transitory computer-readable storage medium of claim 16 , wherein the pseudo-random number generator is seeded using the seed value.
18. The non-transitory computer-readable storage medium of claim 15 , wherein the updated token table is generated by the central tokenization management system in response to determining that the transmitting endpoint has transmitted tokenized data a threshold number of times to the receiving endpoint.
19. The non-transitory computer-readable storage medium of claim 15 , wherein the updated token table is generated by the central tokenization management system in response to determining that the transmitting endpoint has transmitted a threshold amount of tokenized data to the receiving endpoint.
20. The non-transitory computer-readable storage medium of claim 15 , wherein the transmitting endpoint is configured to provide an identity of the initial token table to the receiving endpoint.