DATA FORMAT-PRESERVING ENCRYPTION, TOKENIZATION, AND ACCESS CONTROL FOR VAULTLESS SYSTEMS AND METHODS

1 . A method, comprising:

encoding a first data set to produce encoded input data;

generating a secure tweak for the encoded input data based on a token format schema by:

encoding a tweak input to produce an encoded tweak input; and

hashing the encoded tweak input along with a unique hashing key to generate the secure tweak;

applying a format preserving encryption algorithm that utilizes the encoded input data, the secure tweak, and a unique encryption key to generate ciphertext output; and

encoding the ciphertext output into token.

2 . The method according to claim 1 , further comprising receiving a cleartext input, wherein the first data set is a part of the cleartext input.

3 . The method according to claim 2 , wherein the tweak input comprises another part of the cleartext input.

4 . The method according to claim 3 , wherein the secure tweak is created from one or more portions of the cleartext input that are not tokenized.

5 . The method according to claim 4 , wherein the secure tweak is created from an entity-provided value.

6 . The method according to claim 5 , wherein the first data set is encoded into the encoded input data using a first lookup table, wherein the first lookup table is unique to an entity that provided the cleartext input.

7 . The method according to claim 6 , wherein the tweak input is encoded using a second lookup table.

8 . The method according to claim 7 , wherein generating the token from the ciphertext output includes using a third lookup table to convert the ciphertext output into the token.

9 . The method according to claim 8 , wherein generating the token from the ciphertext output further comprises assembling an assembled token as a concatenation of the one or more portions of the cleartext input that are not tokenized and the token, as specified in the token format schema.

10 . The method according to claim 8 , wherein the third lookup table comprises alphabetic characters, whereas the first lookup table and the second lookup table comprise numeric characters.

11 . The method according to claim 1 , further comprising:

decoding the ciphertext output from the token;

regenerating the encoded tweak input;

recovering the secret tweak by hashing the encoded tweak input along with the unique hashing key;

decrypting the encoded input data by applying the format preserving encryption algorithm that utilizes the ciphertext output, the secure tweak, and the unique encryption key;

decoding the first data set from the encoded input data; and

reassembling the cleartext input using the first data set.

12 . A system, comprising:

a processor; and

memory for storing executable instructions, the processor being configured to execute the instructions to:

encode a first data set to produce encoded input data;

generate a secure tweak for the encoded input data based on a token format schema by:

encode a tweak input to produce an encoded tweak input; and

hash the encoded tweak input along with a unique hashing key to generate the secure tweak;

apply a format preserving encryption algorithm that utilizes the encoded input data, the secure tweak, and a unique encryption key to generate ciphertext output;

generate a token from the ciphertext output; and

discard the first data set or a cleartext input that comprises the first data set.

13 . The system according to claim 12 , wherein the processor is further configured to encode the first data set using a lookup table.

14 . The system according to claim 13 , wherein the processor is further configured to encode the tweak input using the lookup table.

15 . The system according to claim 14 , wherein the processor is further configured to generate the token from the ciphertext output using the lookup table.

16 . The system according to claim 15 , wherein the processor is further configured to

decode the ciphertext output from the token using the lookup table;

regenerate the encoded tweak input;

recover the secret tweak by hashing the encoded tweak input along with the unique hashing key;

decrypt the encoded input data by applying the format preserving encryption algorithm that utilizes the ciphertext output, the secure tweak, and the unique encryption key;

decode the first data set from the encoded input data; and

reassemble the cleartext input using the first data set.

17 . A method, comprising:

encoding a first data set of a cleartext input to produce encoded input data;

encoding a tweak input to produce an encoded tweak input;

hashing the encoded tweak input along with a unique hashing key to generate a secure tweak;

applying a format preserving encryption algorithm that utilizes the encoded input data, the secure tweak, and a unique encryption key to generate ciphertext output;

generating a token from the ciphertext output;

receiving a request to obtain the cleartext input;

decoding the ciphertext output from the token;

regenerating the encoded tweak input;

recovering the secret tweak by hashing the encoded tweak input along with the unique hashing key;

decrypting the encoded input data by applying the format preserving encryption algorithm that utilizes the ciphertext output, the secure tweak, and the unique encryption key;

decoding the first data set from the encoded input data; and

reassembling the cleartext input using the first data set.