Format-Preserving Tokenization with Base Conversion for Short Data Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional tokenization schemes used by services and platforms like BaaS, SaaS, FinTech, IaaS, and PaaS are vulnerable to reverse-engineering and decryption due to brute force attacks, especially for short strings of sensitive information.
Innovation Solution
A tokenization method that alters the original input string length and applies numeric base changes, combined with format-preserving encryption and shuffling through randomly generated tables, using hardware security modules to generate secure tokens that cannot be reverse engineered.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional encryption tokenization is used, then implementation simplicity is maintained, but security against brute force attacks deteriorates for short strings
Solution Approach 1:
The tokenization process is divided into multiple independent stages: format-preserving encryption, base conversion, and shuffling with randomly generated tables. Each stage adds a layer of security while maintaining modular implementation, making the overall system resistant to brute force attacks without requiring a single complex monolithic algorithm.
Solution Approach 2:
The patent applies format-preserving encryption that maintains the original string format and length, then transforms the encrypted string into a different numeric base. This parameter transformation (base conversion) creates additional complexity for attackers while preserving the original data structure for legitimate use cases.
2Reliability
If token length is increased to prevent brute force, then security improves, but the ability to handle short sensitive data deteriorates
Solution Approach 1:
The system uses format-preserving encryption that maintains the original string length and format, then applies base conversion to increase the effective complexity. This allows short strings (e.g., 4-digit PINs) to be secured without extending their visible length, as the security enhancement comes from the encryption and base transformation rather than length extension.
Solution Approach 2:
Instead of increasing token length in one dimension, the patent adds multiple dimensions of security: format preservation, base conversion, and shuffling with randomly generated tables. This multi-dimensional approach provides strong security for short strings without requiring length extension.
3Reliability
If multiple encryption layers are applied, then security against brute force improves, but processing time increases
Solution Approach 1:
The encryption process is segmented into distinct operations: format-preserving encryption, base conversion, and shuffling with randomly generated tables. Each operation is optimized and independent, allowing for efficient processing while maintaining strong security. The segmented approach prevents any single operation from becoming a performance bottleneck.
Solution Approach 2:
The system uses randomly generated tables that are pre-computed and stored, allowing the shuffling operation to proceed quickly during tokenization without requiring complex real-time calculations. This copying of pre-generated tables enables fast processing while maintaining security through the randomness of the tables.
Data Source
AI summary
Disclosed herein are system, method, and computer program product embodiments for tokenization by obfuscating a length of personal information through addition of one or more digits and modifying a base of the input string before encryption. In one process, a security string is added to a user information input string of a first length and first base to generate a second string of a longer length, a format preserving encryption (FPE) is performed to generate a new string of the another length and base, and converted into a token of the first length but different base.