Format-Preserving Tokenization for Sensitive Data Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data security techniques, such as encryption, face challenges in maintaining transparency and field validation, especially in financial data processing, where encrypted data no longer resembles the original format, affecting applications like sorting and searching, and tokenization methods require online token requests, increasing overhead and vulnerability.
Innovation Solution
A method that uses format-preserving tokens generated using format-preserving encryption (FPE) to replace sensitive data components, allowing these tokens to maintain the original format and structure, and cryptographic camouflage to secure token keys, enabling offline token generation and secure transmission.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If encryption is used to protect sensitive data, then security is improved, but data format and structure are lost affecting sorting and searching operations
Solution Approach 1:
The patent creates format-preserving tokens that are copies of the original sensitive data but with altered content. These tokens replicate the exact format, structure, and validation rules of the original data, allowing them to be processed by existing systems without modification while protecting the actual sensitive information.
Solution Approach 2:
The patent transforms sensitive data into tokens by changing the content parameters while preserving the format parameters. The tokens maintain the same data type, length, structure, and validation characteristics as the original data, enabling seamless integration with existing processing systems.
2Reliability
If traditional tokenization is used to protect sensitive data, then security is improved, but online token requests are required increasing system overhead and vulnerability
Solution Approach 1:
The patent performs tokenization locally on the device before data transmission or storage. By generating format-preserving tokens offline using local cryptographic keys, the system eliminates the need for continuous online communication with tokenization services, reducing system overhead and attack surfaces.
Solution Approach 2:
The patent enables devices to autonomously generate and manage their own format-preserving tokens using locally stored cryptographic keys. This self-service capability eliminates dependency on external tokenization services, reducing system complexity and improving security by keeping sensitive operations local.
Data Source
AI summary
A method includes receiving a security profile comprising user-defined rules for processing sensitive data, and identifying a plurality of sensitive data components in a data file according to the security profile. The method further includes generating a respective format-preserving token for each of the identified plurality of sensitive data components. The method additionally includes generating a corresponding token key for each of the respective-format preserving tokens, and replacing each of the plurality of sensitive data components in the data file with the respective format-preserving token. Further, the method includes cryptographically camouflaging each of the token keys using a first password and storing each of the cryptographically camouflaged token keys.