Public-Cloud Payment Data Tokenization with Namespace Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Distributing sensitive data, such as credit and debit card information, on public clouds increases the risk of inappropriate access and theft due to potential breaches.
Innovation Solution
Implementing a tokenization service in the public cloud that generates tokens for sensitive data, encrypts them, and associates the tokens with encrypted data, using reserved digits to prevent identification as payment tokens and isolate data through namespaces, thereby protecting sensitive information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If sensitive data is distributed on public cloud, then data accessibility and service delivery are improved, but security risk and vulnerability to breaches increase
Solution Approach 1:
The patent introduces tokens as intermediary elements that replace sensitive data in cloud environments. Tokens cannot be reverse-engineered to reveal original data, creating a protective layer that maintains accessibility while eliminating the security risk of exposing sensitive information on public clouds
Solution Approach 2:
The system creates token copies that represent sensitive data without containing the actual sensitive information. These token copies can be freely distributed and accessed in the cloud, providing the benefits of data accessibility without the security vulnerabilities of distributing actual sensitive data
2Reliability
If tokens are generated for sensitive data, then data security is improved, but system complexity increases due to token management infrastructure
Solution Approach 1:
The tokenization service performs multiple functions within a single system: generating tokens, validating tokens, mapping tokens to sensitive data, and managing token lifecycles. This multi-functional approach consolidates complexity into a dedicated service rather than distributing it across multiple components
Solution Approach 2:
The tokenization service acts as an intermediary layer between applications and sensitive data, handling all token-related operations centrally. This mediator approach simplifies the overall system architecture by creating a single point of management for token operations rather than requiring each application to implement its own tokenization logic
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Systems and methods for tokenizing data in a public cloud are disclosed. According to an embodiment, a method may include: (1) receiving, at a tokenization service in a public cloud and from a client application, source data associated with one of a plurality of namespaces; (2) generating, by the tokenization service, a token for the source data according to a token format rule, wherein the token format rule specifies one or more digit in the token format that are reserved; (3) encrypting, by the tokenization service, the source data; (4) associating, by the tokenization service, the token with the encrypted source data; (5) persisting, by the tokenization service, the association between the token and the encrypted source data in a token table in the public cloud; and (6) providing, by the tokenization service, the token to the client application.