Cloud Tokenization via Keyed Hash Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional tokenization techniques are not suitable for long-term storage due to low-entropy encryption issues and reversibility problems, leading to security concerns and retrieval challenges.
Innovation Solution
A system that combines high-entropy long-term storage encryption with short-term network encryption, using a keyed hash function from a key management system to generate storage tokens, ensuring reversibility and consistency across multiple data centers, while employing reversible tokenization and salting to enhance security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional low-entropy encryption techniques are used for tokenization, then the tokenization process is simple and fast, but the security of stored tokens is compromised
Solution Approach 1:
The system divides tokenization into two separate processes: network tokenization (low-entropy, reversible) for transaction processing and storage tokenization (high-entropy, irreversible) for long-term storage. This segmentation allows each process to use appropriately complex encryption methods without compromising the other.
Solution Approach 2:
The patent introduces a tokenization service as an intermediary component that manages the conversion between network tokens and storage tokens. This intermediary handles the complex high-entropy encryption process, shielding the application layer from complexity while maintaining security.
2Reliability
If non-deterministic encryption with salting is used to increase entropy, then security is improved, but token conflicts occur in long-term storage
Solution Approach 1:
The system separates the salting mechanism from the storage tokenization process. Salting is applied only during network tokenization, while storage tokenization uses deterministic hashing without salts, ensuring consistent tokens across multiple data centers while maintaining security through the initial salting step.
Solution Approach 2:
The system performs preliminary tokenization with salting at the network layer before data is stored. This preliminary action creates a deterministic base that can then be consistently stored without requiring repeated salting operations that would cause conflicts.
3Reliability
If secure irreversible encryption is used for tokenization, then security is enhanced, but the ability to retrieve original information is lost
Solution Approach 1:
The patent creates two distinct token types with different properties: network tokens that are reversible for transaction processing and storage tokens that are irreversible for secure long-term storage. This segmentation allows the system to maintain both retrievability and security for different operational contexts.
Solution Approach 2:
Different parts of the system use different tokenization approaches: the network layer uses reversible tokenization where retrievability is needed, while the storage layer uses irreversible high-entropy tokenization where security is paramount. Each layer has the appropriate quality for its specific function.
Data Source
AI summary
Systems and methods for tokenization in a cloud-based environment. The disclosed systems and methods may perform operations including receiving input to be tokenized; obtaining a keyed hash function from a key management system; using the keyed hash function to generate a storage token for the input; creating an encrypted database entry linking the generated token to the received input; setting an expiry for the storage token; and when the storage token is received before the expiry, providing the linked input in response.