Public Cloud Tokenization Service for PCI Data Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Distributing sensitive Payment Card Industry data on public clouds increases the risk of inappropriate access or theft due to the need for data to be shared across internal and external applications.
Innovation Solution
Implementing a tokenization system in the public cloud that generates tokens for sensitive data, encrypts the data, associates the token with the encrypted data, and persists this association in a token table, while also computing and persisting a hash of the data for secure data protection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If sensitive Payment Card Industry data is distributed across internal and external applications on public cloud, then data accessibility and business service delivery are improved, but the risk of inappropriate access and data theft increases
Solution Approach 1:
The patent introduces tokens as intermediary objects that replace sensitive Payment Card Industry data in applications. The tokenization service acts as a mediator between data storage and application access, allowing applications to use tokens instead of actual card data. This resolves the contradiction by maintaining data accessibility through token operations while eliminating the security risk of exposing sensitive data across distributed systems.
Solution Approach 2:
The patent creates token copies that represent sensitive data without containing the actual sensitive information. These token copies can be distributed across applications and cloud environments, enabling data accessibility while preventing theft since tokens cannot be reverse-engineered to reveal the original card data. The token table stores the mapping between tokens and encrypted source data securely.
2Reliability
If tokens are generated with reserved digits to prevent identification as payment tokens, then security is improved, but token format complexity increases
Solution Approach 1:
The patent applies local quality by reserving specific digit positions in the token format for particular functions. The first digit is reserved to prevent payment token identification, while other digits may be reserved to identify namespaces. This localized assignment of special meanings to specific token positions enhances security without requiring complete format complexity throughout the entire token structure.
Data Source
AI summary
Systems and methods for tokenizing data in a public cloud are disclosed. According to an embodiment, a method may include: (1) receiving, at a tokenization service in a public cloud and from a client application, source data associated with one of a plurality of namespaces; (2) generating, by the tokenization service, a token for the source data according to a token format rule, wherein the token format rule specifies one or more digit in the token format that are reserved; (3) encrypting, by the tokenization service, the source data; (4) associating, by the tokenization service, the token with the encrypted source data; (5) persisting, by the tokenization service, the association between the token and the encrypted source data in a token table in the public cloud; and (6) providing, by the tokenization service, the token to the client application.