Restricting access to sensitive data using tokenization

1. A method comprising:

receiving a security profile comprising user-defined rules for processing sensitive data; identifying a plurality of sensitive data components in a data file according to the security profile;

generating a respective format-preserving token for each of the identified plurality of sensitive data components on an end-user device that is remote from a tokenization server;

generating a corresponding token key for each of the respective format-preserving tokens;

replacing each of the plurality of sensitive data components in the data file with the respective format-preserving token;

wherein the plurality of sensitive data components comprise a first sensitive data component associated with a first respective format-preserving token, and a second sensitive data component associated with a second respective format-preserving token, and wherein the first and second respective format-preserving tokens preserve different formats;

cryptographically camouflaging each of the token keys using a first password;

transmitting each of the cryptographically camouflaged token keys from the end-user device to the tokenization server; and

storing each of the cryptographically camouflaged token keys.

2. The method of claim 1 , further comprising:

receiving a second password;

determining whether the first password is equal to the second password; and

in response to determining that the first and second password are equal:

decrypting each of the corresponding token keys; and

replacing each respective format-preserving token in the data file with the respective sensitive data components.

3. The method of claim 1 , wherein the respective format-preserving tokens are original format-preserving tokens, and further comprising:

receiving a second password;

determining whether the first password is equal to the second password; and

in response to determining that the first and second password are not equal:

generating a new respective format-preserving token for each of the plurality of sensitive data components; and

replacing each original format-preserving token in the data file with the respective new format-preserving token.

4. The method of claim 2 , wherein determining whether the first and second passwords are equal comprises:

receiving the second password at an end-user device;

determining the first password; and

comparing the second password to the first password.

5. The method of claim 1 , wherein said generating the respective format-preserving token for each of the plurality of sensitive data components is based on respective initialization vectors.

6. The method of claim 5 , wherein the respective initialization vectors are comprised of a prime number and an expiration date.

7. The method of claim 5 , wherein the data file further comprises a plurality of non-sensitive data components and wherein the respective initialization vectors are comprised of one of the non-sensitive data components.

8. The method of claim 1 , wherein the plurality of sensitive data components comprise first and second sensitive data components, and wherein the first sensitive data component comprises a valid primary account number and the second sensitive data component comprises a social security number, and wherein the first respective format-preserving token is visually indistinguishable from a valid primary account number and the second respective format-preserving token is visually indistinguishable from a valid social security number.

9. The method of claim 1 , wherein the corresponding token key for each of the format-preserving tokens comprises an encryption key and the respective format-preserving token.

10. A computer comprising:

one or more processors; and

a non-transitory computer-readable storage medium storing computer-readable instructions that are executable by the one or more processors to perform:

receiving a security profile comprising user-defined rules for identifying and processing sensitive data;

identifying a plurality of sensitive data components in a data file according to the security profile;

generating a respective format-preserving token for each of the identified plurality of sensitive data components on an end-user device that is remote from a tokenization server;

generating a corresponding token key for each of the respective format-preserving tokens;

replacing each of the plurality of sensitive data components in the data file with the respective format-preserving token;

cryptographically camouflaging each of the token keys according to a format-preserving encryption technique using a first password;

transmitting each of the cryptographically camouflaged token keys from the end-user device to the tokenization server; and

storing each of the cryptographically camouflaged token keys;

wherein the plurality of sensitive data components comprise a first sensitive data component associated with a first respective format-preserving token, and a second sensitive data component associated with a second respective format-preserving token, and wherein the first and second respective format-preserving tokens preserve different formats.

11. The computer of claim 10 , wherein the computer-readable instructions are executable by the one or more processors to perform:

receiving a second password;

determining whether the first password is equal to the second password; and

in response to determining that the first and second password are equal:

decrypting each of the corresponding token keys; and

replacing each respective format-preserving token in the data file with the respective sensitive data components.

12. The computer of claim 10 , wherein the respective format-preserving tokens are original format-preserving tokens, and wherein the computer-readable instructions are executable by the one or more processors to perform:

receiving a second password;

determining whether the first password is equal to the second password; and

in response to determining that the first and second password are not equal:

generating a new respective format-preserving token for each of the plurality of sensitive data components; and

replacing each original format-preserving token in the data file with the respective new format-preserving token.

13. The computer of claim 11 , wherein determining whether the first and second passwords are equal comprises;

receiving the second password at an end-user device;

interrogating the tokenization server to determine the first password; and

comparing the second password to the first password.

14. The computer of claim 10 , wherein said generating the respective format-preserving token for each of the plurality of sensitive data components is based on respective initialization vectors.

15. The computer of claim 14 , wherein the data file further comprises a plurality of non-sensitive data components and wherein the respective initialization vectors are comprised of one of the non-sensitive data components.

16. The computer of claim 10 , wherein the plurality of sensitive data components comprise first and second sensitive data components, and wherein the first sensitive data component comprises a valid primary account number and the second sensitive data component comprises a social security number, and wherein the first respective format-preserving token is visually indistinguishable tram a valid primary account number and the second respective format-preserving token is visually indistinguishable from a valid social security number.

17. A non-transitory computer readable storage medium storing instructions that are executable to cause a system to perform operations comprising:

receiving a security profile comprising user-defined rules for processing sensitive data in a data file;

identifying a sensitive data component in the data file according to the security profile;

generating a respective format-preserving token for the identified sensitive data component on an end-user device that is remote from a tokenization server:

generating a corresponding token key for the respective format-preserving token;

replacing the sensitive data component in the data file with the respective format-preserving token;

wherein the plurality of sensitive data components comprise a first sensitive data component associated with a first respective format-preserving token, and a second sensitive data component associated with a second respective format-preserving token, and wherein the first and second respective format-preserving tokens preserve different formats;

encrypting the corresponding token key using a format-preserving cryptographic camouflage encryption technique and a first password; and

transmitting the cryptographically camouflaged token key to a tokenization server; wherein the corresponding token key for the respective format-preserving token comprises an encryption key and the respective format-preserving token.