Dynamic Tokenization Table Exchange via Nonce-Based Key Derivation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing tokenization tables are static, leading to security issues when compromised and requiring full table exchange for size changes, which increases risk and inefficiency.
Innovation Solution
A method involving the computation of network device nonces and key derivation functions to dynamically update tokens in tokenization tables, allowing for secure and partial table updates over a network.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the whole tokenization table is encrypted and sent over the network to resolve security issues, then security is improved, but the risk of data compromise increases when data is transmitted across unsecure networks
Solution Approach 1:
The patent extracts only the necessary token data from the tokenization table for transmission over the network, rather than sending the entire table. This reduction in transmitted data minimizes the attack surface and potential impact of network interception, while still achieving the security goal of updating tokens across devices.
Solution Approach 2:
The patent performs preliminary encryption and token generation on the local device before transmission. Tokens are encrypted using device-specific keys and algorithms before being sent to other devices, ensuring that even if transmission is intercepted, the data remains secure. This preliminary security measure resolves the contradiction by maintaining security without requiring unsecure transmission of plaintext data.
2Adaptability or versatility
If the whole tokenization table is exchanged when the size changes, then the tokenization table can be updated, but efficiency decreases and unnecessary data is transmitted
Solution Approach 1:
The patent segments the tokenization table update process into individual token transmissions rather than transmitting the entire table. When the tokenization table size changes, only the specific tokens that need to be added, removed, or modified are exchanged between devices. This segmentation dramatically improves update efficiency by reducing the volume of transmitted data while maintaining full adaptability of the tokenization table.
Solution Approach 2:
The patent applies partial action by transmitting only the necessary portion of the tokenization table that has changed or needs updating. Instead of exchanging the entire table, the system identifies and transmits only the specific tokens affected by size changes or updates, reducing network overhead and improving efficiency while achieving the required adaptability.
3Device complexity
If static tokens are used in the tokenization table, then simplicity is maintained, but security deteriorates when tokens are compromised
Solution Approach 1:
The patent implements dynamic token generation and update mechanisms while maintaining a relatively simple tokenization table structure. Tokens can be dynamically updated, regenerated, or revoked based on security requirements, device changes, or compromise detection. This dynamic capability enhances security without significantly increasing the complexity of the tokenization table itself, as the underlying structure remains simple while the content can change over time.
Solution Approach 2:
The patent changes the parameter of token stability from static to dynamically changeable. Tokens are no longer fixed but can be updated with new values based on security events, device registration, or administrative decisions. This parameter change from static to dynamic resolves the security issue while maintaining simplicity through standardized update procedures and a consistent tokenization table structure.
Data Source
AI summary
A first network device nonce is computed. The first network device nonce is based on a first network device secret. A Change Token Table message (CTTM) is sent to a second network device. The CTTM comprises the first network device nonce. A Change Token Table Ack Message (CTTAM) with a second network device nonce is received from the second network device. A new token for a tokenization table is computed based on the first network device secret, the second network device nonce, a prime number, and a key derivation function. The new token for the tokenization table is also computed by the second network device based on a second network device secret, the first network device nonce, the prime number, and the key derivation function.